Paper: Device-based Age Verification
slides-agews-paper-device-based-age-verification-00

Benjamin VanderSloot

Websites typically ask visitors to assert they are of legal age before serving them adult content. As the EFF identified last year, numerous efforts are underway to require websites to instead verify their visitor’s age. The mechanisms vary, but typically require users to present credentials derived from digitized identity documents or upload selfies for automated age estimation.

Legal requirements for websites to verify visitor ages come with substantial risks for user privacy and open access to the web. Unlike self-assertion, the methods put forward for age verification entail leaking information about the user to third parties, impacting privacy. For any given jurisdiction enacting such requirements, a substantial fraction of websites may be unable to participate and so either choose to self-censor through geo-blocking or be censored by regulators, affecting open access to the web, even between adults.

These issues can be mitigated with an architectural change, moving the enforcement from the website to the device, where it can remain under the control of the device owner. We propose such a system for web browsers, which achieves the same goal of restricting access to inappropriate content with fewer externalities.

We do not take a stance how the verification of age should be done, instead focusing on which party enforces the verification. We take the question of where the verification occurs as the critical one, separating it from the question of how that verification is performed.
The core of this proposal is to place a responsibility on the browser to respect existing signals from the operating system about the user’s content preferences and from websites about the content they contain.