Come July 15, 2019, internet users in Britain attempting to visit major pornography sites will be confronted with a question: How old are you? Then, a follow-up: Can you prove it?
They’ll have a few options. Users can verify their age online, by submitting official government IDs or credit card information. Or they can walk into a store and establish their eligibility to access porn the old-fashioned way: by handing money and identification over to a human being, at a participating store, in exchange for a pass.
The British government has touted its mandatory age check as a “world-first” that will help make Britain the “safest place in the world to be online,” particularly for children. It has been less vocal about the precise manner in which these rules will be enforced. Just a few months out, and after multiple embarrassing delays, this is very much a work in progress.
What is taking shape is an enforcement regime made up not just of actual regulators and quasi-regulators but also major pornographers. It is a system that may not only fail to accomplish the law’s stated purpose (to keep children from stumbling upon adult content), but which also risks being captured by the biggest name in online porn, a multinational streaming conglomerate called MindGeek.
How could a distinctly British moral crusade end up empowering a foreign porn monopolist?
How a Bill Becomes a Law
The age verification rule grew from a Conservative party campaign promise in 2015, and ended up tucked into what would become the Digital Economy Act 2017, a wide-ranging bundle of internet rules and regulations.
Among the bill’s consequential but stultifying provisions about telecommunications infrastructure, copyright enforcement and government data sharing, the porn rule remained not only intact but grew stronger over time (thanks in part to copious media coverage). The bill was hastily rubber-stamped before Britain’s 2017 general election, and questions about how exactly it would be enforced, as well as concerns about user privacy, were set aside to be dealt with later.
Rather than create a new regulatory body within the government, the British Department for Digital, Culture, Media & Sport outsourced the task to the British Board of Film Classification, or BBFC, a nongovernmental organization best known for assigning ratings to films, much like the Motion Picture Association in America.
“The Government designated the BBFC to be the age-verification regulator because of our expertise in regulating pornographic content and our longstanding experience of online regulation, through working with the video-on-demand industry, mobile filters and online music videos,” wrote Brittany Maher-Kirk, a spokeswoman for the BBFC, in an email.
How a Law Becomes a Product
The BBFC then did some outsourcing of its own. The organization, it turned out, would not be creating or endorsing a single age verification system. Instead, it would lay out guidelines for external age verification services run by private firms. Commercial porn sites would be required to install such a system under threat of being banned, at the direction of the BBFC, by major internet service providers.
A user sharing credit card information, or a driver’s license, in this system, would not be handing it over to an agency of the government, or even to an organization deputized by the government, but to a private firm of the porn site’s choosing, carrying, perhaps, a BBFC stamp of approval.
But what can the BBFC can do to ensure private data is handled correctly? “They don’t have any experience regulating an industry for privacy concerns,” said Jim Killock, the executive director of the Open Rights Group, a nonprofit user-rights organization that has been critical of the Digital Economy Act. Nor, he said, do they have much power to do so. On its website, the BBFC says that data privacy “is so important that it has its own regulator,” the Information Commissioner’s Office, “which has the expertise and powers to apply strict data protection standards.”
“We have a Memorandum of Understanding with the ICO,” the site says, “but we don’t duplicate their work.”
The process will certainly feel conspicuously risky: a user will attempt to go to a porn site; that user will hit a wall; that user will be asked to supply proof of his or her age to get through.
As for whether the systems actually keep out kids, the BBFC will be keeping an eye on that, somehow. “Checks will be carried out by our Compliance team and we will use technology to maximize efficiency. There will be regular ongoing checks,” wrote Ms. Maher-Kirk, regarding third-party age verification providers.
The organization has also developed a “voluntary, nonstatutory certification scheme to ensure age-verification providers maintain high standards of privacy and data security,” Ms. Maher-Kirk said. The certification, which the BBFC said was developed with the help of a cybersecurity firm called NCC Group, will be represented to users by the presence of a reassuring green “V.”
The Inmates and the Asylum
The BBFC says it will soon publish a list of recommended age verification services. Existing solutions include AgeChecked, which markets its tool to gambling sites and e-cigarette retailers, among others, and AgePass, which claims to store its data on a “private blockchain.” One option, however, will start with an enormous advantage.
“AgeID is free for the user and very affordable for the website owner, providing a seamless experience for both sides,” reads the AgeID website. “Our single sign-on solution means users can verify once, then simply login to any one of the thousands of sites protected by AgeID on launch, without the hassle of re-verifying every time.”
AgeID is precisely the sort of solution the BBFC is demanding. It also shares an office with its parent company, MindGeek.
