Mapping age assurance typologies and requirements

Abstract

The internet has afforded many novel opportunities to children, but also

presents several potential or actual risks to their rights and well-being. On the

one hand, children can participate in social interactions, create content, and voice their opinions online like never before but, on the other hand, they are increasingly exposed to different risks and harms online. Protecting children from online risks while furthering their participation in the online sphere is important, to ensure that the rights of children enshrined under the United Nations Convention on the Rights of the Child (UNCRC) and the Charter of Fundamental Rights of the European Union (CFREU) are upheld. In this respect, age assurance is considered one of the solutions towards creating a safe online experience for children while promoting their well-being and respecting their rights and best interests. Age assurance is the umbrella term for the methods that are used to determine the age or age range of an individual to varying levels of confidence or certainty, and the three primary categories of age assurance methods are (1) age estimation, (2) age verification, and (3) self-declaration. While these are the directly relevant terms for the present report, associated concepts such as age- appropriate design and parental consent can also have an interrelation with age assurance. The present report seeks to explore the various aspects of age assurance. At the outset, it is relevant to understand when and why age assurance must legally be used in certain cases and – in the absence of such a legal requirement – when (and in what form) it may be an adequate tool for the online protection of children. Age assurance is legally relevant in three ways: (1) when a minimum age is prescribed by law for buying products or using services that may harm children or for performing legal acts, both of which require age assurance for legal compliance, (2) when there is a duty of care to protect children which may require age assurance to be employed, and (3) when there is a contractual obligation to provide the products or services only to users of a certain minimum or maximum age. Further, even where no legal or contractual stipulations exist, platforms may still undertake age assurance in certain circumstances out of their own volition. Legal instruments at the EU level, such as the Audiovisual Media Services Directive (AVMSD), the General Data Protection Regulation (GDPR), the Unfair Commercial Practices Directive (UCPD) and Digital Services Act (DSA), and national laws on contract, sale of harmful products (e.g., alcohol, cigarettes, and weapons), provision of harmful services (e.g., gambling) etc., are relevant for consideration to ascertain the legal requirements for age assurance. It is crucial to note that in situations where age assurance (or, in particular, age verification) is not legally mandated but can be employed as a duty of care to children or as a contractual obligation or a voluntary measure, it should still be implemented with due regard to the potential exclusionary effects of age assurance. This is because age verification can exclude children from (parts of) a service and thereby affect their participatory rights. Thus, other solutions such as age- appropriate design, age ratings, parental control tools etc., may be more appropriate in certain situations. In scenarios where age assurance is to be implemented, an important factor that has to be determined is the type(s) of age assurance to be employed. In this regard, the present report discusses ten main methods of age assurance: (1) Self-declaration; (2) Hard identifiers; (3) Credit cards; (4) Self-sovereign identity; (5) Account holder confirmation; (6) Cross-platform authentication; (7) Facial age estimation; (8) Behavioural profiling; (9) Capacity-testing; and (10) Third-party age assurance services. Each of these methods has varying assurance levels and associated advantages and disadvantages. For instance, self-declaration methods can be relatively privacy-friendly, but they provide a low level of assurance, as it is a trust-based method that can be easily circumvented. Facial age estimation can be easy to use but raises several privacy concerns as biometric data may be used for estimating age. The above methods are not an exhaustive list of age assurance methods present today and methods such as checking age against data held by entities including banks, mobile phone operators and credit reference agencies are also used in certain countries. Other methods, including estimation techniques using voice analysis, hand geometry, and natural language processing, could also become prominent in the future. Age assurance providers may also use a combination of age assurance methods instead of relying on any one method, which can potentially increase the level of assurance. The liabilities associated with employing the right method of age assurance, in the appropriate manner, would depend on the applicable legal regime and the specific circumstances of the case within the context concerned. However, it can be construed that the primary responsibility for ensuring appropriate age assurance will be on the digital service providers themselves. Further, since the different types of age assurance have varying levels of certainty or accuracy, there have been initiatives to propose a mechanism to determine the confidence one can have regarding the accuracy of given age assurance methods. For instance, the International Organization for Standardization’s (ISO) working draft on age assurance proposes a five-level model ranging from zero over basic, standard and enhanced, to strict, reflecting the level of confidence that can be placed on given age assurance methods implemented. Given the above background, it is important to set out certain requirements that ought to be present, while assessing the necessity of age assurance and determining the method of age assurance to be implemented. The present report discusses ten such requirements: (1) Proportionality; (2) Privacy; (3) Security; (4) Accuracy and effectiveness; (5) Functionality and ease of use; (6) Inclusivity and non-discrimination; (7) Furthering participation and access; (8) Transparency and accountability; (9) Notification, challenge, and redressal mechanisms; and (10) Hearing the views of children. It must be acknowledged that there are significant challenges and tensions to be combated to achieve these requirements. Even among the requirements, there are contrasting principles and a balance needs to be struck between them. For instance, the accuracy of age assurance systems could contradict the privacy rights of users since increasing the accuracy of the age assurance employed could sometimes require users to provide more personal data to age assurance providers. This is, inter alia, why proportionality is a basic requirement that can play a role in satisfying the other requirements as extensively as possible. Therefore, this report emphasises that age assurance is a complex matter, and it is far from straightforward as to how it is to be implemented in given situations. That is why age assurance should not be construed as a silver bullet for online child protection. Instead, it should be considered as one of the many tools to protect and further the experiences of children online. Going forward, the current efforts by European standardisation bodies could provide further clarity to age assurance providers on how to implement age assurance solutions in an appropriate manner. That includes the European standard for online age verification, as envisaged under the European Commission’s Better Internet for Kids (BIK+) strategy, which will develop an interoperable approach to age verification across borders and sectors. The previously outlined proposed standards could give more insight into aspects such as the levels of age assurance available for the protection of children that can be implemented by specific platforms. Furthermore, these standards should include consideration of the effects of age assurance on the digital ecosystem and, more specifically, on the effective enforcement of legislation, to ensure both adequate protection of, and age-appropriate design for, children, as well as the creation of a level playing field for companies. Additionally, any further guidance for online platforms, to provide them with assistance in applying measures that can ensure a high level of privacy, safety and security for children, while respecting their fundamental freedoms, would be welcome. The European Commission is empowered to issue such guidelines under Article 28 (4) DSA, which could include guidance on the application of age assurance methods.