UK age-verification for online pornography: entry in force delayed

posted on 11 June, 2019   (public)

Balancing privacy concerns with the need to protect children from inappropriate content

According to new measures coming into force on 15 July 2019*, commercial providers of online pornography will have to implement a robust age checking system, in order to keep minors from accessing adult content. In case of failure to do so, the website faces being blocked by UK Internet service providers or having their access to payment services withdrawn. Under the Digital Economy Act 2017, the BBFC (The British Board of Film Classification) will supervise the implementation of these measures.

In December 2018, the BBFC released guidance on Age-Verification arrangements, setting out the criteria used by the Board to assess the effectiveness and compliance of an age-verification system.

This new step is an answer to the growing worries expressed by the UK population, and especially the parents. According to research carried out by YouGov for the BBFC, 88% of UK parents with children aged 7-17 “agree there should be robust age-verification controls in place to stop children seeing pornography online”.

If these new legal provisions have been mostly well received by the representatives of parents in general, some concerns have been raised with regard to the protection of private data and the compliance with the General Data Protection Regulation (GDPR).

The UK Government has responded to criticisms that the provisions will pose a threat to adults’ online privacy by saying that age-verification arrangements should only be concerned with verifying age, not identity, and arguing that all age-verification providers are to comply with GDPR standards.

In addition, the BBFC has created a voluntary, non statutory, certification scheme (AVC, Age-Verification Certificate) which should ensure that the provider’s age checking system complies with data security standards. The AVC has been developed in cooperation with industry, with input from Government. Certified providers will carry the BBFC’s new green ‘AV’ symbol to indicate that security checks have been met and the provider has a high standard of data protection. Certified providers will also be listed on the BBFC’s age-verification website, alongside details of their assessment.

Social media platforms that host some pornography online, such as Twitter and Reddit, have been excluded from the scheme because they fall under an exception where more than a third of site or app’ content must be pornographic to qualify.

The UK is currently working on an overhaul of its legislation regarding online content, with the ambition to be the safest country for online navigation (see the Online Harm White Paper).

Source: BBFC and DCMS websites

* Update 24 June 2019: Due to failure to comply with the notification procedure laid down in the Directive (EU) 2015/1535, the new measures will be delayed for around six months, as announced by the Culture Secretary last week. According to this Directive, Member States must inform the Commission of any draft technical regulation prior to its adoption.

Additional EPRA background: The protection of minors in the online environment is one key theme in EPRA's 2019 Work Programme. A plenary session in Sarajevo in May focused on evidence of harm, the follow-up session in Athens in October will address age-verification systems and the interplay between media regulation and data protection.