‘Mission Impossible’ masks, bad data and immature tech dog age verification for social media

Yet another state has signed into law restrictions on young people’s use of social media, again relying on platforms to use age verification technology to check users’ ages. But the latest effort comes as concerns about the reliability and safety of identity verification online mount.

Tennessee Gov. Bill Lee recently signed legislation with regulations similar to those first established in Utah, and later built upon in Arkansas and Florida, among other states. The legislation requires parental consent for a minor to become an account holder or to keep their existing accounts, and mandates that social media companies not retain any information they used to verify someone’s age.

Despite the widespread use of online identity verification technology in other countries and the reliance on it in state laws, new research suggests that the approach faces numerous problems, including risks like document fraud, so-called “selfie spoofing” and artificial intelligence-driven deepfakes. Those issues could not only scupper efforts to verify identities online, but also put people’s privacy at risk.

A recent report from the public policy think tank New America’s Open Technology Institute reflected this, as it warned that age verification mandates “may actually pose more risks than benefits.”

“Many social media platforms and other online operators already implement a wide range of age assurance practices to comply with existing laws and uphold their own terms and conditions,” the report said. “These methods aren’t perfect, but mandating age verification, which often necessitates sharing government-issued identification, can negatively impact users’ constitutional rights, privacy and security.”

In addition to arguments about constitutionality and the cost of compliance, the report warned that age verification technology is technologically immature and therefore is “not technically feasible.” The institute cited research from France that found that six age verification solutions did not respect users’ “rights, privacy and security,” and a report from Australia found “privacy, security, effectiveness and implementation issues.”

The report also argued that most age verification methods are “at odds” with data minimization, an effort to limit the collection of personal information to only what is relevant and necessary to accomplish a specific task. As a result, the methods pose “significant risks” to users’ data privacy. Age verification companies have previously said that a comprehensive national data privacy law would help alleviate those concerns.

Other organizations and experts have warned of “low-tech fraud,” as more people could use fraudulent documents to verify their identities. A recent report by identity management company Socure found that “document image-of-image,” which refers to when a user takes a photograph or a screenshot of an identification document, was the most prevalent document fraud technique last year, as it occurred in 63% of all identification rejections. 

With minors needing to verify their ages to use social media in a growing number of states, image-of-image fraud could continue to grow.

“If I'm a 15-year-old, I want to access social media, and it requires my parent to give verifiable parental consent by scanning their ID and taking a selfie, it's going to be a lot easier for me to swipe an ID from their wallet—if they are not supportive of me using those platforms—and then take a photo of the family picture on the wall to try to get the selfie,” said Eric Levine, Socure’s senior vice president and head of DocV, its document verification arm.

Additional research has found that other approaches to verifying one’s identity, such as facial biometrics, also come with challenges. Identity management company iProov, though, found in a recent survey that 61% would be likely to use facial biometrics at stores and e-commerce websites, with 70% open to using a mobile driver’s license to verify their identity online. Some states, including Louisiana, have already pioneered mobile driver’s licenses.

Social media companies could use facial age estimation, a popular method that uses artificial intelligence to analyze someone’s face in a still or live photo to estimate their age. Opponents, cited in the Open Technology Institute’s report, say the method risks being inaccurate, while proponents like age verification company Yoti argue they have trained their systems on millions of images and have a high level of accuracy.

The technology behind facial biometrics has gotten better over the years as it’s increasingly been used in airports and to unlock cell phones, said Ajay Amlani, iProov’s president, head of Americas. Those uses have helped it enter the mainstream and improve. Today, he says, someone can have their face recognized through their computer’s camera, as it uses light to reflect against the user’s face to capture their skin’s translucency, which would not be present in an AI-generated fake image.

Technology itself and the data facial biometrics is trained on has also matured since some high-profile mistakes early on, Amlani said.

“Biometrics had fallen victim to some of the early deployments, and the inaccuracies and biased datasets that were used to train some of those early algorithms,” he said. “Early algorithms were not trained on well-represented databases, and therefore came up with answers to matching that were not accurate based upon different ethnicities, colors or devices, and would perform differently. You needed to have higher end devices with better cameras, but now, even the lower end cameras are performing quite well.”

But even as facial biometric technology has evolved, new pitfalls have emerged. That includes so-called “selfie spoofing,” where fraudsters use images people post to their social media accounts to correspond to an identification document that has been stolen through other means. As opposed to document fraud, Socure’s report said selfie spoofing is almost always done with nefarious thoughts in mind, not by children looking to circumvent their parents’ permission to use social media.

Socure’s Levine said a “perfect storm exists today” that allows fraudsters to steal people’s photos and use them to illegally verify an identity. And with technology advancing, selfie spoofing is growing more sophisticated.

“People normally think about face swapping or face switching as futuristic,” Amlani said, “going back to the ‘Mission Impossible’ movies of creating incredible masks that need to be manufactured and perfectly fit with your voice.” 

But that future is now, he said.