As Online Age Verification Spreads, So Do Privacy Concerns

The U.K.'s Online Safety Act took effect last Friday, requiring proof of age to access certain content. But this new law has sparked concerns about privacy and security in the digital age.

In Ontario, cybersecurity expert Richard Rogerson was surprised when a children's online gaming platform asked for his ID to verify his child's age. The platform required him to enter the email address of a parent, along with his birthday and government-issued ID or credit card details. Rogerson declined to upload his ID, unsure how securely his data would be stored.

"When my kids sent me a form saying, 'Upload your driver's licence,' you can imagine the amount of resistance that I had towards that," he said. His kids have now had to give up playing the game as a result.

Online age verification systems are sweeping the internet as jurisdictions introduce laws to prevent children from accessing certain content. A wave of privacy concerns has followed, with many users frustrated by insufficient or unclear privacy policies from apps and websites they use.

The U.K.'s Online Safety Act requires websites to ask users to verify their age using identifiers like selfies, driver's licences, passports or credit cards. Some sites have pulled out of the country rather than comply with the new rules, while others are rolling out their own measures beyond the U.K.

YouTube announced Tuesday it will introduce an age verification system with select U.S. users before implementing it more broadly. The video streaming platform will analyze browsing patterns to determine age before asking for other forms of ID.

"We're seeing this kind of pop up everywhere," said Rogerson, founder of Packetlabs, a cybersecurity firm specializing in professional hacking services. "It's a good idea to restrict minors from accessing certain content, but it's also important to address related privacy and security concerns."

Most companies rely on third-party verification systems, so the average user won't know who is privy to their private information, how secure it is, or how it's being stored. If that data is breached, the fallout can be disastrous.

"You think about an adult website getting compromised, and here's all the faces of all the people and where they live, and here's all the content they viewed," Rogerson said. "That would be quite, quite damaging."

Last Friday, San Francisco-based Tea Dating Advice Inc said in a statement that some 72,000 images, including 13,000 selfies and photo IDs, were leaked online from Tea, an app designed for women to vet dates by sharing information about men.

Rogerson says Canada has mandatory breach notification laws, but some companies aren't sophisticated enough to even know when they've been breached. He says the U.K.'s General Data Protection Regulation, while not perfect, offers strong privacy protections in some areas and stiff penalties for violations.

"We need the privacy laws here in Canada to protect Canadians, because it's every day we're seeing companies get breached with hordes and hordes of privacy-related information," he said.

The Online Harms Act was introduced in February 2024 but didn't pass. The federal government may rewrite or reintroduce the act over the summer. Justice Minister Sean Fraser recently said the government plans to take a "fresh" look at the legislation, though it's unclear what changes are coming.

A ministry spokesperson did not answer whether age verification might be one of those changes, saying in an email that the government "cannot speculate on legislation or content at this time."

Privacy Laws: A Necessary Step?

"Age verification requirements present users with a tough choice when faced with insufficient or unclear privacy policies from the apps and websites they use," says Cliff Steinhauer, director of information security and engagement at the National Cybersecurity Alliance.

"It's like, either do this and accept the policy, or don't do it and don't get access to the service," he said. "As a user, I think you have to really ask yourself: Am I comfortable with this? If this were to be breached, what would the impact on me be? What is the risk that I'm taking by putting this selfie into this app? And is this service worth the risk?"

Steinhauer says privacy laws need to put safeguards around age verification systems, like guarantees of deleting the data as soon as the user's age is verified.

A Growing Concern: Children's Online Safety

The Canadian Centre for Child Protection has been lobbying the federal government to mandate online age verification. Jacques Marcoux, the centre's director of research and analytics, worries about children being harmed by sexually explicit material online.

"I think this is maybe a first step in moving towards a better system, where it will be refined over time," he said. "The bottom line is that the current situation — which is that children of all ages have unfettered, no-friction access to essentially the whole of the content of the internet — is a problem that we can't turn away from."

Marcoux says even with parental controls, it's impossible for parents to monitor their child's online activity 24/7. "The current situation is one that we can't turn away from," he said.