MindGeek’s holdings include Pornhub, Redtube and YouPorn, among dozens of other sites; it has its own porn production companies and its own adult advertising network; it claims on its corporate website, which makes no direct allusion to pornography, that it receives more than 115 million daily visitors to its properties. The company is now headquartered in Luxembourg, but has offices around the world. On AgeID’s site, the most visible evidence its affiliation with MindGeek is a pair of addresses at the bottom of the site: one in Cyprus and one in Oxnard, Calif., both listed under companies called variations of “MG Billing.”
As what seems to be the most visited collection of porn sites in the world, MindGeek took early interest in what the British government was doing. In fact, the Open Rights Group obtained communications between the company and regulators before the law passed.
Aside from having the resources to develop and lobby for its tool, MindGeek also has the advantage of being able to roll it out instantly on the most popular porn sites in the world, creating the impression of a single sign-on for porn in Britain, akin to signing into third-party apps with your Facebook or Google account. “In the name of child protection, the government has given a massive leg up to an enormous pornography company to have a monopoly on age verification in the U.K.,” Mr. Killock said. “That’s quite a surprising outcome.”
The Consolidation of Pornography
The adult industry has for the most part taken a wait-and-see approach to the Digital Economy Act, which, not unlike Brexit, has been limping toward an uncertain resolution for some time. Now that the new rules are bearing down on adult sites, the biggest threat the industry sees isn’t the specter of creeping censorship, or of the government getting into citizens’ private business, but of further corporate consolidation by a firm that has already remade the industry in its image.
MindGeek’s largest properties are “tube sites,” as in YouTube, which allow users to upload videos of their own, and which have come to dominate online porn consumption in the last decade. Tube sites have been criticized for embracing a growth strategy common among major online media platforms: turning a blind eye toward stolen content uploaded to their sites in service of growth; then, once they’ve become dominant, using that leverage to work with producers directly.
“What we call free porn is a misnomer, because it’s very often pirated or stolen,” said Shira Tarrant, author of “The Pornography Industry: What Everyone Needs to Know,” and a professor at California State University, Long Beach. Tube sites haven’t just capitalized on stolen content, Dr. Tarrant said: They’ve altered the character of the content itself. “What gets clicked more shows up more.” On large, centralized sites the reliance on algorithmic recommendations (as on some mainstream social media platforms) means that narrow categories of content rise to the top, creating feedback loops. “It can repeat a lot of stereotypes,” she said.
“There’s a lot about MindGeek that the average person doesn’t know,” said Jiz Lee, an adult performer and film producer, including “having built their empire off of pirated content.” Their involvement in enforcing age regulations is doubly worrying because “porn being accessible to children is a problem of their own making.”
“I know that MindGeek says, ‘don’t worry, your information is safe,’ but I think we all have reason to worry,” Dr. Tarrant added. The company has suffered data breaches in the past. And from an industry perspective, installing a MindGeek-owned sign-in portal (from which the company could see, at bare minimum, how popular a competitor is) would feel like one more concession to the porn world’s own fearsome tech giant.
MindGeek has said that it will not actually collect or store any such user data through AgeID; the company will further outsource the actual age verification to separate age verification sites, including Yoti, which verifies users by asking for a selfie and a government issued ID.
“AgeID does not verify users internally,” said James Clark, director of communications at the company. “We use multiple trusted, independent third parties in the age verification space to feedback a simple pass-fail result. AgeID cannot see, let alone store, any of this data.” AgeID is, in other words, a middleman. It just happens to be a middleman to which MindGeek’s millions of visitors in Britain will be introduced first.
Jumping Over the Porn Wall
There are plenty of anxious if probable what-ifs: What if the new porn age databases get hacked? What if one of them turns out to be a scam? Or what if the British government has inadvertently helped crown MindGeek the King of Porn for Life? At least one question, however, should be answered as soon as the rules go into effect: Will they even work?
“I have never known a parental control that couldn’t be bypassed by kids,” Dr. Tarrant said. British youth will indeed have plenty of options. They could sign up for virtual private networks to appear as though they’re browsing from another country (free versions of which often come with unclear privacy trade-offs themselves). They could get a physical pass from a friend. They could seek out noncompliant foreign sites that haven’t yet been caught.
Or, contrary to the rule’s stated intention to stop kids from “stumbling across” porn online, they could just search Twitter or Reddit. According to the BBFC, “Social media platforms are not defined as online commercial pornography,” and won’t be subject to age verification. Porn will always find a way.
