Online age verification explained (Part 2/3): What means what, how it’s done, and balancing child rights and safety

Have you ever had to show a physical identification (ID) card when purchasing movie tickets or certain over-the-counter medications? When entering a nightclub, has security given you a quick glance to guess your age? While browsing the internet, ever clicked on a button to state you’re old enough to enter a website? These are all forms of age-based restrictions, each with their own terms and methods, but they work very differently and involve very different trade-offs. How we decide to regulate and implement them online might significantly change our experience of the internet in the years to come. Welcome back to our three-part blog post series on age verification online. In Part One, our introductory blog post, we explained why Wikimedians should care about the current wave of age verification mandates. We went over some of the key moments and decisions in the regulatory history of the internet. We also highlighted how many of our concerns have to do with the fact that the Wikimedia projects are entirely different from commercial online platforms: they have a lower risk profile, exist for the public interest, and moderate content through a transparent, decentralized, and community-driven model. If you read that blog post already, you probably noticed that we also used terms like “age-based restrictions” and “age assurance.” Also, if you’ve followed news reporting on the topic, you most likely have come across other terms, for instance, “age gating.” Sometimes these terms are used interchangeably, causing confusion, because there are differences in their meanings. For that reason, this second post unpacks these terms to make sure that we’re on the same page when talking about the topic. We’ll also mention the main technological methods used for age verification, noting the potential consequences for online users when age and identity estimates are incorrect—especially privacy risks, but not only. Doing so allows us to highlight why we have concerns about the ways in which online age verification might affect our human rights commitments, which shape the data privacy and other policies that exist to protect Wikimedians and readers. Lastly, because legislation and regulation need to balance restrictions—even those attempting to ensure safety—with digital rights, we’ll go over the benefits that the Wikimedia projects offer minors, particularly regarding the exercise of their rights to education and to access reliable information. As a preview of Part Three, know that we’ll explore legislation in several countries that serve as concrete examples of how regulations can impact the Wikimedia projects. We’ll also tell you about the challenges we face as the global complexity of these laws, and how we’re engaging with governments and courts throughout the world—to make sure that legislators understand the value of the Wikimedia model, and that efforts to make our online experiences safer need to go hand in hand with promoting and protecting the best spaces the internet, Wikimedia projects included. Age verification: Related terms and methods The following are a few of the more common terms you’ll find in conversations about age-based restrictions and some very short explanations of what they typically mean—although there are some inconsistencies in usage even among technology and public policy experts. Rather than organize them alphabetically, we’ve done some from most general to most specific, also making sure to order them so that terms needed to understand other terms are already defined by the time you get to them. They are as follows: Age gating: The practice of providing different experiences to online users based on their ages. Age assurance: An umbrella term that includes all of the various ways of assigning an age or age range to a particular internet user. Self-attestation (or self-declaration): The most common type of age assurance used for many years, which requires users to input their own age, select their birth date or otherwise assert that they are above or below some age threshold. You’ve probably encountered this type of system before, which can be as simple as a check box stating “I am over the age of X. Age estimation: An educated guess that a provider makes about a user’s age. Methods vary, but these estimates typically involve inferring a user’s age based on online attributes or behaviors associated with that user, for instance: whether they have a credit card, the age of their account, or biometric data like scans of their face. Age verification: A requirement that users prove their ages, which typically involves uploading a government-issued identification that states the user’s age and submitting to a biometric facial scan to prove that the identification belongs to the user. Identity-based verification: A form of age verification in which a user’s real identity is associated with their online account. Digital identity: A form of identification consisting of a validated digital document, including mobile driver’s licenses (mDL) and other electronic identification (eID). With the most common terms defined now, we can explore how they are implemented technologically, and examine the level of confidence or accuracy they tend to exhibit, including some of the complications that may result from when they incorrectly estimate age and/or identity. Age verification technologies This is an emerging field of imperfect technological solutions to social problems. Both the technology and the laws in this area of digital policy are very much works in progress. Flaws, limitations, and modes of failures are still being identified. None of the currently available methods of age assurance provide a high degree of confidence or accuracy without increasing privacy risks. It’s important to understand that when website or app providers perform age gating, they might do so for different reasons, and they might use one or more methods of age assurance. In some cases, this means younger users are simply blocked from accessing the website or app. In other cases, younger users may see a different version of the website or app, including different design features and different content. In addition, the methods that providers use vary in terms of their precision, accuracy, and confidence. For instance, the simplest method of self-attestation—i.e., the check box stating that a user is over a certain age—is disfavored by many lawmakers: it provides a very low level of confidence that the user’s age is accurate, since nothing prevents the user from lying about how old they are. To be clear, age estimation is far more accurate than self-attestation, but less precise and less accurate than age verification. Estimating age also provides more flexibility for users, who may lack the government-issued ID often required for verifying their age. However, age estimation methods may incorrectly assign an age or age range to users who are near the age threshold, and may exclude certain groups that are already marginalized. Other methods of age assurance include several forms of age estimation, each with their own unique drawbacks, including: - Biometric estimation (usually based on facial features, and prone to error for some skin tones and face shapes); - Estimates based on associated accounts and transactional data (requires sharing lots of data with third parties); and even, - Artificial intelligence (AI) analyses of a user’s interactions online (privacy invasive and potentially