It looks like we were right: online age verification is being used as a Trojan horse for the mass rollout of digital identity systems.
Last Friday (July 25), the Starmer government took a historic step by making age verification checks mandatory for accessing pornography and other supposedly adult content online. The age verification checks can include uploading an ID document — including, presumably, the government’s recently launched digital ID wallet –, checking a person’s age via their credit card provider, bank or mobile phone network operator, or a selfie for validation and analysis.
“It is the biggest step forward in safety since the invention of the internet,” said Labour Party Tech Secretary Peter Kyle. “When it comes to children, that is something we celebrate.”
The Potential Costs of Non-Compliance
While one can argue that restricting children’s access to online pornography is a noble goal, the new rules apply to a bewildering array of websites, platforms and apps, including social media, search engines and even Wikipedia. One estimate suggests that as many as 100,000 services will now have to comply with the rules, or risk ruinous fines of up to £18m or 10% of global turnover, whichever is higher.
The brainchild of successive former Conservative administrations, the new rules form part of the so-called Online Safety Act, which was passed by the Sunak government in 2022 and has since creeped into force in piecemeal fashion. The majority of Labour Party MPs voted against the bill when it was presented. However, since coming to office the Starmer government has not only embraced the Act but expanded its scope by enabling censorship of online speech.
Like the EU’s Digital Services Act, the OSA seeks to compel online platforms “to remove illegal disinformation content if they become aware of it on their services. This includes the removal of illegal, state-sponsored disinformation through the Foreign Interference Offence, forcing companies to take action against a range of state-sponsored disinformation and state-linked interference online.”
The banned content so far has already included politically sensitive news and developments, notes Fred de Fosssard in an op-ed for The Critic:
Footage of British people being arrested in Leeds while protesting against asylum seekers’ hotels was censored on X for users who had not verified their age.
Even worse, videos of a speech made in Parliament by Katie Lam MP detailing the horrors of the rape gangs have also been blocked by these new rules. Speech which has been constitutionally protected from censure since the 1689 Bill of Rights is now being censored online via age verification technology.
It is hard to overstate the significance of this. British people are being forced by the state to verify their age and hand over personal information to view political news about their own country. It is the sort of thing for which British diplomats would castigate third world or tyrannical governments.
Growing Public Opposition
The new law is already deeply unpopular among large segments of the UK public — despite the fact that an estimated eight in 10 Britons supported mandatory age checks to stop young children accessing pornography sites before the new rules came into place, according to a poll by YouGov.
What they probably don’t support is banning children from using Wikipedia to do their homework or blocking access to sensitive political news online. As the FT reports, even a post on X containing YouGov’s own polling on the subject was blocked as it contained “pornography” in the title.
Public support for the measures has already fallen to 69%, says YouGov, though the wording of the survey question has changed slightly from one that specified “pornography websites” only to one that asks about “websites that may contain pornographic material”. If it is anything like Starmer’s public approval, support for the measures will probably have slumped to single figures within a few months.
As of today, more than 465,000 people have signed a petition asking for the OSA to be repealed. Many more are using VPNs to skirt the age checks. So far, one in four Britons (26%) have encountered the new restrictions while browsing, according to YouGov.
As we warned in November, these online age verification checks that are now proliferating across the collective West’s ostensibly liberal democracies threaten to trap everyone, not just minors, in their web. As the Australian government admitted last year, though the age restrictions are only meant to apply to children under 15 or 16, their enforcement requires everyone to verify their age — unless, of course, they use a VPN (more on that shortly):
For governments around the world, one of the great advantages of age verification, or assurance as the Austrian government is now calling it, is that it traps everyone in the same web — not just under-16s but just about anyone who wants to use the Internet. As members of the Australian government recently admitted, everyone will soon have to prove their age to use social media. And that will presumably mean having to use the government’s recently launched digital ID app, myID:
The UK’s Online Safety Act is also hitting hurdles. While the introduction of the age-gating for pornography websites has meant that five million extra online age checks are being carried out per day, according to The Guardian, it has also driven a massive, seemingly sustained surge in demand for virtual private networks, or VPNs. According to some reports, some VPN companies have reported a 1,400 percent increase in sign-ups since the OSA came into force.
For readers who don’t know, virtual private networks, or VPNs, are a very standard part of business IT that allow you to connect remote computers together on the same virtual network. As NC reader Balan Aroxdale notes in the comments below, “they are about as common as internet proxies or email”. However, as fellow NC reader Bugs notes, in more recent times “they have become shorthand for services that allow you to appear to have an IP in a different country” (h/t Bugs).
Britons have made use of other creative workarounds. For example, one rather cheeky security consultant revealed on X that it was possible to bypass one age verification tool using a screenshot of Mr Kyle’s own face. From WIRED:
In some cases, reportedly, you can even use the video game Death Stranding’s photo mode to take a selfie of character Sam Porter Bridges and submit it to access age-gated forum content.
