The Definitive Guide to the Digital Economy Act and the UK Porn Ban

 

On 15 July 2019, a new law will come into force across the United Kingdom. The Digital Economy Act 2017 will effectively result in the UK porn ban.

Austerity is inflicting unnecessary misery.

Brexit is a shambles, regardless of what you voted for.

And just when you thought the UK government couldn’t be less popular, they pull this rabbit (giggity) out of the hat.

The average age a person enjoys their sexual debut in the UK may be 16-17, but those even younger are able to readily access pornographic content online.

All they have to do is mistakenly search for ‘Mr. Hands’ instead of ‘Mr. Tickle’, and…

BOOM.

What has been seen, cannot be unseen.

(Do not search for Mr. Hands. You have been warned.)

This should not be allowed to happen, according to Doctor May and Snoop Moggy Mogg.

And so, as is the apparent wont of the Conservative Party, everyone must be made to suffer.

That’s right, the time has come to erect the age verification statute.

Why is the UK blocking adult sites? How is the ban going to work? And is it really a good idea?

Let’s find out. 👇

Why is the UK Banning Porn?

The block is an attempt to stop under 18s from gaining access to adult material online.

A 2015 poll motivated the legislation, after discovering some startling statistics relating to children aged 11-16 viewing pornography online.

Most notably, the survey found that 10% of 12 to 13-year-olds in the UK fear they are addicted to pornography.

One in five of the 700 young people surveyed also said they had seen adult images that had shocked or upset them.

The research was commissioned by the NSPCC, a national charity dedicated to the care of children.

Initially, the findings were widely reported and caused a moral panic. People were understandably horrified.

As a result, the Conservative Party promised to tackle the issue as part of their 2016 election campaign.

On their Facebook page, they announced:

 
Legislating to put online hard-core pornography behind effective age verification controls is an important part of our plan to back families and give children the best start in life.
 

This pledge, to block internet adult content web sites that did not have controls to prevent under 18s from looking at them, is what would eventually become the UK porn ban.

The Problem

Soon after the BBC led with the story, many other news outlets and publishers began to report on the story.

As you might imagine, the media was filled with outraged headlines about children being addicted to online pornography.

The problem?

Nobody had taken the time to actually question the findings.

At least not until Frankie Mullin at Vice decided to dig a little deeper. And what she found raised a few questions about the data behind the drama.

When a respected national charity publishes the results of an investigation that it has conducted, it’s usually accompanied by a full report of the study.

You might expect the report to disclose details such as the number of those surveyed, relevant demographic information, how they were vetted or prepared, and the conditions in which they participated; among many other factors that could influence their responses.

When dealing with very sensitive issues, such as children and pornography, you would also want a number of safeguards to be put in place.

The NSPCC had commissioned OnePoll to carry out the survey. This was problematic for a number of reasons.

As the Vice article points out, these should include pilot tests to gauge each child’s state of mind, face-to-face interviews, a self-completion section for sensitive questions to avoid being heard and influenced by parents, family members or the interviewer, detailed surveys about the children themselves and measures of mediating factors such as psychological vulnerability.

That’s what the London School of Economics did when they published research into the internet use of children in 2010.

But this was not the case here.

The 2015 study had been conducted by ‘creative market research’ group OnePoll. A firm which pays people to participate in questionnaires online.

OnePoll is better known for speedy, fun polls with questions about celebrities and your daily life. Some of their previous work includes “The World’s Coolest Man Bun” and “Wrong Side of the Bed: Myth or Fact.”

The survey in question here was comprised of just 11 multiple choice questions. Hardly an academic approach to an important issue that would ultimately impact a change in the law.

In order to take part in a OnePoll survey, you have to be signed up as a panelist on their website. You also have log on to check for new polls, as it doesn’t send out invitations. Unlike many other survey sites.

And perhaps most importantly of all, OnePoll’s terms and conditions of use state that you must be at least 16 years old to become a member.

What this means is that the children who engaged in the survey were at best doing so under parental instruction and supervision (which would obviously affect their answers), or at worst were adults masquerading as youngsters in order to get paid.

Professor Clarissa Smith, an expert on Sexual Cultures at the University of Sunderland, spoke with Vice at the time:

 
Why aren’t they being entirely transparent with the research? If this was really robust, they would be sending the report to everybody, they wouldn’t be hiding it. There’s absolutely no way an organization like [OnePoll] could conduct the kind of in-depth interviews you need to really engage with young people on pornography. I cannot conceive of a child answering honestly in front of a parent. The dimensions of parent-pleasing there are horrific. I wouldn’t want to sit and answer a questionnaire about porn in front of my dad.
 