inaccurate for many users). You can read more about the various methods and forms of age assurance here and here. Age verification provides higher levels of accuracy and confidence than age estimation, which explains why it is perhaps the most common method of age assurance currently in use. However, because it involves requiring a government-issued photographic ID and a biometric facial scan, this sharing of far more personal information than other methods raises greater privacy and security concerns. Identity-based verification methods present other risks as well: tens of millions of people in the US and as many as 850 million people around the world lack a government-issued photo ID, making it impossible for them to access websites requiring this form of age assurance. Some governments have established digital identity such as electronic identification (e-ID) systems or have begun accepting digital ID such as mobile driver’s licenses. Although these are identity verification methods, because these e-IDs can also be used for age verification, the European Union (EU) is working to establish both e-IDs and age verification systems side by side. Associating users’ identities with their online accounts goes beyond age verification because a person’s identity is not necessary to perform age gating. For these reasons, identity verification raises even greater privacy and security concerns, and also undermines the benefits of anonymity and pseudonymity online—which enable democratic participation and speaking truth to power. Given this plurality of technological approaches, a range of entities—companies, platforms and apps, and governments—are developing and deploying age assurance and verification methods. Some of the larger technology companies are voluntarily implementing their own age estimation methods for their platforms and services—for example, Google and Facebook. The majority of websites and apps with some kind of age assurance use third-party services, like Yoti or k-ID, which provide several methods. This industry has already grown large enough to develop its own trade associations and even an industry awards event, which means there are now also financial incentives for some companies to encourage the adoption of even more age assurance mandates. Even some governments have developed their own age verification apps (see the EU technical portal here), although they, like the private companies, are facing challenges in building and maintaining secure, trustworthy products. Age verification and the human rights of Wikimedia users In the previous sections, we explored the terms used in the online age verification debate and the technological methods employed to implement age gating. This allows us now to highlight more clearly why privacy risks can negatively impact the safety of Wikimedia users, both volunteers and readers, who can reap many benefits when empowered to access and participate in encyclopedic, open knowledge. The Foundation’s human rights commitments inform how we provide a safe experience for people of all ages, including how we respond to online child safety laws and age gating mandates. In addition, since our goal is a world where everyone, everywhere, can freely participate in the sum of all human knowledge, we consider very carefully how every legislation and regulation can affect the fundamental, inalienable rights of readers and users, whichever age they might be, either intentionally or inadvertently. Freedom of expression, including the ability to share and access free and open knowledge without fear of retaliation, depends on protecting the privacy of Wikimedia volunteers and readers, regardless of their age. For example, our commitment to privacy and data minimization make it impossible for us to know the ages of the people who read or contribute to the projects—and, because of that, how many minors do so—but this also helps to protect the real identities of volunteers and readers alike. When a person’s real identity can be linked to their online activity, like reading or editing Wikimedia projects, they are at greater risk of harassment or retaliation. Not only that, but fear for their own safety can also lead to self-censorship and a chilling effect, limiting what people read on the projects and/or contribute to them. Our Human Rights Impact Assessment and Child Rights Impact Assessment, which were produced by independent experts, reaffirm that young people possess the same human rights as adults. This doesn’t only mean privacy, but means freedom of expression and access to reliable information as well. Furthermore, these reports identify that access to online information and educational resources can support children’s—as well as adults’—rights to education, freedom of expression, health, and cultural participation as ethnic, religious, and/or linguistic minorities. In this sense, open knowledge platforms like Wikipedia can help reduce barriers to learning by making high-quality information freely available regardless of geography or socioeconomic background. This is particularly important for children and young people who may otherwise have limited access to educational materials or diverse sources of information. Likewise, digital platforms can provide opportunities for minors to share ideas, contribute knowledge, engage in public discourse, and participate in communities that reflect their interests and identities. These opportunities can support confidence, creativity, civic engagement, and a sense of agency. In addition, online participation can help children develop digital literacy, critical media literacy, research skills, and other critical thinking capabilities that are increasingly essential for participation in modern society. Online communities may also provide social connection, peer support, and inclusion, including for children who face barriers to participation offline due to disability, geography, language, or marginalization. Where do we go from here? There are policy proposals aimed at supporting education, research skills, and other proactive measures to empower people of all ages to safely engage with others online. We encourage policymakers to prioritize these proposals, not just because education, research, and empowerment are key elements of contributing to Wikimedia projects, but because they are essential to civic participation and democratic governance. We also encourage that when they consider these or any other proposals, they employ the Wikipedia Test: a reminder to take into account how new laws can negatively affect online communities and platforms that provide services and information in the public interest. In the last post of our blog post series, Part Three, as we mentioned before, we’ll look at some of the legislative and regulatory approaches to using age verification to promote online safety for young people, as well as some of the Wikimedia Foundation’s responses to them. Whether such approaches effectively advance online safety remains an open question, and we encourage you to consider your own online experiences together with the changes that many regulators are proposing across the world. _______ Subscribe to our newsletter to stay informed on digital policy, Wikipedia, and the future of the internet. For media inquiries, please contact or direct members of the press to press@wikimedia.org. Can you help us translate this article? In order for this article to reach as many people as possible we would like your help. Can you translate this article to get the message out? Start translation