Robust online age verification for both children and young people wishing to access a range of products and services online, including via mobile devices, is regarded by many as essential to improving children’s safety online. In Ireland the average age at which children start using the Internet is 9 years of age. In 2014 a quarter of 13-14 year olds and 37% of 15- 16 year olds reported that they have experienced something online that bothered them or wished they hadn’t seen.
The requirements in the “real” world for age checks, including for example, when applying for Free Travel Passes, purchasing alcohol and cigarettes, gaining access to age-rated films, apply to both young and old, and can be achieved simply by the presentation of a photocard from a reputable organisation. These include the iConnect card for which young people aged between 12 and 17 years of age are eligible to apply and Age Cards that can be obtained by individuals aged 18+ years, to show that they have reached the legal age for purchasing alcohol.
Why should an online equivalent be so difficult?
In fact, Ireland has the capability to introduce online age verification using the Personal Public Service Number, but to date has not done so.
Legal constraints and precedents
Crucially, use of the Personal Public Service Number is governed by legislation, which precludes use of the PPS Number by private companies or bodies, other than in transactions with public bodies. Important legal precedents have been set in other European countries, including Spain, Italy and Denmark, whereby effective and efficient use by the online gambling sector of government-led electronic ID schemes, – equivalent to PPS Number – provide a reliable means of verifying legal majority age online. Governments in those countries decided that preventing children and young people from accessing gambling sites was sufficiently important to change the laws governing Government issued electronic ID schemes, to enable private sector companies, such as gambling operators, access to the schemes. To ensure citizens’ data is protected during these identity and age verification checks, stringent data processing and management rules apply.
In the UK Tory ministers are committed to online child safety and in particular online age verification. The Digital Policy Alliance in partnership with the British Standards Institution (BSI) is on the cusp of defining standards to underpin the roll out of scalable, viable, cost effective, online age verification solutions, built on the principles of ‘verify once, use many times’. Representatives of a number of sectors, -adult entertainment, gambling operators, e-tailers selling age-restricted products (e.g. alcohol, knives, tobacco, vaping products, etc.) – are involved in the Digital Policy Alliance’s Age Verification Group, and are working together with Identity Providers to find ways to deliver online age verification. In the UK, those companies that provide access to adult entertainment online are required by the regulator ATVOD (Authority for Television on Demand) to verify the age (but not necessarily the identity) of those seeking access.
What is happening in Ireland?
The Irish Government has enabled a scheme that issues a Personal Public Service Number (PPS Number) to Irish citizens, including children and young people. To address privacy concerns, the Irish Department of Education and Skills consulted with the Data Protection Commissioner in relation to the collection of individual pupil information for the Primary Online Database. The Data Commissioner deemed that the Personal Public Service Number (PPSN) is classified as non-sensitive personal data, similar to name and address and can be collected by schools.
The PPS Number is a unique reference number that could very easily be used to enable online age verification, in a privacy preserving manner, by gambling operators, adult entertainment sites, online dating platforms and online retailers that sell age-restricted goods. This would serve to restrict children and young peoples’ access to online pornography, gambling sites, and their ability to purchase age-restricted products online. The PPS Number could also be used to enable companies running educational services and related social networks for children, to age-check users. In the UK, the BBC is exploring the scope to enable online age verification on its educational platforms that may use the UK’s Department for Education’s pupil database via a company called GroupCall.
How would the technical platform that enables age verification operate?
In the UK, the Government has invested in GOV.UK Verify which is the new way to prove who you are online so you can use government services safely, like viewing your driving licence or assessing your tax. GOV.UK Verify is being built by Government Digital Service (GDS), working with government departments, private sector and privacy consumer groups. It was recently announced that the Royalmail and GBgroup will be using the Acovo Secure Trust Platform to provide online identity verification– age is simply one attribute of a person’s identity -as a service for the UK Government program.
A Trust Platform takes common identifying information, such as, for example, the PPS Number and uses it with range of other identifiers, to make sure the person is over 18, or under 16, over 21 and so on. It uses, easily applied, dynamic rules to enforce access rights based on age to online content, such as porn, gambling sites, chatrooms etc. A Trust platform is also capable of giving the online site the information it needs, i.e. the person is over or under 18 years of age, whilst retaining the privacy of the individual, e.g. using anonymous, but verified login and not actually disclosing the actual date of birth details. The dynamic nature of a Trust platform and the use of business rules enable it to take data from different sources and meet the very varied requirements in the market.
Moreover, an Irish company called Sedicii.com uses a patented Zero Knowledge Proof (ZKP) cryptographic login protocol, that in combination with the PPS Number would enable a child or young person to securely login to a website whilst, when required, also indicating the age band to which that child belongs. This is a privacy preserving method of authentication by which no data, other than the fact that the person wishing to access a site knows the correct login details and is over or under the age band set by the website, is shared with the site.
Next steps
This article highlights that examples of the technical architecture required to enable age verification using PPS Numbers not only exist, but have also been certified and are operational in e.g. a UK context. Moreover, policies with respect to data processing and management have been developed by a number of countries, often in partnership with privacy and consumer groups. The PPS Number provides the current Irish Government with an opportunity to dramatically improve the safety of children and young people online. To make this a reality, the Government should convene a multi-stakeholder group to explore how best to deploy online age verification, using the PPS Number, to better protect children and young people. In addition to child protection a key driver that will inform the deliberations of such a multi-stakeholder group is the importance of protecting Irish businesses, which are subject to European laws that increasingly recognise that online identity and age verification is already operational in a number of European countries.
It is always important to highlight that whilst no technical solution, including age verification, will substitute parental involvement in childrens’ online activities, age verification can act like a safety belt, which serves to reduce the risk of harm to a child’s wellbeing.
Dr Rachel O’Connell is an expert on Internet safety and former chief safety officer for the online social network Bebo. She is founder and CEO of TrustElevate, a technology products and services company that specialises in regulatory, policy and compliance online.
The post The Personal Public Service Number Can Be Used To Better Protect Children Online appeared first on Trust Elevate.