On Device Controls Spark Privacy, Security Concerns
The British government is demanding that smartphone giants Apple and Google ensure underage users of iOS and Android devices can no longer take, send or view nude photographs.
See Also: AI Impersonation Is the New Arms Race-Is Your Workforce Ready?
Prime Minister Keir Starmer said on Monday that the move would stop predators from grooming kids through their devices, and stop kids from viewing pornography. Adult phone users would need to go through an age-verification process to take, send or view such imagery. The necessary technology would have to be installed on both new and older handsets.
For now, this is just a demand, but it comes with the threat of legislation – including potential fines – if the companies don’t bend within three months. Google said in response that it is “working constructively with U.K. partners to find effective, privacy-preserving solutions that deter the spread of harmful content while ensuring a safe digital environment for young people.” Apple has not yet commented.
“When it comes to the safety of our children, standing by is not an option. Nobody gets a free pass. That is why I’m making sure Britain is the first country in the world to make it impossible for children to take, share or view nude images,” Starmer said. “And I expect tech firms to make that happen. This is not an impossible challenge – these are some of the most innovative companies in the world. But if they choose not to, then we will act and change the law.”
The government’s idea is not a new one. Apple itself in 2021 introduced a raft of measures designed to spot child sexual abuse material on people’s accounts and devices. This involved scanning files held in iCloud and sent over iMessage, but, most controversially, it also involved putting client-side scanning functionality into people’s devices, to monitor what they were trying to upload to iCloud before it was sent.
A spokeswoman for the Home Office – the department in charge of this push – denied that the government is proposing client-side scanning.
“Client-side scanning involves data collection and this doesn’t involve data collection,” she said, even though the term is broadly understood to refer to scanning people’s messages on a device, before they can be encrypted and sent. The spokeswoman also said that “nudity detection filters are already on phones,” citing Apple’s Communication Safety feature and Google’s controls for Google Messages. “It’s simply a request to apply those filters to other features,” she said.
There is certainly a lot of political buttressing behind the government’s plans, particularly in the context of Starmer’s shaky hold on power. He is expected to soon face a leadership challenge from Manchester mayor Andy Burnham, and one of the many blows to his authority in recent months came from former safeguarding minister Jess Phillips, who said in her resignation letter last month that she was quitting because of Starmer’s unwillingness to even threaten nudity-blocking legislation.
In Parliament on Monday, opposition parties questioned why Starmer had taken so long to make such a threat, and lambasted him for not going further and announcing a ban on underage social media use, as some had expected. A consultation on that matter closed in late May, and the government says it is still going through the responses.
Some lawmakers did question the enforceability of age-verification tools, prompting junior minister Kanishka Narayan to insist that the administration had worked hard to understand the technology. “We want to get it right and robust so that young people in this country are kept safe,” he said.
Apple’s attempt to introduce client-side scanning in 2021 sparked immediate pushback from privacy advocates and security researchers, who warned it could “be used to censor protected speech, threaten the privacy and security of people around the world, and have disastrous consequences for many children.” They also said it would effectively end the confidentiality of iMessage, an end-to-end encrypted service.
After withering criticism that endangered Apple’s reputation as a bastion for privacy in an otherwise invasive tech industry, Apple back peddled. By the end of 2023, it officially killed the feature. “Scanning every user’s privately stored iCloud data would create new threat vectors for data thieves to find and exploit,” Apple privacy chief Erik Neuenschwander wrote to child-safety advocates at the time, as reported by Wired. “It would also inject the potential for a slippery slope of unintended consequences. Scanning for one type of content, for instance, opens the door for bulk surveillance and could create a desire to search other encrypted messaging systems across content types.”
What the British government is now demanding might be more invasive than what Apple previously attempted – it would try to spot nudity as users take photos on the phone, and it would apply to third-party messaging services.
“Forcing all U.K. residents to prove their age and/or have all their content scanned, simply to exercise their fundamental right to communicate, is a perilous proposition,” said the team behind the Signal encrypted messaging app. “We know that mass surveillance and censorship capabilities, however sincere-sounding the promises of those who initiate them are, never remain narrowly scoped. Once created, they will be expanded, forming a dangerous tool that will be wielded both in the U.K. and abroad to censor and surveil whatever they might consider ‘threats’ or ‘harmful content.'”
Signal has already threatened to leave the United Kingdom should communications regulator Ofcom use powers granted to it by the country’s 2023 Online Safety Act, to require the scanning of messages on end-to-end encrypted services in a perpetual search for CSAM or terrorist material (see: UK Parliament Approves Online Safety Bill).
The Online Safety Act is also the basis for the age verification regime that now applies across British internet users, covering everything from pornographic websites to social media platforms such as X and Bluesky. The government’s Monday statement praised Apple for introducing age checks for iPhone users, “making it the first company to activate safety features by default for those who are not verified as over 18,” and said its new demand built on that step.
Apple last year also removed for British users its Advanced Data Protection feature, an option for encrypting end-to-end backup iCloud data, in the U.K., a decision it made in response to a separate surveillance law called the Investigatory Powers Act. Apple is currently fighting the case in a tribunal, recently winning the right to make details of those proceedings public (see: WhatsApp Backs Apple Over Encryption Fight With UK).
The government’s Monday statement on nudity blocking was packed with supportive quotes from child-safety organizations, as well as some who stand to benefit, such as the tech vendor SafeToNet. “We can put an end to so much online misery with this approach. SafeToNet’s HarmBlock technology is a proven example that it is possible to make the device safe by default and not as some optional add-on,” company chair Richard Pursey said in the official announcement.
ISMG asked the government whether it talked to any privacy advocates before making its announcement, and how it responds to criticism from those quarters, but it did not respond to that question.