Ofcom’s age verification proposals risk privacy and security

Open Rights Group has responded to the publication of Ofcom guidelines on the age verification of pornography websites. The guidelines outline how sites and apps that display or publish pornographic content must fulfil duties outlined in the Online Safety Act to prevent children and young people from encountering pornography.

ORG’s Programme Manager for Platform Power, Abigail Burke said: 

“Open Rights Group agrees that it is important that children are protected online; however, Ofcom’s proposed guidelines create serious risks to everyone’s privacy and security .”

“Age verification technologies for pornography risk sensitive personal data being breached, collected, shared, or sold. The potential consequences of data being leaked are catastrophic and could include blackmail, fraud, relationship damage, and the outing of people’s sexual preferences in very vulnerable circumstances. 

“It is very concerning that Ofcom is solely relying upon data protection laws and the ICO to ensure that privacy will be protected. The Data Protection and Digital Information Bill, which is progressing through parliament, will seriously weaken our current data protection laws, which are in any case insufficient for a scheme this intrusive. Specific and clear privacy rules are needed, given the vast amount of sensitive data that will potentially be processed. 

“Additionally, the ICO has proven itself to be one of the weakest data regulators in Europe and is in urgent need of reform. Ofcom must go further in setting out clearer standards and guidelines to ensure users’ data will be protected from the substantially increased risk of fraud and cybercrime that comes with invasive age verification technologies.” 

ORG has outlined our concerns about the impact of age verification on free speech and privacy in a joint briefing with the EFF.

We are also campaigning against the government’s attempt to grab data powers through the Data Protection and Digital Information Bill, which is expected to be passed in early 2024. Read our latest DPDI briefing on how this Bill will take away the power we have over our data and give more power to government departments and corporations.