The Second Study

Needless to say, the NSPCC took notice of the criticism.

As a result, the charity and the Children’s Commissioner for England ordered a second study to be undertaken by the University of Middlesex.

This time around, just over one thousand young people aged 11-16 from around the UK took part in the project, which consisted of:

  • 1001 participants completing an extensive online survey
  • 34 participants for an online discussion forum and four online focus groups to inform the design of a survey and identify emerging issues
  • 40 participants in six online focus groups to provide more in-depth information on elements of the online survey findings – segregated by both age and gender

A much more ethical approach also included safeguards for the children involved.

The key findings in the Middlesex study were:

  • 39% of 13-14 year olds wanted to copy the behavior they viewed
  • Over 75% of all respondents agreed that the material didn’t help them understand consent
Not quite the porn addiction epidemic that had been previously reported.

There are still issues, too, relating to the small sample size when compared to the number of under 18s living in the country. A figure that currently stands at over 11 million.

Particularly when you consider that the statistic involving 39% of 13-14 year olds isn’t based on all 1001 participants aged 11-16, but rather a smaller age group within the study.

Another important note is that section 1.3 of the study itself, on Policy Implications, states that more research is needed into young people’s viewing of adult videos. Specifically, in relation to the effects it may have on their development and relationships.

The lawmakers failed to take this into account.

A case of premature legislation, so to speak.

The Legislation

In 2017, the UK government passed the Digital Economy Act.

Under the legislation, the government aims to impose mandatory age verification controls on websites that publish pornographic content. These websites must begin employing tougher measures to make sure their content is not accessible to under 18s.

If an adult site is found to be failing in its new obligations, it will face a financial penalty of up to £250,000 (or 5 per cent of turnover) and potentially a complete website block.

Having set aside a pool of £10 million, it appears the UK government is bracing itself for a number of legal battles due to the introduction of the porn block. The money has been ring-fenced to help deal with the fallout.

The regulator, which is set to be the British Board of Film Classification (BBFC), will have the power to request relevant information from Internet Service Providers and order them to block certain websites.

Big social media sites like Twitter, where pornographic material can be freely posted, are not in line to be blocked.

Exceptions will be made for websites where porn makes up a third or less of the available material on the site – unless the site is marketed as a purveyor of adult material.

A confusing aspect for some who point out that if children are going to stumble across adult content anywhere online, it’s likely to be on social media websites that allow adult content to be posted.

Abbie Gillgan, of the NSPCC, believes the legislation doesn’t go far enough to protect children from material they might find on social media platforms.

It also isn’t clear what methods the BBFC will be employing to calculate this 33.33%, or on which side of the regulation sex blogs will fall.

As Pandora Blake points out in their article, many sex bloggers receive small payments from advertising adult sites, and niche websites in the industry often have very small audiences and profit margins.

Many of these websites could end up facing a block, or being driven out of business, if they are forced to implement age verification technologies that they may not be able to afford.

An explanation was offered alongside the publishing of the regulations, which states that the focus of the legislation is on adult websites. Not popular blogs and social media platforms, where pornographic material is a small part of the overall content.

But a lot of minor details remain unclear.

Some microblogging and social networking sites, like Tumblr, have already attempted to permanently ban adult content websites.

It didn’t work.

There could easily be similar complications for websites who are not porn publishers by nature, but who do peak over that 33.33% threshold for adult content.

On top of all that, it’s only “commercial providers” that will be targeted. Meaning all other adult material will remain untouched.

The law is now due to take effect on 15 July 2019. However, a recent poll of 1,769 UK citizens suggests that the majority of the population are not even aware that the block will be introduced.

76%

76% of the general population indicated that they were not aware of the policy, but 67% indicated that they supported the new legislation once they were given the details.

As might be expected, the people who said they have “never” watched porn* were the most likely to be unaware. But more surprisingly, over 50% of those who said they watched “every or most days” also had no idea about the changes.

*Yeah, right. We totally believe them. 😉

There are plenty of vocal critics, though, despite the support the YouGov poll suggests. I spoke to Sam Bowman, a board member of the Volteface Think Tank, and he says:

I think it’s bizarre – the government has claimed to be interested in privacy and has really pushed the tech giants on whether they’re giving people’s data the protection it needs. But simultaneously they’re introducing what, at a minimum, is an invasion of privacy, and at worst risks exposing people to one of the most damaging and embarrassing data breaches possible. Imagine if a company that has your porn viewing history AND your personal details attached to that had a data breach? For many people it’s the worst privacy violation imaginable – and it’s exactly what the government has legislated for!

