The UK has become the first major country to introduce a legal requirement for internet age verification, but it affects all websites and apps worldwide. Additionally, the US has recently revived a bill very similar to the British legislation.

While the law was presented as a way to prevent children accessing adult websites, the reality is very different, and we’re already seeing the privacy risks of good intentions being turned into bad legislation – with iMessage and FaceTime in the firing line …

The UK’s took effect on Friday, and made websites and apps legally responsible for preventing kids accessing “age-inappropriate content.” Complying with this law requires companies to verify the ages of all their users.

We noted last week that very similar legislation in the US known as the was passed in the Senate last year before stalling, but has since been reintroduced in the House and looks likely to become law this year.

While the legislation claimed to be addressing adult entertainment websites, it was later expanded to cover over 200 types of content, much of it very vaguely defined.

The British government’s own summary of the content affected reveals just how vague it all is:

Services must assess any risks to children from using their platforms and set appropriate age restrictions, ensuring that child users have age-appropriate experiences and are shielded from harmful content.

So far it appears that this includes use of social media apps, as well as online access to information on birth control, sexual hygiene, and information on reporting sexual abuse. A law claiming to protect teenagers will in many cases make it harder for them to access information that helps them protect themselves.

Some dating apps have already been requiring users to use a private identity verification service.

Second, the law doesn’t tell websites and apps how they are supposed to verify the age of their users, meaning that services are making it up as they go along. In particular, there is concern about the use of private “identity verification” services demanding personal data like copies of passports in order to carry out age verification.

There have been many past examples of such companies failing to protect this highly-sensitive data. For example, US identity verification company AU10TIX was found to have exposed name, date of birth, nationality, identification number, and the type of document uploaded such as a drivers’ license – and to have included a photo of this document !

In short, these companies are not regulated and should absolutely not be given access to personal data. Some Reddit and Discord users are finding a way around this:

We’ve already noted the inadvertent inclusion of innocuous websites and apps, but a repressive government can easily add new categories to the legislation at the stroke of a pen.

For example, if a certain US president doesn’t like criticism from a political website, he could add those to the categories covered by the law, making them harder to access, and making people fear that their visits to the site now identify them.

Finally, and most egregiously of all, section 122 says companies are supposed to scan private messages for illegal content.

This is of course impossible in the case of end-to-end encrypted (E2EE) platforms like iMessage, FaceTime, and WhatsApp. The government just waved its arms and said companies need to figure out how to do it.

While the government appears to be quietly backing-down from its attempt to force Apple to provide a backdoor into iCloud data, this law appears set to re-ignite the broader issue of E2EE.

Photo by on