Age Assurance: not what but whom

Grace Rachmany, Executive Director at Decentralized Identity Foundation

Within the identity space, the topic of age verification and age assurance has gotten a lot of attention. The recent Australian government enforcement of an age ban on social media, as well as noises from the British government that full surveillance of messaging is at least part of the answer to protecting our children. The Age Assurance topic was hot at GDC in Geneva, with GDC even establishing an Age Assurance Task Force. 

The Age Assurance advocates are discussing a variety of government approaches, and, based on the number of identity professionals in the discussion, it seems a significant amount of money is being thrown at the problem

Yet nobody asks the most important questions: Who should be accountable for online child safety? What, if anything, is the role of the government? How can you even assess whether an approach is a good or bad one until you state clearly what the government’s role should  be when it comes to online safety.

Nanny and the nanny state

Who should be accountable for online child safety?

The obvious answer is the parents, and the other obvious answer is anyone who tries to harm the child. The parents get autonomy on what they think is appropriate for their child to do, and anyone who harms or attempts to harm the child should be deterred or punished. The government’s job is to have a judicial system to punish people who perform criminal acts against children.

The government isn’t necessarily supposed to predict who might commit a crime, to prevent all crime, or even necessarily to make it harder to perform crimes. For example, the government isn’t expected to install locks on people’s doors. It is expected to arrest and prosecute thieves. Government officials aren’t expected to staff liquor shops. They are expected to prosecute shopkeepers who sell alcohol to minors. In many countries, the government also prevents liquor companies from advertising to children. All of that is what we expect of our governments. Why do we expect the government’s role to be any different when it comes to age assurance for online activity?

Advocates for government control emphasize how difficult it is for parents to control their children’s use of mobile phones, social media, and harmful online websites. Certainly, that’s part of the problem. However, the bigger problem is that we now live in a society where harming children is not a crime. The clearest symptom on display is the settlement where Meta agreed to pay 18 billion in damages due to harms to children of their social media platforms, yet nobody has been charged with any criminal activities.

How is it possible that 18 billion dollars of damage was done, yet nobody went to jail? The damage included sexual exploitation and suicides. Yet, the people who developed and sanctioned the child-harming activities are not facing criminal trial. It was proven that the highest executives in the company knew of the outcomes of the technology, and actively ignored advice from employees to repair it, yet they face no consequences. The money will be paid by the company, not the individuals. The social media platforms don’t have to change how they operate. Selling harmful services to people will continue at pace. What does that say about the deterrents for real criminals who cause real violent crimes to children?

By the way, this isn’t just true of harming children. Meta admits that scam advertising is approximately 10% of its revenue, and it has a convenient policy that if an advertisement is reported to be a scam, it has to pay higher clickthrough rates. Instead of banning the scams, Meta figured out how to make more money from them. In this case, at the very least, such behavior could be considered aiding and abetting a crime.

Rather than implementing a system that would prosecute criminals, governments and intergovernmental organizations are now funding discussions about age assurance technologies. But what will this actually do? If nobody gets prosecuted for harms, why does it matter if new legislation is in place? The technologies being proposed may be used to surveil the public, which is already a huge risk. However, since corporations already have your data, surveillance isn’t the main objective from their perspective. What corporations are likely to get is the expansion of plausible deniability. In other words, age assurance could be just one more layer of bureaucratic protection for corporate executives and product developers who have no qualms about producing addictive and harmful products. Everyone from financial institutions to the government itself can feel comfortable leaking private information to hackers as long as they were “compliant” with security regulations and can document “reasonable,” industry-standard mitigations.

Expanding plausible deniability

Fundamentally, Age Assurance regulations will expand corporate plausible deniability, as if the social media companies needed it. For years, these companies have been telling us that they are not able to discern the age of their users if the user lies about their age. Obviously, that’s been baloney all along. If they couldn’t discern the age of the users, they wouldn’t be able to serve them the most addictive content possible for their age groups.

But with age assurance laws, it’s about to get even better for those who harm children (either intentionally or by neglect). Simply complying with new legislation will be enough for them to escape the consequences of their actions. Such legislation may allow them to avoid fines that are currently applied, because companies will be able to prove that they used some complicated compliance and surveillance protocol.

Age assurance, as it’s currently envisioned, is just one more layer of protection (also known as limited liability) to protect corporate executives who don’t mind the “collateral damage” that comes with their products.

If you’re really concerned about child safety, let’s talk about solutions that would really help. For example, enforcement authorities could jail the CEOs if their technologies cause death. Even a few months in a regular prison would be a significant deterrent to the white-collar tech bros. A good start would be simply pressing charges and putting a half a dozen executives in for a few weeks without bail. For the ones whose products caused death, we could even sentence them as if they’d committed manslaughter. You don’t have to put them all in jail, either, just one or two. I’m willing to bet if you just put a couple of them in jail for a year, you’d suddenly see safer online products from those who hadn’t yet been jailed. You know what? As long as we are doing it for the social media execs, how about the AI execs too? I’m sure you could think of other company executives who might be liable for causing (or failing to prevent) demonstrably preventable deaths.

But here’s the really crazy thing. Some readers are thinking that the above paragraph is extreme. Maybe you think it’s extreme. That’s because we live in a society where it’s perfectly OK to cause death and go on causing death under the guise of fiduciary responsibility. In fact, none of us can imagine the consequences of living in a society where corporations are liable for the bodily harms their products cause. We won’t go down that rabbit hole, but just think about it for a moment. We are resigned to a society in which we attempt more and more technological safeguards while continuing to develop technologies that are increasingly unsafe.

Stay calm and take responsibility

Most of us have heard of parental control software, but there’s also great software out there which can help your business make sure it’s not serving inappropriate content to the wrong age group. It’s not hard to develop if you’re a massive advertising-financed social media company, and if you’re not, there are off-the-shelf products. Some of our DIF members are the producers of the kind of tech that can protect you, the business owner, from causing harm to minors. It’s not hard. You just have to care enough to take responsibility.

Legislation that makes sense

Generally, it is a bad idea to censor the internet. It is a bad idea to surveil people’s phones. However, there is a place for government legislation and judicial intervention.

Governments need to punish and ban the real harm and neglect that corporations knowingly produce. “Limited liability” needs to be reconsidered now that corporations are reaching into our skulls and rewiring our decisions and perceptions. Where executives know they are causing serious harm, it is absurd to protect them under a “fiduciary responsibility” or “limited liability” when the harms caused are so tangible. Instead of spending money on yet one more layer of legislation, governments need to establish liability frameworks that hold corporations responsible for their products and services.

In an age of zero personal accountability, age assurance legislation is unlikely to prevent harm and more likely to protect those who least need protection: the criminals themselves.