Age verification for using social networks is an idea that is gaining traction in multiple countries around the world – it started in Australia, then the UK, and currently sees increasing support in France and other EU countries, as well as in the European Commission. The idea sounds simple – “social networks are proven to be detrimental to children’s mental health, and so they must not be allowed to use it. The way to do it is to add an age check before registration, so that only adults can use the service”.

While simple to formulate, it’s much more difficult to implement, if not impossible.

First, let’s be clear that I agree 100% that social networks, with their addictive design, their lack of content curation and mediocre attempts to protect children, are bad for minors. And policy makers, such as myself, as a member of parliament of an EU country, need to address that.

But age verification is hardly the right solution, as it’s problematic in many ways which I’ll try to describe here.

1. Privacy – the obvious, but rarely state fact, is that age verification is for every online user, not just for children. In order to limit children, you have to check everyone, and let only people about 18 (or 16) to use a given service. That poses serious privacy concerns and so policy makers are trying to find privacy-preserving solutions that don’t require users to show their face and identity document on every registration.

   “Age tokens” and “age attestations” have been discussed and even implemented. The EU even created a privacy-preserving app, with zero-knowledge prove, that proves the someone is above 18 without them disclosing any identity data (even their age) to the relying party (e.g. a social network). This, however, has problems with circumvention, which I’ll address in the 2nd point. The problem is that fully privacy-preserving solutions are going to be circumvented. If privacy is compromised – i.e. if the solution leaks identifiable information to service providers, age verification becomes “mandatory digital identity for everyone”. I’m a proponent for digital identity for a long time, but strictly optional and mostly for government services, no as a permission to use the internet.

   The French law was this weak blocked by the French Constitutional court based on privacy issues. And UK age verification examples have shown some disasters – e.g. one age verification company was found vulnerable and it became obvious that they don’t just check your age – they check you against multiple registers and lists, including for terrorism – which is logical if you want to use every opportunity to reduce risks, but that’s not “on the brochure”.

2. Circumvention – even if age verification is properly implemented, it can easily be circumvented by good old VPNs. However, as we know, VPNs are a gateway to a darker internet, where other safeguards and protections are also off. The reality in Australia and the UK is such that VPN usage spiked and many children continue to use social networks – so while governments created a privacy nightmare, they didn’t achieve the initial goal.

   But privacy-preserving age verification is possible and that’s why we have to address this very seriously. The EU has made a well-meaning attempt to design and implement a proper zero-knowledge proof of age. It’s a great tool, with proper cryptography, complex-yet-elegant. It has “just” one problem – it didn’t account for the actual “threat actor” in this scenario – the user, who would try many things to circumvent the age limitation. As security consultant Paul Moore has brilliantly shown, you don’t have to compromise the age verification app in order to circumvent the flow – by a simple relay attack, where you just present someone else’s verified age credentials in order to use a service. The proof of concept was implemented as a chrome extension which relays age checks to 3rd party service, backed by an over-18 person’s device, which sends the proof to the service. That way a single adult can verify the accounts of all minors, and because of the necessary privacy guarantees, the relying party (the social network) won’t even know.

   This is very likely to happen, which “age verification as a service” providers pop-up to help minors get into social networks. What’s worse – some of these providers may collect children’s personal data, including phone number or social network account ID, in order to provide them with the much coveted proof of age. That data, purposefully or after an inevitable data breach, may be used by sex predators to target children. There are completely realistic nightmare scenarios, born from the good intention to limit the negative effects of social networks.

   Even in a school context, a single over-18 (or over-16) student can lend their age verification app to help younger children register profiles. What are policy makers going to do then? Issue administrative fines for sharing age tokens/attestations? Criminilize it? It’s obviously the wrong path.

   There is one option that may improve this approach, but doesn’t fix it – binding the age attestation to a device ID, so that one device (physical or virtual) can have only one account. That, however, breaks the privacy guarantees – yes, it’s not a personal identifier, but a device identifier, but nevertheless, it allows linking and leaking. And may still be circumvented – with per-request virtual device creation, which would require rate-limiting of attribute providers functionality to attest age. So, broken privacy guarantees and further technical complication that are also likely to be circumvented when someone thinks about it for more than 2 days.

   There seems to be a fundamental mismatch between “perfect privacy” and “age verification” (as shown by Paul Moore as well), because if you achieve sufficient privacy guarnantees (like the one in the EU app), a relay attack makes the whole approach useless. And if you ignore or weaken privacy, the whole measure becomes much more problematic.

3. Adoption by social networks – every relying party (social network or other age-restricted service) has to implement the age verification flow. Some may get it wrong, have bugs. But some may decide not to implement it. What’s the penalty for that – huge fines and ultimately – a total ban from the EU? For larger platforms that may not be a good option commercially, but for others, especially non-profits, niche players, etc, it may be the preferred option. This approach also limits EU’s and EU countries flexibility in determining who has to comply – it’s not just a monthly-updated list of age-restricted services; it’s a complicated compliance process, implementing custom, location-based registration and confirmation flows, compliance analysis, legal documents, whatnot.

Obviously, “showing your ID card to the cashier” is not as trivial in the digital world as it is in the physical world. That already leads to a backlach, and policy makers should be aware of those limitations.

The title of this post ends with a question – what’s the alternative? My proposal has two components:

1. Limit the addictive features of social networks and present age-appropriate versions, with age-restricted content – yes, that’s harder for social networks, and it will lead to a drop in monetization. Because such a proposal will likely focus not only on children, but on adults as well – addictive feeds and endless reels are problematic for adult users as well. And policy makers will have to answer why they are not protecting everyone, if they have the legal instrument to do it?
2. More heavy reliance on parental control apps – parental control apps are rudimentary nowadays, and maybe that’s for a reason. They are not popular, unintuitive, buggy. But they can be regulated and fixed. What’s more – they can have government-mandated blacklists for children, based on age. For example, a state agency for children protection can publish a blacklist of apps and domains that the parental control apps have to import automatically. Legislators can also require these apps to be pre-installed on every phone sold in their country. This would still leave parents in control – if they trust their children to be responsible, they can fine-tune the settings.

   Certain apps can be banned for under-14, others for under-16 and others – for under-18. Governments would be much better control over the exact services they deem risky for children, without the need for any changes on the service’s side. Or, if an app vendor wants to have it whitelisted, they may have to implement children-friendly versions.

   Going further, this may eventually lead to platform-level parental control APIs, so that each app can read parental control settings, and on the other hand export parental control configuration options to be used in the parental control app.

This approach is much better from political point of view – it’s not that government that decides – it’s the parent, but with guidance from the government, which provides reasonable defaults, which the parent can override.

These controls are much harder to circumvent – you can’t VPN out of an OS-level ban or an OS-level firewall which blocks outgoing connections, regardless of which your ISP is. It’s completely privacy-preserving, as users don’t have to show or prove anything.

Of course, the harder part is making sure every child and parent has a parental control app installed. Information campaigns and teachers can help with that, and I’m sure it will achieve much better results than what we are seeing in Australia for example.

Children protection agencies can even receive statistics for the number of changed preferences, to monitor for trends of parents just giving up and allowing whatever app the child wants. That’s why the first point in the above proposal is important – limit the addictiveness and brainrot on these platforms as a general rule, not just as a measure to protect children.

The problem is real, The Anxious Generation is spot in, and this mental health pandemic can have devastating long-term effects. That’s why we have to make the best possible decision on how to address it.

The post Age Verification Is A Bad Way To Solve The Problem of Children on Social Networks. What’s The Alternative? appeared first on Bozho's tech blog.