For proponents of the law, there is progress to point to as well. The UK’s communications regulator Ofcom says that more than 6,600 porn websites have introduced age checks so far. And major social platforms like Reddit, X, and Bluesky have also added age verification for content that is now restricted in the UK or are in the process of doing so. Microsoft has even started rolling out voluntary age checks for Xbox users in the UK. But even if this movement is satisfactory for now, digital rights advocates point out that normalizing such mechanisms creates the possibility that they will be enforced more aggressively in the future.
“I think people just want to show that we can make some progress on this without thinking about what the consequences of the progress will be,” says Daniel Kahn Gillmor, a senior staff technologist at the American Civil Liberties Union. “We do know that there are some things that you can do to help kids have a better relationship with digital tools. And that involves having an adequate social support network; it involves listening when kids run into problems and making sure that they have functioning emotional relationships with adults who can respond to them. But instead what we’re looking for is a quick technological fix, and those technological fixes have consequences.”
Seema Shah, VP of research and insights at the market intelligence firm Sensor Tower, says five VPN apps have experienced particularly “explosive growth” and reached the top 10 free apps on Apple’s UK App Store by Monday.
The fact that tech-savvy youths are already finding work-arounds while older generations are generally falling into line is hardly a surprise. As we noted in our July 2024 article on Spain’s plans to launch a similar age-verification system for accessing online porn, which even contemplated rationing the amount of porn adult users could access, “if someone specifically wants to continue accessing Spanish-hosted porn, they could do so by simply using a VPN.”
Prior to the launch of the age-checks, the UK government was given fair warning about what would happen. Melanie Dawes, the head of Ofcom, told MPs in May that people would use VPNs to get around the restrictions.
“A very concerted 17-year-old who really wants to use a VPN to access a site they shouldn’t may well be able to,” she said. “Individual users can use VPNs. Nothing in the Act blocks it.”
As VPN use has surged in the past few days, reports have surfaced that the government may try to curtail their use. Such an act would certainly be consistent with its general authoritarian impulses. In a press release published today, it fired off a broadside warning platforms that “they have a clear responsibility to prevent children from bypassing safety protections”:
This includes blocking content that promotes VPNs or other workarounds specifically aimed at young users.
This means that where platforms deliberately target UK children and promote VPN use, they could face enforcement action, including significant financial penalties.
The Register, a British technology news website, predicts that any move against VPN use would likely backfire:
[E}xperts we spoke to were predictably dismissive. One told us that it’s “not gonna happen.”
The government could pull various technical levers, such as banning the sale of VPN kit, but as people who spoke to The Register about the matter said, it would be like banning people from smoking in their own homes.
“You might not like it, but good luck enforcing it,” said Graeme Stewart, head of public sector at Check Point Software. “The logistics are near-impossible. You could, in theory, ban the sale of VPN equipment, or instruct ISPs not to accept VPN traffic. But even then, people will find workarounds. All you’d achieve is pushing VPN use underground, creating a black market for VPN concentrators.
“The only way to do it is badly. You’d effectively be forcing ISPs to block legitimate encrypted traffic and, in doing so, you’d be regulating an entire industry out of existence. Worse still, you’d be legislating against cybersecurity and privacy.”
…
Jake Moore, global cybersecurity advisor at ESET, told us that other methods could see the UK veering into enemy territory, not to mention a PR calamity.
“Although we shouldn’t even consider adopting a route used by China, the Chinese use the technique of analyzing traffic patterns for VPN usage, but this requires expensive infrastructure and constant updates so again, not feasible,” he said.
“Furthermore, many VPNs offer modes to make their traffic look like regular HTTPS anyway, making detection harder yet again.”
To put it in his plainer terms: “Not gonna happen.”
Scott McGready, co-founder of Damn Good Security, agreed that if UK ISPs started snitching on their customers’ VPN usage, it would be “a very worrying position to be in” and the unintended consequences for legitimate users and businesses would be massive…
Morally unconscionable?
Some countries that ban the use of VPNs include Russia, the United Arab Emirates, Iran, Saudi Arabia, Turkmenistan, Myanmar, Belarus, and China. That’s not even an exhaustive list, but it shows the questionable company the UK would keep should it choose to ban VPNs.
A ban not only puts the UK on a concerning trajectory from a privacy and cybersecurity standpoint, but it is also unlikely to work in practice. Possible? Yes, but the practicality of policing such a ban would be challenging.
As shown by individuals in nearly all the aforementioned countries that outlaw VPNs, bans don’t prevent use. People always find ways to circumvent such restrictions, as they do routinely and successfully in more authoritarian countries.
All a UK ban would do is provide the impetus for young people to learn how to circumvent the legislation by using outlawed privacy tech. They would find a way, they always do.
Given the Starmer government is already perceived by voters as “chaotic” while its approval ratings continue to sink to fresh lows, it may think twice before targeting VPNs. That said, the people using VPNs are presumably a minority of the population, and minorities always make for easy targets. At the same time, however, pressure is coming from Washington, which sees the OSA as a bureaucratic nightmare that will punish US companies with huge fines.
Whatever the Starmer government ends up doing, one thing is clear: the Online Safety Act is likely to be manna from heaven for Nigel Farage’s rapidly rising right-wing Reform Party, which is already leading in the polls.,,
Continue reading on Naked Capitalism
Nick Corbishley 