We have already talked about how there is no safe technological means to allow age verification on the web without bad compromises on privacy. Also, it is nearly impossible to enforce age verification due to the cat-and-mouse game of pornographic websites and… the possibility of using VPNs.
But the European Commission does not care. On 20 December, it designated Pornhub, Stripchat and XVideos as “Very Large Online Platforms” (VLOPs) under the Digital Services Act (DSA). Among various requirements, the EU requires these platforms to ensure “strong protection of minors”, by “prevent[ing] minors from accessing pornographic content online, including with age verification tools”.
At the moment, the way this obligation works in practice seems vague. Article 35(j) of the DSA requires VLOPs to take “targeted measures to protect the rights of the child, including age verification and parental control tools, tools aimed at helping minors signal abuse or obtain support, as appropriate”.
Recital 71 of the DSA states that “[a]n online platform can be considered to be accessible to minors when its terms and conditions permit minors to use the service, when its service is directed at or predominantly used by minors, or where the provider is otherwise aware that some of the recipients of its service are minors, for example because it already processes personal data of the recipients of its service revealing their age for other purposes”. The meaning of “directed at or predominantly used by minors” is unclear, but can be easily applied to any pornographic websites.
The same Recital recommends following the best practices from the Commission’s Communication “A Digital Decade for children and youth”, which in Section 5.1 refers to the “EU code of conduct on age-appropriate design building”, whose drafting started only last July. The Communication also hypothesises using the European Digital Identity Wallet, that still has to be adopted.
tl;dr: everything is pretty vague and the exact type of enforcement will be likely dependent on the arbitrariness of the Commission.
Still, the privacy problems of mandatory age verification stand. This is ironic since in the last years the EU has tried to build its credibility as the data protection cop of the world. However, with the Child Sexual Abuse Regulation and the Data Retention Directive the EU has already shown that these principles can be suspended to (supposedly) protect us from child pornography or terrorism. Is it really surprising that the moral panic on porn for kids is becoming another reason to justify such an exception?