{"id":19991,"date":"2022-11-30T20:00:58","date_gmt":"2022-11-30T20:00:58","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/11\/30\/as-us-uk-embrace-age-verify-everyone-french-data-protection-agency-says-age-verification-is-unreliable-and-violates-privacy-rights\/"},"modified":"2022-11-30T20:00:58","modified_gmt":"2022-11-30T20:00:58","slug":"as-us-uk-embrace-age-verify-everyone-french-data-protection-agency-says-age-verification-is-unreliable-and-violates-privacy-rights","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/11\/30\/as-us-uk-embrace-age-verify-everyone-french-data-protection-agency-says-age-verification-is-unreliable-and-violates-privacy-rights\/","title":{"rendered":"As US, UK Embrace \u2018Age Verify Everyone!\u2019 French Data Protection Agency Says Age Verification Is Unreliable And Violates Privacy Rights"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

from the privacy-or-age-verification:-pick-one<\/i> dept<\/h3>\n

We keep seeing it show up in a variety of places: laws to \u201cprotect the children\u201d that, fundamentally begin with age verification<\/em> to figure out who is a child (and then layering in a ton of often questionable requirements for how to deal with those identified as children). We have the Online Safety Bill<\/a> in the UK. We have California\u2019s Age Appropriate Design Code<\/a>, which a bunch of states are rushing to emulate in their own legislatures. In Congress, there is the Kids Online Safety Act<\/a>.<\/p>\n

All of these, in the name of \u201cprotecting the children,\u201d include elements that effectively require sites to use age verification technology. We\u2019ve already spent many, many words explaining how age verification technology is inherently dangerous<\/a> and actually puts children at greater risk. Not to mention it\u2019s a privacy nightmare<\/a> that normalizes the idea of mass surveillance, especially for children.<\/p>\n

But, why take our word for it?<\/p>\n

The French data protection agency, CNIL, has declared that no age verification technology in existence<\/a> can be deemed as safe and not dangerous to privacy rights.<\/p>\n

Now, there are many things that I disagree with CNIL about, especially its views that the censorial \u201cright o be forgotten in the EU\u201d should be applied globally<\/a>. But one thing we likely agree on is that CNIL does not fuck around<\/em> when it comes to data protection stuff. CNIL is generally seen as the most aggressive and most thorough in its data protection\/data privacy work. Being on the wrong side of CNIL is a dangerous place for any company to be. <\/p>\n

So I\u2019d take it seriously when CNIL effectively notes that all age verification is a privacy nightmare, especially for children:<\/p>\n

\n

The CNIL has analysed several existing solutions for online age verification, checking whether they have the following properties: sufficiently reliable verification, complete coverage of the population and respect for the protection of individuals\u2019 data and privacy and their security.<\/em><\/p>\n

The CNIL finds that there is currently no solution that satisfactorily meets these three requirements<\/strong>.<\/em><\/p>\n<\/blockquote>\n

Basically, CNIL found that all existing age verification techniques are unreliable, easily bypassed, and are horrible regarding privacy.<\/p>\n

Despite this, CNIL seems oddly optimistic that just by nerding harder, perhaps future solutions will magically work. However, it does go through the weaknesses and problems of the various offerings being pushed today as solutions. For example, you may recall that when I called out the dangers of the age verification in California\u2019s Age Appropriate Design Code, a trade group representing age verification companies reached out to me to let me know there was nothing to worry about, because they\u2019d just scan everyone\u2019s faces<\/a> to visit websites. CNIL points out some, um, issues with this:<\/p>\n

\n

The use of such systems, because of their intrusive aspect (access to the camera on the user\u2019s device during an initial enrolment with a third party, or a one-off verification by the same third party, which may be the source of blackmail via the webcam when accessing a pornographic site is requested), as well as because of the margin of error inherent in any statistical evaluation, should imperatively be conditional upon compliance with operating, reliability and performance standards. Such requirements should be independently verified.<\/em><\/p>\n

This type of method must also be implemented by a trusted third party respecting precise specifications, particularly concerning access to pornographic sites. Thus, an age estimate performed locally on the user\u2019s terminal should be preferred in order to\u00a0minimise the risk of\u00a0data leakage<\/a>. In the absence of such a framework, this method should not be deployed<\/strong>.<\/em><\/p>\n<\/blockquote>\n

Every other verification technique seems to similarly raise questions about effectiveness and how protective (or, well, how not<\/em> protective it is of privacy rights).<\/p>\n

So\u2026 why isn\u2019t this raising alarm bells among the various legislatures and children\u2019s advocates (many of whom also claim to be privacy advocates) who are pushing for these laws? <\/p>\n

\nFiled Under: ab 2273<\/a>, age appropriate design code<\/a>, age verification<\/a>, cnil<\/a>, facial recognition<\/a>, kosa<\/a>, online safety bill<\/a>
\n<\/p>\n<\/div>\n