How Will the UK Porn Block Work?

The big change in pornography is almost upon us.

AgeID is a controversial technology aiming to handle the age verification process for thousands of adult websites.

Coming after years of delays and several protests from the likes of Open Rights Group, Privacy International, Backlash UK, Index on Censorship and NO2ID.

Age verification rules are going to be introduced on all adult websites accessed from the UK.

“But what about the practical implementation of such an inherently complex policy?” I hear you ask.

Here’s how the system will work.

When you visit a site that publishes or hosts adult content, your UK IP address will be picked up.

You’ll be redirected to a clean landing page with no explicit imagery, prompting you to verify that you are over 18 years old before you can enter.

Implementing the technology behind this age verification system is down to the websites themselves, with different solutions likely to be in use across the industry.

Let’s cast a critical eye over 4 solutions that will be in play once the law takes effect:

AgeID

AgeID is a controversial solution by MindGeek.

Why the controversy?

Well, MindGeek just so happens to be the parent company behind Pornhub, RedTube, YouPorn, and many other popular adult sites.

Many people are questioning the involvement of such an industry giant in the age verification process. There are dangers associated with placing so much data (and power) in the hands of a single company.

It’s safe to assume that AgeID will be in use across MindGeek’s own family of websites. And the solution’s website indicates that “thousands” of others are in line to be using the system.

As per the privacy policy on the company’s website, AgeID does collect a limited amount of personal information on you. This includes:

  • Your login ID, including associated email address and password
  • Your age status
  • Your IP address
  • Cookie data

In response to the criticisms, James Clark, Director of Communications at AgeID, explains AgeID’s approach to user privacy:

When a user registers an AgeID account using an email address and password, both are protected by a salted, one-way hash. This means that at no point does AgeID have a database of email addresses. AgeID does not know the identity or date of birth of its users, all it knows is whether a hashed account is over 18 or not. We look forward to being scrutinised by the BBFC and the auditors of their voluntary certification scheme. We expect a robust penetration test to be part of that process. We also require all our third-party age verification providers to submit to the voluntary scheme, ensuring end to end security.

PortesCard

MindGeek’s AgeID has also landed an exclusive partnership with OCL, the outfit behind the PortesCard. This is essentially voucher that will be sold at local shops around the country.

Purchasing a card will set you back £4.99 for a single device and £8.99 for multiple devices.

The card allows this type of sites to verify the age of users without any personal information being submitted.

You verify your age by showing a valid form of ID in person at a shop. Once you have the voucher, you can enter or scan the voucher code via the Portes app. This has to take place within 24 hours of obtaining it.

The app will then generate a virtual card, called a DIID, on your device. DIID’s represent your verified status, and don’t include any personal information.

The final step is to secure your DIID with a passcode. The Portes app on your device can then verify your 18+ status anonymously to any website compatible with the system.

From a privacy perspective, this seems like a big win at first glance. The company’s policies also state that it does not collect or share any personal information, other than the email addresses of those who sign up for its newsletter.

There are, however, other privacy issues when it comes to the physical purchasing of the PortesCard. But we’ll get to those later.

AgeChecked

An encouraging alternative could come in the form of AgeChecked, with verification here taking place via an app, using credit cards and driving licenses.

According to its website, the company claims that it won’t be storing any personal data collected during the verification process. It also claims not to be sharing information with any website operators or third parties.

The company’s privacy policy also states that personal information will not be used or shared with anyone, except for an email or messaging service for the purpose of contacting those who make an enquiry.

However, the technology was recently found to be easily cheated.

AgePass

Another solution claiming to be more trustworthy comes in the form of AV Secure’s AgePass.

The platform is built on blockchain technology, incorporating the associated security that comes with its encryption processes, and will not involve usernames or email addresses.

Proving your age with AgePass involves a mobile phone number, driving license number, credit and debit card details; or you can do so via an app.

Unlike AgeChecked, though, the privacy policy of AV Secure leaves a lot to be desired.

By using the company’s website or services from within the European Union, you consent to “the transfer of your sensitive information as well as your personal information across international boundaries.”

