Age-gating the internet is a start

Australia has recently implemented a ban on social media for those under 16. The EU and other jurisdictions have implemented restrictions to adult content by using age verification. Similar bans are likely to be introduced in Canada. These measures are long overdue but bring up considerable privacy and implementation problems which must be addressed by governments.

Age-gating is the process of restricting user access to online content based on a user’s age. This is a responsible and necessary function of government to protect our youngest citizens.

However, the process of age verification brings up real concerns about privacy and the process. There are a number of ways verification is done, some involving facial scanning, credit card credentials, government ID card uploading, parental authentication, as well as AI analysis.

Many of these methods expose considerable privacy concerns, since people would need to give personal details to providers to verify ages. This approach is a privacy nightmare and could lead to innumerable problems in the future if that data is not used securely. And if this sensitive data is in the hands of private companies, there is no way to know how they might use that data behind the scenes or if a data breach occurs. This is not a good approach and a dereliction of government duty.

If governments require age verification for its citizens to access content, verification should not be left to the companies — this should be a function of government. As citizens we are told to protect our IDs carefully, whether it be driver’s licences, passports, birth certificates or other sensitive documents that can confirm who we are. It’s a further giving-away of regulatory enforcement, which offloads a government function to a private entity that can possibly do anything they want without scrutiny or transparency.

Technology companies have already spent decades eroding any semblance of privacy by coercing us to give away our personal information and scraping every bit of personal information they can from our online activities and behaviour.

If a government is requiring age verification and governments issue verifiable ID, then they need to be directly involved in the verification process. It would be like setting speed limits on the highways and having the manufacturer of your car hand out speeding tickets while they scan your face and upload your driver’s licence and insurance to their systems. Enforcement is a core feature of any laws and a responsibility of government.

Verification for a law that governments expect citizens to follow falls under the same responsibility. If governments enact regulations that are enforced by companies, they erode government legitimacy by allowing for regulatory capture by the companies. That means once a private entity becomes responsible for what should be a government function, that company has the power that the government used to hold in carrying out that function. The privacy that was once important in issuing IDs and being the arbiter of identity has been given to the private sector.

The fix will require action beyond legislation to force tech companies to comply with lawful orders. Governments must get more directly integrated with technology to ensure regulatory compliance by allowing verification to take place through their respective government organizations.

It is heartening to know that governments are realizing the importance of data sovereignty in protecting national interests and are actively seeking ways to build-out IT infrastructure. This will involve building data centres within sovereign borders to ensure data protection. But this same idea needs to extend to privacy sovereignty.

Privacy sovereignty involves taking back privacy as a government function for both individuals and governments and keeping sensitive information beyond the reach of private corporations. This will need to involve serious government IT enhancement to ensure that privacy remains in the power of citizens and compliance by technology companies to co-operate on a technological level to ensure lawful use.

This model could not only apply to ID verification, but also other legislation that needs technological compliance, and as is now, and in the future, that could be a large portion of legislation. As we move forward, laws and their implementation would move through the technological framework to be implemented with compliance as an automatic requirement, rather than governments chasing companies and stopping them from doing something they’ve already done that may be against the law.

Australia’s approach to banning social media will be a good bellwether to see if governments can take back control of their important functions, to enforce the laws and protect the values that they hold in reducing harm to their youth. Governments must do more to make sure that laws are enforced, especially in this technology age, which will mean meshing technology and the law.

The speed of technology has vastly outpaced the ability of laws to adapt and that has to change, otherwise technology companies will continue to exploit and erode sovereignty everywhere with the supranational control of regulatory authority. Because last time I checked I was not a citizen of TikTok, I am obligated to follow Canadian law, and so should all tech companies operating within our borders.

David Nutbean is a technology writer with a background in technology administration, management and education.