Tell the BBFC that age verification will do more harm than good

By the end of this year, the Government is planning to enforce new rules requiring anyone in the UK to prove their age before looking at pornographic websites. Young people deserve our protection and support, but there is no evidence that these measures will do anything to keep children safe – and meanwhile, the Government are reducing funding for sex education, schools, libraries and youth clubs, indicating that they are more interested in blocking access to pornography and controlling the Internet than in truly helping young people.

The Government is leaving it to private companies to handle age verification, enabling these companies to collect databases of the porn browsing habits of UK adults which could be leaked or hacked. Despite these risks, the regulations contain no strong requirements for age verification tools to protect user privacy.

The regulator is holding a public consultation which is open until next Monday, April 23.  We need as many individuals as possible to respond to the consultation. Would you please add your voice using the resources below, and share these links with your networks? Even a quick response in favour of increased privacy requirements would be enormously valuable.

The BBFC guidelines can be found here. There’s a decent summary of the guidelines here, if you want to avoid wading through the PDF.

There are two massive problems with the policy in its current form:

  • Scope and proportionality
  • Privacy

Scope and proportionality

Under the current regulations, all websites hosting over-18 stills, images or audio currently stand to be covered by the law, regardless of whether they make any money. This is unrealistic and unworkable. It will stifle free expression and increase the stigma around talking and writing about sex. Loss of traffic, when viewers are unwilling to submit ID to view a site, will put many small producers out of business. This will inhibit the diversity and inclusivity of adult media online. It will also have devastating consequences for sex workers who advertise online; decreasing their options, freedom and independence, and making it harder for them to choose clients and work in safety.

The BBFC have said they will take a proportionate approach, but it will still be in their power to discriminate against small sites. Lifestyle sex bloggers and content creators who post within tight-knit, low traffic communities, and spend more money maintaining their websites than they make should not have their freedom of expression constrained by expensive and unnecessary age checks.

Consenting adult sex workers who advertise online are primarily publishing online for purposes of advertising – arguably, this material thereby falls outside both the definition of “pornographic material” (its primary purpose is not arousal), and the definition of “commercial basis” (in person sex workers publishing materials in this way receive payment for services, not for the publication). These individuals must not be prevented from posting their own advertising, screening and vetting their own clients, and choosing what services they offer. If sex workers are obliged to lock their adverts behind age verification tools, it will deter most clients from viewing the material. The consequences will be that sex workers are instead obliged to go back to working for exploitative bosses or on the street because they cannot effectively advertise online. This will put them at greater risk of violence, exploitation and abuse. The BBFC must not endanger vulnerable people by forcing sex workers to hide their adverts behind age checks.


Age verification for online porn creates a new technical space with unique privacy and security concerns, and requires new privacy and security standards uniquely tailored to these circumstances. However there is no mandatory privacy standard which age verification software must comply with – apart from the most basic legal minimums enshrined in the General Data Protection Regulations (GDPR). These are insufficient to ensure the privacy of people using age verification.

MindGeek’s age verification solution, AgeID, will inevitably have broad takeup due to their using it on their free tube sites such as PornHub. This poses a massive conflict of interest: advertising is their main source of revenue, and they have a direct profit motive to harvest data on what people like to look at. AgeID will allow them to do just that.

MindGeek have a terrible record on keeping sensitive data secure, and the resulting database will inevitably be leaked or hacked. The Ashley Madison data breach is a clear warning of what can happen when people’s sex lives are leaked into the public domain: it ruins lives, and can lead to blackmail and suicide. If this policy goes ahead without strict rules forcing age verification providers to protect user privacy, there is a genuine risk of loss of life.

The draft guidance leaves a gaping regulatory gap between the requirements of the BBFC to find an age verification tool compliant, and the responsibilities of the ICO. Age verification creates a new risk of highly sensitive personal data being collated and leaked, and as such the regulator should lay out robust, mandatory privacy rules that age verification tools must comply with.

The Open Rights Group have published a page to help you respond to the consultation, which contains bullet points on privacy and an easy web form to help you send your response. Alternatively you can email with replies to the questions posed in the consultation.

Please respond to the consultation today and tell the regulator that age verification will do more harm than good.