Collected and stored information includes:

  • Questions, queries or feedback you leave, including your email address if you contact AVSecure.com
  • Your IP address, and details of which version of web browser you used
  • Information on how you use the site, using cookies and page tagging techniques

As with AgeID and the PortesCard, there will also be an option to buy a card in a shop. Valid ID will need to be shown in order to verify your 18+ status. These Age Verification ‘Paysafe’ cards will cost £10 and be available for purchase in shops around the UK.

Data Privacy Dangers

Time to get into the sticky stuff.

No, not that sticky stuff. 🙄

Let’s face the truth here. Adult content sites are not the best when it comes to privacy and security.

After all, they’re generally more concerned with the quality of their T&As than their T&Cs.

And with pornography sites collecting more data than the likes of Netflix and Hulu, recent history suggests that any individual giving up personal information like name, address, date of birth, and credit card details has good reason to sweat.

Particularly if they’re giving that info to a company involved with sensitive material.

And unfortunately, this industry doesn’t have a great track record when it comes to data privacy.

Here’s the skinny on the key data breaches that have taken place in the online porn industry:

2012

Brazzers

Compromised data: Email addresses, usernames, and passwords.

Compromised accounts: 790,724

2012

YouPorn

Compromised data: Email addresses and passwords.

Compromised accounts: 1,327,567

2015

Ashley Madison

Compromised data: Real names, home addresses, search history, and credit card transaction records.

Compromised accounts: 39,000,000

2015

Adult Friend Finder

Compromised data: Usernames, email addresses, dates of birth, genders, geographic locations, IP addresses, races, relationship statuses, sexual orientations, and spoken languages.

Compromised accounts: 3,867,997

2015

Eroticy

Compromised data: Email addresses, IP addresses, names, passwords, payment histories, phone numbers, physical addresses, usernames, and website activity.

Compromised accounts: 1,370,175

2016

Naughty America

Compromised data: Dates of birth, email addresses, IP addresses, passwords, usernames, and website activity.

Compromised accounts: 1,398,630

2016

xHamster

Compromised data: Email addresses, passwords, and usernames.

Compromised accounts: 377,377

2018

High Tail Hall

Compromised data: Browser user agent details, dates of birth, email addresses, IP addresses, names, phone numbers, physical addresses, purchase records, usernames.

Compromised accounts: 411,755

2018

Wife Lovers

Compromised data: Email addresses, IP addresses, names, passwords, usernames.

Compromised accounts: 1,274,051

Do you really think there won’t be any further additions to that list? Especially with malicious actors now aware that adult sites operating in the UK are forced to keep highly valuable databases of personal info.

It’s the equivalent of a bank putting up a “vault this way” sign for robbers.

I spoke with Neil Brown of Decoded.Legal, a UK-based firm that specializes in tech, telecoms and internet law, and he agrees:

The regulation of pornography, including age verification, is nothing new. In the offline world, there are age restrictions on pornographic magazines, and for the purchase of pornographic videos. Viewed through this prism, the online rules are merely an extension of the offline world to the online world — what some are terming ‘parity’ of regulation. In practice, there is a much greater potential for harm associated with online age verification, because of the risk of creating databases of sensitive viewing habits — both lawful and unlawful. Lawful databases run the risk of being hacked or compromised. Fraudsters and identify thieves are likely to create ‘fake AV’ portals, to encourage people to submit their personal data, perhaps even their bank details, which they will then abuse.

And two of those breaches listed above took place within the MindGeek family of sites. Yes, the same MindGeek mentioned earlier. The one with its own AgeID solution.

It’s the parent company of many free websites, including Pornhub, RedTube, and the two sites compromised in 2012 – Brazzers and YouPorn.

Legal professionals and digital rights groups aren’t the only ones raising such concerns, either.

David Kaye, special rapporteur for the United Nations, wrote an Open Letter to the UK Government back in 2017, raising several concerns about this block. Even going as far as questioning the legality of the proposed framework in relation to the International Covenant on Civil and Political Rights (ICCPR):

There is no doubt that the protection of children is a legitimate objective under international human rights law, including under article 19(3) of the ICCPR which establishes criteria for permissible restrictions to freedom of expression. The question that arises relates to the way in which the bill seeks to achieve to protect children. Does the proposed way achieve this legitimate objective and it is lawful under international human rights law, in particular with respect to the UK’s obligations under articles 17 and 19 of the ICCPR?

The UK Government responded, failing to address any of the points raised and expressing no intention to take these concerns on board. Instead claiming that it was “proud” to be implementing such “robust” measures.

