Meta Ruling Points to Obligatory Verification
The European Union all but mandated the use of age verification technologies by large social platforms by provisionally finding that Meta broke digital rules by allowing pre-teens to access Facebook and Instagram.
See Also: AI Impersonation Is the New Arms Race-Is Your Workforce Ready?
Critics say mandatory online age verification poses significant security and privacy risks. The European Commission this month released an early version of an age assurance app – only for security researchers to find significant weaknesses in the design.
The commission said Wednesday that Meta likely flouted the Digital Services Act – a rulebook for large online platforms – by “failing to diligently identify, assess and mitigate the risks of minors under 13 years old accessing their services.”
The social media giant’s terms of service bars underage users, but the commission said the company didn’t institute measures that would “adequately prevent minors under the age of 13 from accessing their services [or] promptly identify and remove them, if they already gained access.” Per the EU executive body, as much as 12% of European under-13s login to Instagram or Facebook.
“The DSA requires platforms to enforce their own rules: terms and conditions should not be mere written statements, but rather the basis for concrete action to protect users – including children,” said European Commission Executive Vice President Henna Virkkunen.
The commission is heavily promoting the idea of age verification services as many European countries consider following Australia’s lead in raising the minimum age for social media use to the mid-teens (see: Global Push for Age Verification Raises Security Concerns).
It published guidelines last July recommending age verification, provided the method is “accurate, reliable, robust, non-intrusive and non-discriminatory.” Virkkunen said Wednesday the commission now says that countries should “accelerate the adoption of age verification tools,” and has a framework setting “criteria for those who can provide proof of age and those who can develop age verification solutions.”
But it has not yet formally demanded the use of these technologies, and continues to deny that it is doing so.
A commission spokesperson told ISMG on Wednesday that “the DSA does not mandate specific mitigation measures,” and Meta could also comply by adopting “stronger internal processes, resources, testing and documentation in relation to minors under 13 accessing the services” and “better evaluation of mitigation measures to prevent, detect and remove users under 13 that access the service.”
In practical terms, it seems difficult to see how Meta could avoid using age assurance tech if it wants to comply.
“When it comes to security, age verification poses a significant risk, not just for minors but for everyone,” Hanna Bozakov, head of marketing and press officer at Tuta, told ISMG on Wednesday. “A large amount of personal data of millions of EU citizens is a gold mine for malicious attackers … malicious hackers will try everything to get hold of this data and use it for their own purposes. Phishing, scamming, hacking attacks – all of these will only get worse if EU citizens must perform age verification to use certain internet services.”
In theory, concerns like these should be allayed by age-assurance techniques that do not involve handing over personal data to third parties.
This is the course the commission tried to take when, a couple weeks ago, it announced an official mobile app that Europeans could set up with their national passport or ID card, so they could then prove to online services that they are above the age limit, without even needing to reveal their identity, let alone any further personal data.
The European Commission described the app as being “technically ready” and “ready for deployment,” and said some EU countries were “already planning to integrate the app into their national digital identity wallets.” But it did not immediately make it available for download. Instead, the commission released the app’s open source code so experts could check it, which they did. Multiple security consultants said the app was easily hackable. The Commission backtracked, with spokesman Thomas Regnier explaining: “When we say it’s a final version, it’s still a demo version.”
Virkkunen insisted Wednesday at a press conference that the app was “now ready for member states to customize and roll out,” adding that “member states must now establish a system of proof-of-age attestations.”
Virkkunen sidestepped a question on why the commission was issuing a “recommendation” rather than drawing up a regulation. She characterized the app as an attempt to encourage interoperability between countries’ age assurance systems and a “blueprint” whose technical approach will be embraced by the public and private sectors alike.
“It’s very important that this is protecting the privacy of the citizens, but of course the security aspect is very important as well,” Virkkunen said. “And that’s why this is published as open source and everyone can hit and hack and test this model we have. Of course, this is not the final model yet. It’s still under progress, but when it will be now adopted in the member states, of course it will be fully secure.”
Virkkunen acknowledged that an expert panel meant to advise the commission on social media age restrictions will only deliver its recommendations in the summer, but argued that it was important to weigh in now because many member states are planning new minimum ages.
Regarding the possibility that kids might fire up a VPN to access their forbidden Meta accounts, Virkkunen sighed and said: “It’s difficult, of course, to have the technological solutions that there’s no way to circumvent … it’s also an important part of next steps to look at [the issue] that it shouldn’t be circumvented.”
In Australia, where the new social media age limit is 16, two-thirds of 12-to-15-year-olds kids who supposedly lost their accounts still have access to at least one account, according to research published this month by the Molly Rose Foundation. The online safety charity said this was partly down to platforms’ inaction, but many kids are using family members or VPNs to circumvent the rules. Survey respondents were evenly split on whether the new regime made them safer online or not.