The Australian eSafety Commissioner recently released regulatory guidance to support social media firms ahead of the country’s world-leading legislation being enforced in December, which is intended to prevent those under 16 years from accessing the sites. The controversial legislation has faced criticism regarding platforms’ ability to effectively and reliably identify whether those on the end of the connection are indeed Australian or old enough to legally use the service. These concerns follow the United Kingdom’s recent widespread adoption of applications disguising the location of end users when regulations requiring purveyors of explicit adult online content to verify the age of their consumers were implemented.
The Australian guidelines follow the September 1 release the Australian Government’s Age Assurance Technology Trial results. The trial reports that “age assurance can be done in Australia privately, efficiently and effectively” and that “no substantial technological limitations prevent[ing] its implementation to meet policy goals.” However, “a wide range of approaches exist, but there is no one-size-fits-all solution for all contexts.”
For regulatory guidance purposes, “age assurance is a broad term that refers to a range of processes and methods used to verify, estimate or infer a person’s age or age range.” Age assurance methods include:
- Age estimation: Analysis of biological or behavioral features of humans (such as facial features, voice and behavioral patterns) that vary with age;
- Age inference: Using information, other than a date of birth, which indirectly implies that an individual is over or under a certain age or within an age range; and
- Age verification: Calculating the difference between a verified year or date of birth of an individual and a subsequent date.
The trial found that age estimation is feasible and already used by social media, retail, and age-restricted content providers. However, ongoing challenges were noted, “particularly for end-users with darker skin tones and those aged 16–20.”
Age inference draws probabilistic conclusions about facts other than a date of birth to imply a likely age or range. The conclusions can be based on behavioral patterns, contextual data, digital interactions, metadata or a range of other information. No substantial limits exist for its use in Australia, and tools are likely already being used by social media platforms when targeting feeds and advertising. However, they require the collection, retention, and use of individual data that may prove unacceptable for minors.
Age verification is considered a “technically mature, high-certainty and low-ambiguity method of determining an age assurance result.” It relies on validating an authoritative source of a person’s date of birth compared with the current date. However, the trial cautioned against requiring the use of a single form of verification, as this would be overly restrictive.
The trial also evaluated other methods, such as self-declaration, vouching (where a trusted third party provides assurance that the individual meets age criteria), parental attestation or consent, and the use of parental control tools on a site. None of these was considered satisfactory on its own for reliable age assurance, but could be used with other methods.
Guided by these findings, the Australian regulatory guidelines do not mandate any method for age assurance. Neither does eSafety propose a minimum accuracy threshold. Rather, what is provided is a set of principles to be followed, which include taking reasonable steps to:
- determine which accounts are held by age-restricted users and deactivate or remove those accounts with kindness, care, and clear communication;
- prevent age-restricted users from creating new accounts; and
- mitigate circumvention of measures.
The following verification methods were not considered reasonable: relying on self-declaration, holding an account for a set period of time before detection, and not preventing age-restricted users who have accounts deactivated or removed from immediately reactivating or creating a new account. Platforms are expected to inform consumers of the tests they use, “undertake and document ongoing internal testing procedures as well as seek external audits or independently validated testing to support transparency.”
Importantly, given the proportion of Australians using VPN accounts, the guidelines also outline a range of reasonable measures in addition to the IP address of the account to detect and deactivate accounts belonging to age-restricted users. These include using location services, detecting language and time settings of use, phone numbers, and information indicating a usual address in Australia, among other methods. In a similar vein, age-related signals including language, audio and visual content analysis, activity patterns consistent with school attendance, memberships, and connections of groups could be used.
In sum, the Australian guidelines suggest a low-key, flexible approach with lots of discretion left up to platforms as to how they will comply, but with an emphasis on transparency, information provision and respect for users. A strong contrast to the prescriptive and intrusive approach to age verification used in the United Kingdom.
The post Identifying Under-16s for Social Media Management: The Australian Way appeared first on American Enterprise Institute – AEI.