Jerry Fishenden, former Chair of the Cabinet Office’s Privacy and Consumer Advisory Group, resigned in May 2017 citing how “advice and offers of help [were] repeatedly ignored by officials who should know better.” Also accusing the government of taking a “half-baked approach” to the security of personal data when formulating the Digital Economy Act.

Now all that’s if you’re looking to verify your age online.

Is Your Offline Privacy at Risk Too?

The purchasing of physical cards is another option available to you. But let’s not forget:

UK citizens are living in the age of surveillance.

Pat Walshe, a highly experienced data privacy consultant who is quite simply a must follow on Twitter, gave me his take:

Splitting identity (who you are) from status (what you are, such as age) through ‘anonymous’ face to face age verification requires a person to physically buy a voucher from a local shop. While this kind of service argues no personal data is captured and the voucher and device IDs are not matched or retained, it nonetheless points to a number of issues:
  1. It has a chilling effect on people’s right to consume legal content
  2. As with alcohol consumption, it won’t stop those under 18 from persuading or paying an adult to buy a voucher on their behalf
  3. Data may well bind the identity of a person with the voucher unless they pay cash. For example, in a retail environment there is likely to be CCTV footage of the person buying a voucher and a credit card linked to the purchase. These things say a lot about that purchase – the date, time and location, and the nature of the purchase. That data may also be used for commercial analysis.

Expressing further concerns, Pat also noted that this kind of move could lay the groundwork for the use of facial recognition technology within stores throughout the United Kingdom and Northern Ireland.

Regarding age estimation via the scanning of a face; while it is intended not to retain personal data, it may lead to the normalization of facial recognition in retail environments if the service is rolled out for purchases not requiring age verification. Indeed, AI bias and errors may restrict people from accessing services.

Conclusion

Like it or not, the UK porn block is coming soon.

Now that the July 15 date has been set, media attention on the issue will be ramping up as the probable mess approaches. And at this point there doesn’t seem like much can be done to stop the law from eventually taking effect.

One way to get around the intrusive measures is to hide your IP with a virtual private network service. This would essentially mask the fact that you’re browsing from a UK location by replacing your IP with one from another country.

The fact that your web traffic would be fully encrypted also means that nobody will be able to snoop on the… perfectly bland documentary videos you will obviously be searching for. 😉

When your hands aren’t too busy with that, it’s important to get them dirty in another way – by supporting the activists and campaigners out there fighting for your digital rights.

Or the UK could end up on a list like this before you know it.

What are your thoughts on this new regulation? Let me know in the comments below!

Leave a comment

They haven’t thought this through. If a porn site requires a person to provide personally indetifiable data in order to view content then there is no real consent and that isbl a breach of GDPR.

They will also end up driving porn underground, a far worse situation. They haven’t learned from American prohibition or their own, failed war on drugs, have they. The problem with a nanny state is that it legislates on isolated issues with blinkers on and rarely stands back to look at the bigger picture.

What about parents. Parents should set up parental controls as they see fit. Sure, if your child wants to see porn they’ll find a way round it as did I in the 90s by raiding my friend’s neighbor’s dad’s “VHS collection”. Kids who want to see porn, will see porn, just as they did 30 years ago.

A person with minimal determination can buy drugs, guns and even people on the darkweb. Perhaps try to avoid driving porn the same way. They’ll end up pushing young people into a criminal culture they needn’t have got involved in. Once they’re on the dark web for porn they’re on there, with all that it has to offer right in front of them. Just like pushing young people to drug dealers unnecessarily by keeping “soft” drugs illegal.

There’s another danger here. When I was a teen I remember standing outside shops asking people to buy cigarettes or alcohol. Guess what happens when keep D’s online are doing the digital equivalent of standing outside that shop. Who hands are younputting them in then?

Reply

Hi Anon 🙂

Thanks for the comment! I can certainly see your point about the additional social issues involved here too. As you say, there’s a big risk of teenagers being pushed into accessing adult material via the dark web, which could open doors for them to see much worse.

The websites in question will probably be able to get around the GDPR issue by stating in their T&Cs that by providing them with the info they require, you’re giving consent for them to use the data in whichever ways are deemed necessary. Of course, it’s on the companies to specify how they use the info and down to users to read the policies.

Don’t know about you, but I’m not convinced many people wanting to access porn are likely to take the time to read a 2000+ word legal document!

Fap away I guess! 🙂

Reply

Write a comment

Your email address will not be published. Required fields are marked*