Ofcom outlines four age-check methods for UK under-16 social media ban, raising privacy and ID-data risks
As preparation for the UK's planned social media ban for under-16s, Ofcom has set out four age-assurance methods it considers "highly effective": photo ID matching, bank-based checks, facial age estimation and digital ID services. The government and Parliament will decide how the ban works in practice. The Malwarebytes commentary focuses on the privacy and security implications, noting that collecting ID documents and facial images creates sensitive data stores. This is policy and opinion coverage with no active threat, though it references a prior breach.
Detalhes técnicos
- Photo ID matching: compares a live image with a government ID photo and checks the age on the document; Ofcom says this makes borrowing someone else's document harder.
- Bank-based checks: use age data the bank already holds, with user consent; privacy-preserving if only a pass/fail result is returned.
- Facial age estimation: estimates age from a face image; can be wrong by a few years near age 16, so borderline users may face extra verification.
- Digital ID services: prove age without presenting a physical document.
- The author cites last year's breach at a third-party support provider for Discord, which exposed government ID images of around 70,000 users, as an example of the risk.
- Workarounds seen after earlier restrictions include increased VPN use, borrowed credentials and migration to unregulated services. A VPN alone would not bypass an identity or facial check that is still required.
Remediação
- The author prefers double-blind verification, where the provider confirms age without learning which service is used and the service receives proof of age without learning identity.
- Key design questions are what each party receives, what is retained, and whether checks can be linked to user activity.
Linha do tempo
-
Ofcom outlines four age-check methods for UK under-16 social media ban, raising privacy and ID-data risks
ler a análise desta fonte ocultar
As preparation for the UK's planned social media ban for under-16s, Ofcom has set out four age-assurance methods it considers "highly effective": photo ID matching, bank-based checks, facial age estimation and digital ID services. The government and Parliament will decide how the ban works in practice. The Malwarebytes commentary focuses on the privacy and security implications, noting that collecting ID documents and facial images creates sensitive data stores. This is policy and opinion coverage with no active threat, though it references a prior breach.
Technical Details
- Photo ID matching: compares a live image with a government ID photo and checks the age on the document; Ofcom says this makes borrowing someone else's document harder.
- Bank-based checks: use age data the bank already holds, with user consent; privacy-preserving if only a pass/fail result is returned.
- Facial age estimation: estimates age from a face image; can be wrong by a few years near age 16, so borderline users may face extra verification.
- Digital ID services: prove age without presenting a physical document.
- The author cites last year's breach at a third-party support provider for Discord, which exposed government ID images of around 70,000 users, as an example of the risk.
- Workarounds seen after earlier restrictions include increased VPN use, borrowed credentials and migration to unregulated services. A VPN alone would not bypass an identity or facial check that is still required.
Remediation
- The author prefers double-blind verification, where the provider confirms age without learning which service is used and the service receives proof of age without learning identity.
- Key design questions are what each party receives, what is retained, and whether checks can be linked to user activity.