Online age verification and the battle over biometrics

This article first appeared on Route Fifty.

Lawmakers are experimenting with various ways to verify users’ ages and keep minors off websites with adult content. Using biometrics could represent a better path forward.

In early January, Pornhub announced it was going dark in several more states as a way to protest new age verification laws that are sweeping the nation. In certain states, services like Pornhub are opting to simply restrict access to their websites for all users to avoid hefty penalties.

In the U.S. and abroad, many lawmakers want to limit minors’ access to websites featuring adult content. There are several ways this content can be restricted, but to date, these have been imperfect. Some streaming sites ask users to affirm they are over 18 via a pop-up, but this self-reported information is never confirmed, making for an age verification system that quite simply has no teeth. Another method — parental controls — can all too often be circumvented by kids who are more technologically fluent than their parents.

Other, more sophisticated methods hold promise. For instance, consider the work currently being done in the area of facial age estimation — combining computer vision with machine learning technology to estimate a person’s age.

In Louisiana, Pornhub enlisted an anonymous third-party age verification service that scans a sea of public and private transactional data to verify that a person attempting to access a service is 18 or older. While these may represent improvements over other methods, app development can be costly and time-consuming, and can fail to keep pace with the constant flux of online age verification — also known as age assurance — laws.

Biometrics, or the identification of individuals based on their unique biological characteristics such as palm prints, fingerprints, face and voice, represents the fastest, easiest, most cost-effective way for streaming services to verify age on the internet. Combined with geofencing, this service helps know whether certain laws apply to users. Biometrics also feature built-in document verification capabilities to ensure that age-verifying documentation is legitimate, and that the person really is who they claim to be.

We believe biometrics are the ideal solution to the online age verification dilemma, for several reasons.

Privacy and Security

As the battle over online age verification heats up, opponents of biometrics say that collecting a vast pool of biometric data presents a significant privacy and security risk. In other words, if a hacker were able to access such a database of biometric data, he/she could steal and wreak havoc with data that individuals cannot easily change. Unlike a password, it’s impossible to change your fingerprints.

We believe these arguments are unfounded. Today, there are a number of tactics available to protect security and privacy further, including:

• Decentralized storage: Use on-device storage rather than central databases to reduce the risk of large-scale breaches.
• Template encryption and hashing: Store biometric data as encrypted templates rather than raw images (so no one can “steal your face”). Using cryptographic techniques such as homomorphic encryption or secure multi-party computation ensures that biometric data remains protected even during authentication.
• Role-based access: Restrict access to biometric data based on strict permissions, ensuring that only authorized personnel can access stored information.
• Temporary processing: Authenticate users without permanently storing their biometric data, ensuring data is deleted immediately after use. The Transportation Security Administration’s pre-check identity verification uses this tactic, for example.

“Spoof-Proof”

It’s a challenge that’s been around the in-person age verification world for ages: minors presenting fake IDs. Surely, minors will attempt similar techniques in an online environment — for instance, stealing and presenting an adult’s ID along with another picture or video of the owner’s face to the device camera. This is known as a “spoof” attempt, and in the age of ready access to photos and videos via social media, they’re becoming much more common.

Fortunately, today’s biometric tools feature liveness detection to notice and thwart such scenarios. Liveness detection works in various ways, depending on the biometric modality (face or voice) being used. When it comes to facial recognition, liveness detection may scan the user’s face for natural movements like blinking. Genuine users will respond with natural, involuntary movements that can be detected, whereas static images or videos cannot replicate these movements.

Cost and Speed of Deployment

In the past, only well-resourced, technologically sophisticated organizations could afford biometrics — and the heavy up-front work that was required to implement them. Today, biometrics are available in a cloud-based SaaS model, meaning that virtually any streaming service, no matter how big or small, can begin offering this type of authentication in minutes. Additionally, biometrics are now broadly available as a plug-in on leading marketplaces, further democratizing access for website owners and developers.

Convenience

According to a recent survey, consumers are more comfortable with biometrics than at any time in our history. Over half of those polled indicated they use biometric authentication technology regularly, with nearly 50 percent stating they use biometric authentication “often” or “always” to access mobile apps, indicating a clear path to mass adoption.

Even if they have some trust concerns, the convenience factor tends to have more clout, with 62 percent of respondents noting they have never refrained from using the technology as a result of trust issues.

The fact is, only biometric authentication offers this holy grail of superior security combined with convenience, and convenience tends to win out. Biometric authentication is extremely reliable, fast and easy, taking only milliseconds to process, with no passwords or special codes to remember.

Even as online age verification laws take hold in more states, to date lawmakers have shown they aren’t quite sure how they’re supposed to work. While we believe that biometrics are an ideal foundation for digital ID programs, that’s not to say there aren’t challenges ahead.

Data from a wide range of industries including financial services indicates a high level of consumer comfort with biometrics, but in the adult content/streaming space specifically, people may be more reticent to provide their personal information. Communication will be key to educating users on the comprehensive steps taken to keep their data safe, the convenience of login, and how biometrics will secure online experiences for all.