[this article is also available in Italian and on TechDirt.]
In Italy, an age-verification coalition against porn is getting traction. On September 4th, the Minister of Family Eugenia Roccella, representing the right-wing majority, initiated consultations for introducing a law to prevent minors from accessing pornographic content. On November 13th, the Democratic Party (currently the main opposition party) presented the Digital Innovation Act, whose Article 17 aims to prevent minors from accessing content forbidden to under-18 users.
Currently, the details are vague. The Democratic Party law requests the Telecommunication Authority (AGCOM) to draft technical guidance to implement measures to verify the users’ age when they access websites, apps and platforms showing content forbidden to under-18 users. The practice of setting impracticable targets and delegating the “technical implementation” to independent authorities seems unfortunately similar to many provisions of the UK Online Safety Bill.
The right-wing coalition has no specific proposal yet, but their idea seems to be inspired by the French attempt to enforce age verification through the use of third-party apps. This mechanism involves third-party services certifying the user's age without recording information about the websites visited. The visited website then receives age information from the third-party service without knowing the user's identity.
Age verification measures have already been discussed (as in the United States and Australia) or adopted (as in the United Kingdom and France) in various parts of the world. By looking at the experiences of other countries, such a measure seems ineffective and counterproductive, possibly making internet use less free and secure. Three reasons can be identified.
Effectiveness of Verification Systems
Currently, there exist two methods for age verification on the internet: uploading an identification document or the facial analysis of the user’s face. It must be reminded that to limit minors' access to a website, the age of all users accessing it must be verified. Therefore, every Italian citizen would need to upload their documents or provide biometric data to access services covered by the law.
According to the French Data Protection Authority, none of the identity verification systems currently on the market simultaneously offers reliable age verification, the ability to cover the entire population and respect for privacy (the United States Congress reaches similar conclusions).
On one hand, solutions that require uploading a document hinder access to the internet for people without documents (for example, asylum seekers or people waiting for residence permits), who often use the web to maintain a social network in difficult situations. On the other hand, facial analysis services have significant margins of error, particularly in the case of minorities.
Moreover, both systems increase the production - and temporary possession - of personal data in the hands of private organizations. Although the European Union strictly regulates the handling of personal data, the difficulty in implementing its laws and the possibility of data leaks, combined with the large number of people and organizations involved, increases significantly the possibility of privacy violations.
Impossible enforcement
In 2020, France adopted a law requiring all websites that publish pornographic content to prevent access to minors under 18, under penalty of suspension of service. The enforcement authority prosecuted five publishers of pornographic websites who did not implement the verification system; one of the publishers, accusing the law of being too vague, brought the issue to the Council of State, and two years later a final decision is still pending. In the United States, three states (California, Texas, and Arkansas) have seen their age verification laws suspended due to violation of the First Amendment, since they limit access to some information - and therefore the freedom of speech.
When balancing different rights, these laws prioritise the protection of minors over freedom of speech, with consequent difficulties in defending them in court. Furthermore, there is a problem of scarce resources: even if the suspension of a handful of websites succeeded in France, there will remain hundreds of pornographic portals available, whose operators are often difficult to prosecute and whose contents can easily change home.
Here we come to the main problem in the efficacy of these laws: their circumvention. A study on the consequences of the 2020 French law points out that such law is based on two assumptions:
once a certain website is blocked for minors, the minors previously using that website will not look for other sources for pornography;
minors are not aware of or do not want to use VPN services, [1] which easily allow them to circumvent the blocks imposed by national legislation.
It should be clear that such assumptions are completely unrealistic, as they are based on a static and inaccurate representation of the behaviour of young people online and of the pornographic content market.
Collateral damage
Depending on how they are worded, age verification mandates can harm parts of the internet that extend far beyond pornographic websites. For example, the “California Age-Appropriate Design Code Act” requires every company with a website that is “likely to be accessed by children” to “estimate their age” and assess whether the website has “features” that may expose a child to “harmful, or potentially harmful, content,” and plan measures that “mitigate” those risks. The French penal code, reformed in 2020, requires identity verification for any website containing “pornographic” or “violent nature” content that “could be viewed by a minor”.
These formulations are vague and imprecise, and in the majority of cases determine a de facto inapplicability of these laws. However, their mere existence can push some website managers to limit the use of certain features or to self-censor content that may not be suitable for minors. This process would be guided by very subjective assessments: at what point do artistic nude photographs become pornographic? Can the coverage of the Ukraine war be considered “violent content”?
For these reasons, Wikipedia protested against the UK Online Safety Bill, which requires every website that allows to interact with other users' content to block access to minors for any content that the government defines as "harmful". If enforced, the law would force Wikipedia (along with many other online services) to either limit access to its website to minors or to level all its contents to a level that is tolerable by children (or what the government thinks is tolerable for children).
By using loose or imprecise definitions, a law created to protect children can allow public authorities to arbitrarily sanction a large amount of non-pornographic content on the internet. Even if unenforced, its mere existence might convince cautious or politically exposed actors to limit their content available online.
As in the case of moderation of social networks, minors' access to online pornography cannot be solved with a law that acts as a "silver bullet". In the best cases, identity verification laws are ineffective. In the worst scenarios, they lead to a reduction in content available on the internet, for everyone.
Undoubtedly, the effects of porn on the psyche of minors are to be taken seriously. However, the protection of children on the internet has often been used to propose harmful, as well as ineffective, laws: the attempt in the European Union to eliminate encrypted chat services to combat child pornography is only the latest example. Instead of making age verification mandatory, why not focus on educating parents to supervise their children's online browsing, following Australia's example?
[1] A virtual private network (VPN) is a service that provides a proxy server to help users bypass Internet geoblocking.