Americans are skeptical of online age verification, even as its use grows abroad

Florida Gov. Ron DeSantis last week vetoed an effort to ban minors under 16 years old from social media altogether, although he showed support for other legislation that would keep them from accessing adult websites.

Both bills would mandate that companies “use reasonable age verification methods to verify the ages of account holders.” Age verification, lawmakers argued, would make it harder for children to access inappropriate content.

“The problem today is that most websites and apps assume everyone to be an adult, which means that children can easily access adult content,” Florida Rep. Chase Tramont said in a statement after the Florida House passed both bills in January.

While online age verification would largely be new in the U.S., the approach is already used elsewhere in the world, including on social media platforms. Instagram and French app Yubo currently require users to verify their ages in Europe, Asia and elsewhere, in part due to greater data privacy protections like the European Union’s General Data Protection Regulation.

But the U.S. mostly lacks such protections, and Americans tend to be skeptical that companies will handle their personal information and data responsibly. A study last year by age verification company Jumio found that 62% of Americans are open to having a digital identity for verification, a figure that trails the global average. That may mean it could be a while before age verification technology takes hold in the U.S.

“[Americans] don't live in a culture where you generally trust technology and new tech companies with your data,” said Iain Corby, executive director of the Age Verification Providers Association, which represents many providers in the space. “We see in the U.S., very little control over how personal data is used. We do understand that we have to go the extra mile.”

Florida is far from the only state mandating age verification. Louisiana and Utah last year passed laws requiring pornography sites to verify a user’s age for access. In states’ efforts to restrict social media use by minors, many have written age verification into their laws. Several of these laws and their efforts to verify users’ ages have come under scrutiny and been the subject of legal action. Arkansas’ law, for instance, was struck down last year by a federal court.

Corby’s group has testified in several cases considering the constitutionality of age verification laws. It put together earlier this year a list of do’s and don’ts for state legislators when it comes to writing such laws. For instance, lawmakers should ensure bills are precise in identifying which sites are in their scope, but not too prescriptive in the types of verification allowed. Ensuring competition among verifiers also can keep costs down, Corby said, as others fret about how much it can cost to implement the tech.

Still, America’s lack of comprehensive data privacy legislation remains a stumbling block to the technology taking hold, even as more states approve their own laws in light of Congress’ inaction. 

Veronica Torres, Jumio’s worldwide privacy and regulatory counsel and data protection officer, said while companies’ data protection standards are important, help from lawmakers would be a huge boost.

“The support of a comprehensive privacy law from a U.S. perspective would help some of these concerns,” she said. “There'll be a far better environment for the goals to be achieved with [these state laws].”

Age verification technology can take different forms. One involves checking users’ personal identifying documents, a method favored by the new version of Utah’s social media regulations. They mandate that social media companies have a process that allows “submitting documentary evidence to establish the account holder's age range.”

Those documents can include someone’s passport, identification card or driver’s license. Age verification companies then compare the photograph on these documents with a selfie someone takes. Any information collected is then deleted as soon as possible, depending on individual states’ data retention laws.

Another popular method is the use of artificial intelligence for facial estimation. The technology analyzes a customer’s selfie to assess the person’s age and runs a liveness check to make sure they are a real person, not a bot or a 2D image.

While some are not convinced that the method, or the data underpinning facial analysis, is safe, companies that use the technology say it produces good results. Julie Dawson, chief policy and regulatory officer at age verification company Yoti, said the company began training its technology in 2017 using a neural network, which can estimate someone’s age by analyzing their face.

In a white paper, Yoti claims that age estimation has “no discernible bias” on gender and skin tone and has a more than 99% success rate determining if a child aged 13 to 17 is younger than 25. The company said photos taken of users are deleted immediately, and it has submitted its technology to scrutiny by regulators across the world, including the National Institute of Standards and Technology.

“If you were a nightclub bouncer or if you were in a supermarket and you're on the [register], you would be doing human estimation, which is sort of six to eight years of accuracy,” Dawson said. “In a way, the only difference with this is that you’ve given it lots of ground truth. A teacher that works with 10-year-olds will probably be really good at identifying 10-year-olds. This is taking that even further.”

It is incumbent on age verification companies to keep upgrading and updating their systems to keep ahead of new threats, Jumio’s Torres said. That includes sophisticated efforts like deepfakes and digital injection attacks, where hackers bypass cameras used for identity verification and insert synthetic images. The role of technology providers, she said, is to ensure systems remain strong against those threats.

“At the end of the day, there's always going to be a group of people who are seeking those alternatives and are trying to break the systems,” Torres said. “Our goal is to […] make sure that our systems and our technology are robust, to provide enough information so that to the extent possible at that moment, people are unable to circumvent those processes.”