This article may contain affiliate links. Learn more on our Partner Program page.
A new age verification law has come into force in the UK. It's intended to protect children from inappropriate content, but it affects virtually all websites and apps worldwide. The US is also preparing a similar law. This will make age verification a new reality online, with consequences for users, platforms, and tech companies. Apple is also not immune.
What was initially announced as a measure to prevent minors from accessing pornographic content has since expanded significantly. Age verification now affects hundreds of content categories, including information sites on health, sexuality, and education. The implementation of these laws raises questions, particularly with regard to data protection, risks of abuse, and technical feasibility. The legally required age verification is neither uniformly regulated nor secure. Access to private data and the potential for monitoring private communications have been criticized in particular.
British law requires all platforms to verify age
With the entry into force of the Online Safety Act in the UK, all services are required to protect minors from so-called "age-inappropriate content." Specifically, this means that the age of each user must be verified before they are allowed to view certain content. However, the term "inappropriate" is broadly defined. This applies not only to sites with explicit content, but also to social networks, messaging apps, dating apps, and even information offerings on sex education or support sites for victims of sexual violence.
USA follows suit – Kids Online Safety Act is about to be passed
In the US, a nearly identical bill is on the table: the Kids Online Safety Act (KOSA). Although the bill initially stalled, it has since been reintroduced. It is likely to be passed this year. This bill would also require platforms to verify the age of all users and ensure that minors do not have access to harmful content.
Content affected by age verification – definition remains vague
Although the regulation officially refers to "child protection," it has been expanded to cover over 200 types of content. This includes topics such as mental health, sexuality, LGBTQ+, drug education, and information on contraception. The definition is vague and leaves considerable room for interpretation. The problem: Much of this information is particularly important for young people and can help them protect themselves. Making this content only accessible through age verification will hinder rather than promote education.
Identity verification by third parties – without regulation
The law does not stipulate how exactly age verification should be carried out. Platforms can therefore decide for themselves which methods they use. They often rely on third-party providers who require identification documents or biometric data for verification. However, such identity services are hardly regulated and have repeatedly caused data breaches in the past. The US company AU10TIX, for example, disclosed personal information such as names, dates of birth, nationality, ID numbers, and photos. The risk of misuse or data sale is high – especially because many of these companies are not subject to European data protection regulations.
Technical backdoors possible – danger of political influence
Another problem lies in the potential misuse of such systems by governments. Current legislation allows new content categories to be added at any time. A political leadership could then restrict or monitor critical websites specifically – under the pretext of protecting minors. Even without active censorship, a climate of insecurity develops. Users could avoid certain sites for fear of being identified – even if they are legal and helpful.
Private communication in the spotlight – iMessage and FaceTime affected
Probably the most controversial point: Section 122 of the British law requires that even private messages must be checked for illegal content. This applies to all messaging services - even those with end-to-end encryption such as iMessage, FaceTime or WhatsApp. Technically, this is almost impossible to implement without compromising the encryption. The government is leaving it up to the companies to find a solution, but is silent on practical ways forward. If this regulation is consistently enforced, the protection of private communications would be massively threatened. Apple, previously an advocate of strong encryption, is under pressure. Although the British government currently appears to be distancing itself from demanding a backdoor into iCloud data, the dispute over encrypted communications is likely to escalate further as a result of the new law.
Age verification without regard for privacy
Online age verification is intended to protect children – a legitimate concern. In practice, however, the new laws lead to far-reaching restrictions on freedom of information, data protection, and privacy. The rules apply globally and affect all platforms that provide content to users in the UK, or soon also in the US. Without clear guidelines for technical implementation and without control mechanisms for data processors, sensitive information will fall into the wrong hands. At the same time, it will be more difficult for young people to access important content. And if even encrypted messengers are affected, nothing less than digital privacy is at stake. What is missing is a balanced, transparent approach that offers protection without restricting fundamental rights. (Image: Shutterstock / vectorfusionart)
- Apple close to breakthrough in App Store conflict with the EU
- LG or Samsung Smart TV? How to disable tracking
