From mashable.comYouTube announced in late July that it would start using artificial intelligence for age verification. And this week, 9to5Google reported that the new system will go into effect on Aug. 13.
The new system will "help provide the best and most age-appropriate experiences and protections," according to YouTube.
"Over the next few weeks, we’ll begin to roll out machine learning to a small set of users in the US to estimate their age, so that teens are treated as teens and adults as adults," wrote James Beser, Director of Product Management with YouTube Youth, in a blog post. "We’ll closely monitor this before we roll it out more widely. This technology will allow us to infer a user’s age and then use that signal, regardless of the birthday in the account, to deliver our age-appropriate product experiences and protections."
The AI interprets a "variety of signals" to determine a user's age, including "the types of videos a user is searching for, the categories of videos they have watched, or the longevity of the account." If the system determines that a user is a teen, it will automatically apply age-appropriate experiences and protections. If the system incorrectly determines a user's age, the user will have to verify that they're over 18 with a government ID or credit card.
This comes at a time in which age verification efforts are ramping up across the world — and not without controversy. As Wired reported, when the UK began requiring residents to verify their ages before watching porn as part of the Online Safety Act, users immediately started using VPNs to get around the law.
Some platforms use face scanning or IDs, which can be easily faked. As generative AI gets more sophisticated, so will the ability to work around age verification tools. And, as Mashable previously reported, users are reasonably wary of giving too much of their private information to companies because of security breaches, as in the recent Tea app leak.
In theory, as Wired also reported, "age verification serves to keep kids safer." But, in reality, "the systems being put into place are flawed ones, both from a privacy and protection standpoint."
Samir Jain, vice president of policy at the nonprofit Center for Democracy & Technology, told the Associated Press that age verification requirements "raise serious privacy and free expression concerns," including the "potential to upend access to First Amendment-protected speech on the internet for everyone, children and adults alike."
"If states are to go forward with these burdensome laws, age verification tools must be accurate and limit collection, sharing, and retention of personal information, particularly sensitive information like birthdate and biometric data," Jain told the news outlet.
But it's more than just YouTube:
From 9to5mac.comThe four big problems
Massive overreach
While the legislation claimed to be addressing adult entertainment websites, it was later expanded to cover over 200 types of content, much of it very vaguely defined.
The British government’s own summary of the content affected reveals just how vague it all is:
Services must assess any risks to children from using their platforms and set appropriate age restrictions, ensuring that child users have age-appropriate experiences and are shielded from harmful content.
So far it appears that this includes use of social media apps, as well as online access to information on birth control, sexual hygiene, and information on reporting sexual abuse. A law claiming to protect teenagers will in many cases make it harder for them to access information that helps them protect themselves.
Some dating apps have already been requiring users to use a private identity verification service.
Unregulated access to sensitive personal data
Second, the law doesn’t tell websites and apps how they are supposed to verify the age of their users, meaning that services are making it up as they go along. In particular, there is concern about the use of private “identity verification” services demanding personal data like copies of passports in order to carry out age verification.
There have been many past examples of such companies failing to protect this highly-sensitive data. For example, US identity verification company AU10TIX was found to have exposed name, date of birth, nationality, identification number, and the type of document uploaded such as a drivers’ license – and to have included a photo of this document!
In short, these companies are not regulated and should absolutely not be given access to personal data. Some Reddit and Discord users are finding a way around this:
Can easily be misused by governments
- age_verification.jpg (38.29 KiB) Viewed 248 times
We’ve already noted the inadvertent inclusion of innocuous websites and apps, but a repressive government can easily add new categories to the legislation at the stroke of a pen.
For example, if a certain US president doesn’t like criticism from a political website, he could add those to the categories covered by the law, making them harder to access, and making people fear that their visits to the site now identify them.
Includes private message services, like iMessage and FaceTime
Finally, and most egregiously of all, section 122 says companies are supposed to scan private messages for illegal content.
This is of course impossible in the case of end-to-end encrypted (E2EE) platforms like iMessage, FaceTime, and WhatsApp. The government just waved its arms and said companies need to figure out how to do it.
While the government appears to be quietly backing-down from its attempt to force Apple to provide a backdoor into iCloud data, this law appears set to re-ignite the broader issue of E2EE.
It’s also easy to bypass
There’s also the small matter of the law proving completely ineffective: Virtual Private Network (VPN) apps, which allow UK users to appear to be in the US, shot up the App Store as soon as the measures kicked in. This prevents the age-checks from being triggered.
