Last week, the Australian government decided against the eSafety Commissioner’s recommendation of a pilot before requiring adult sites to verify the ages of visitors. They said this was due to concerns about the privacy of people’s data and the maturity of age assurance technology.
So what exactly would constitute a mature technology? Is it something comparable to NASA’s Technology Readiness level? This suggests the technology needs to have gone through a thorough process of research and prototyping, before testing in a live environment and then ultimately rolling it out.
If that’s the case, we can say that Yoti and other age assurance providers have met the mature technology requirements. After all, some of the largest platforms in the world, including Facebook, Instagram and OnlyFans, have been verifying the ages of their users for over a year.
Or is the concern more around the maturity of the industry? A sensible set of questions to determine the maturity of an industry might include:
- Is there a healthy ecosystem of providers?
- Are there standards in place?
- Has it been adopted by global organisations?
- Are there independent audits with consistent measurement?
- Has there been transparent benchmarking at scale?
- Is there an established trade body?
- Has any sectoral research been done?
- Have there been any regulatory reviews in other jurisdictions?
We’ve answered these questions to help others trying to determine if age assurance is a mature technology and industry.
Is there a healthy ecosystem of providers?
The German government regulator (KJM) has reviewed and approved over 100 methods of age assurance over the last decade.
This includes approving several facial age estimation approaches. There are numerous different providers with a range of options. They have an agreed safety buffer of five years over the threshold age for users to access adult content.
Are there standards in place?
There has been a publicly available specification for age assurance since 2018 with PAS 1296:2018. In the UK, Minimum Standards for Age Assurance were drawn up as a bill and presented by Baroness Kidron in 2021. These were widely welcomed by industry in the UK. Additionally, there are international IEEE and ISO standards which work through the standards development process. The first of these is due to be completed in the coming months.
Has it been adopted by global organisations?
Global organisations such as Instagram, Facebook, OnlyFans, Yubo, NCR (National Cash Registers), Diebold and SuperAwesome have integrated our facial age estimation technology into their platforms.
Yoti, as one company alone, has delivered over 600 million age assurance checks for more than 100 customers in over 100 countries globally. When users around the world are presented with different ways to prove their age, over 80% opt for facial age estimation.
Are there independent audits with consistent measurement?
Independent audits are undertaken by bodies such as the Age Check Certification Scheme (ACCS) and NCC Group, as far back as 2020 and 2019 respectively.
Age assurance technology is developing quickly. As such, it is important to create an aligned approach to age assurance. This work has been commissioned by the Digital Regulators Cooperation Forum and undertaken by ACCS. The research also discusses what ‘state-of-the-art’ age assurance looks like:
“In terms of measurement, ‘state-of-the-art’ is best described as the layer of technology that sits between those technologies that are within existing scientific knowledge and research but may not yet be commercially viable services; and those technologies that are so embedded in everyday life and usage, they have become generally accepted rules of technology.”
Has there been transparent benchmarking at scale?
Accredited testing labs, such as iBeta, already test for liveness to NIST-specified levels. NIST has also started a regular global benchmarking programme for facial age estimation. Due to its scale, this benchmarking programme will include a statistically significant sample, which is likely to be over one million individuals. In comparison, the sample in Australia was based on just 14 individuals, aged 3 to 21.
We’ll soon be publishing an updated facial age estimation white paper as we continue to improve our accuracy and bias levels. We publish these levels transparently using the proposed standardised measurement approaches.
Is there an established trade body?
Age Verification Providers Association (AVPA) is a global trade body for independent providers of age assurance technology. They currently represent 26 industry provider members, many of which provide facial age estimation.
Has any sectoral research been done?
Market intelligence organisation Liminal conducts regular reviews and updates on the sector. In addition, the Future of Privacy Forum has materials describing the range of facial technologies. They make a clear distinction between 1:1 facial recognition, 1:many facial recognition, and facial analysis or characterisation.
Family Online Safety Institute (FOSI) has published a paper reviewing age assurance. In this, they state that “improving age assurance systems has the potential to significantly increase online safety for all users. It is an achievable goal that everyone can unite behind, and will take a combination of innovative technology, transparent and trustworthy practices, and thoughtful regulation that sets a floor for industry to meet and exceed. Every online ecosystem can benefit from having some type of age assurance. This includes e-commerce and online marketplaces, gaming, streaming, news, and other platforms that could offer safer and more age appropriate online experiences”.
Have there been any regulatory reviews in other jurisdictions?
Regulators around the world are reviewing age assurance with many referring to age verification and estimation approaches in regulation.
In the UK, the Information Commissioner’s Office’s (ICO) 2021-2022 regulatory sandbox concluded that “Yoti’s age estimation tool has demonstrated that it is, in some contexts, possible to use biometrics to make a decision about an individual or treat them differently without using that biometric data for the purpose of uniquely identifying that person”.
The ICO also concluded that our technology is distinct from facial recognition because it does not uniquely identify anyone, and “will not result in the processing of special category data”’.
The German Association for Voluntary Self-Regulation of Digital Media Service Providers (FSM) awarded Yoti’s facial age estimation with their Seal of Approval in 2020. They found that the technology meets the required level to regulate access to content for minors.
This year, the French data protection regulator, the CNIL, stated in a report that “it considers acceptable the use of age verification by validation of a payment card or a process of facial age estimation based on facial analysis without facial recognition”.
Facial age estimation is a privacy-preserving solution
In terms of the privacy concerns raised by the Australian government, Yoti (and many other providers) offer a range of privacy-preserving solutions. Facial age estimation simply takes an image of a user’s face, converts the pixels of the image into numbers and compares the pattern of numbers to patterns associated with known ages. As soon as the age has been estimated, the image is permanently deleted.
Our Digital ID app lets the user share only their age, or an ‘over 18’ proof of age credential, with no other personal information. Document verification checks can also be configured so that no personally identifiable information (PII) is passed on to the website needing to do the age check.
If you’d like to find out more about our age assurance solutions, please get in touch.
