In this photo illustration, an age-verification screen is displayed on the website Pornhub. The U.K. requires sites and platforms hosting harmful content such as pornography to have age-verification systems to stop children from accessing them. Canada is considering similar legislation.Jack Taylor/Getty Images
Jake Pitre is a freelance writer and academic based in Montreal.
Canada’s proposed Bill S-209, which addresses online age verification, is currently making its way through the Senate, and its passage would be yet another mistake in tech policy.
The bill is intended to restrict young peoples’ access to online pornography and to hold providers to account for making it available to anyone under 18. It may be well-intentioned, but the manner of its proposed enforcement – mandating age verification or what is being called “age-estimation technologies” – is troubling.
Globally, age-verification tools are a popular business, and many companies are in favour of S-209, particularly because it requires that websites and organizations rely on third parties for these tools. However, they bring up long-standing concerns over privacy, especially when you consider potential leaks or hacks of this information, which in some cases include biometrics that can identify us by our faces or fingerprints.
This is presumably where the age-estimation tools could come in, as they would collect less information while determining a user’s age with the assistance of AI, though this introduces the obvious risk of inaccuracy. Even if the service plans to delete biometrics after verification, a data breach of this material, most likely operated by third parties outside of Canada, would plainly be catastrophic.
New bid to prevent children from watching porn online could use face or hand scans to verify age
Canada’s government is not alone in using de-anonymization as its tool for regulation. Earlier this year, Britain introduced age verification under its Online Safety Act. The typical requirement to simply check a box to state you’re 18 or older on porn websites is, obviously, not enough to stop underage users from viewing it.
In Britain, age checks are done via facial age estimation, verification through your bank or mobile network provider, a digital wallet check, or other forms of photo ID matching. All these methods are being considered under S-209.
From there, Britain recently introduced the next logical step: a form of digital ID for all workers called a “BritCard,” which is intended to combat illegal immigration. It will ostensibly be stored on your phone and will prove one’s right to work in the country, though it has already faced backlash for similar concerns over privacy, data security, and the further marginalization of migrants and the homeless.
Pushing for age verification and for digital ID in this form should be understood as parallel goals for an internet that is more tightly surveilled and under conditional access.
Canada, it seems, may be following this playbook. Despite Prime Minister Mark Carney promising there are no similar digital ID plans coming to Canada, the Liberal budget does in fact propose a digital ID system through the Department of Employment for benefit claimants – not a promising sign.
U.K. media regulator investigates 34 porn sites under new age-check rules
S-209 also includes a clear indication that offending sites will be blocked, which may prevent citizens from accessing “material other than pornographic material made available by the organization” – in other words, users would be banned from viewing otherwise-legal content along with the rest, which could include sexual and mental-health forums and communities.
Most of all, perhaps, and as Christiane Saad, chair of privacy and access with the Canadian Bar Association, has said: “It forces mandatory proof of age for everyone – ending anonymity and prompting people to hand over IDs or biometrics – while empowering risky enforcement measures like Internet Service Provider-level blocking. This constitutes a recipe for data breaches, mission creep, and censorship by default.” Under such rules, everyone would be forced to verify who they are as they explore the internet.
Whatever you may personally think about online pornography itself or the extent to which underage users are able to access it – a serious issue worthy of intervention – this bill nevertheless quite clearly threatens Canadians’ right to privacy and to anonymously browse the internet as we have done since its inception. The proposed tools for enforcing it are either too invasive or too unreliable. The bill must not pass.
Efforts such as these miss the mark in many ways, not least of which is that any potential efficiency in addressing illegal immigration or underage porn use would nonetheless be overwhelmed by fear, paranoia, loopholes, workarounds and economic exodus.
It’s not that expanding digital identification efforts is necessarily a non-starter. There are models that are better or worse, and each case is unique. The European Union’s plan for digital wallets, which has been slowly experimented with according to a privacy-focused framework, intends to let each user have power over their own data, selectively deciding what to share. However imperfect, it signals different priorities.
Politicians may be eager to look tough on Big Tech (too little, too late) or are seeking to protect children, but are too willing to upend democratic notions of privacy and security to do so.
Canadians deserve better leadership on how best to tackle such a complicated issue, with technical solutions that protect children while also preserving everyone’s privacy.