UK Online Safety Regulations and impact on Forums

[benFF]

All this talk of age verification for every signup is just unrealistic.

Hardly anyone is going to be ok with paying to join a forum, and even fewer will be happy submitting id documents (even though it's to a third party) just to ask how to help their sick hamster.

You could mitigate the issue a bit by bearing the cost yourself, but if you have hundreds of registrations a day.....

 

[Alvin63]

I would assume any banking check is a check with the issuing bank and they will presumably have ID checked the person opening the account - so the bank are in a position to tell them if you are over 18?


As long as they have a global one you're good I guess. I suspect the first stage check my supplier (VerifyMyAge) are using. I don't know how well their solution will work for a global audience yet.


Yes. 80p per check (noting that since paypal has fees what I have to charge is higher to break even). So far the lowest fees I've found from asking companies are about 25p and the highest about £1.25. However so far it's only VeryifyMyAge and Stripe who I've found that seem to offer a pay as you go model. Also worth noting that that the contract with VeryifyMyAge requires them to be the sole Age-Verification supplier. So whilst I've started looking at Stripe just to see what it's like (thinking maybe more people will know them and maybe trust them?) I'd not be able to use both - it is also the more expensive option (£1.25)

My implementation It's all sitting ready, but I'm not yet forcing anyone to use it just yet for two reasons - firstly just waiting on VerifyMyAge to get to the bottom of the email notifications issue (they always seem to send out an email and I'm not sure if I want that - since the email template at present can't be edited and it's very product purchase orientated) and second I'm working out the neatest way to "grandfather" in some of our existing userbase (it's a tiny site and a lot of the users know others in person, and are well over 18). How good VerifyMyAge will be long term I don't know. I think all age-verification services will be a barrier to membership full stop and I'm not sure exactly how much difference it will really make.


Appreciated. Interesting looking at AgeGo - I'd not even come across the Digital Economy Act (2017) - given that apparently required porn sites to have age verification in place back then I think we can see how heavily things like this are really policed. Although to be fair maybe a "over 18 checkbox" was enough - I've not read the act.

The only clue about pricing for Lucidti was this:

So presumably it's not a PAYG model? I see the WP plugin is available so might glance at the code.

As an aside I was thinking this morning were Ofcom really serious about this from the POV of actually making a difference they would have contacted the companies/groups that make forum software. It was obvious from day one that forums would be under the rules. There are a handful of more serious competing products in the market (think Xenforo, vBul, phpBB, etc, etc). Why not start up a dialog with XF Ltd (etc) and figure out what areas are likely to be needed and then help to fill/fix those areas ahead of the legislation.

I am sure your members will take it in good spirit! Being asked to confirm their age

Good point about whether some methods would work globally - especially things like electoral register checks. However, does it need to work globally or just for Uk members? That is something I'm not sure about. I assume it needs to be for all though as the site itself is Uk based.

 

[Alvin63]

All this talk of age verification for every signup is just unrealistic.

Hardly anyone is going to be ok with paying to join a forum, and even fewer will be happy submitting id documents (even though it's to a third party) just to ask how to help their sick hamster.

You could mitigate the issue a bit by bearing the cost yourself, but if you have hundreds of registrations a day.....

Some of the accepted forms of age ID are them just scanning their face. No need for documentation. But it needs to be the type of id that includes "liveness". ie that senses it is an actual live, moving person and not just a photo that is held up - which could be of someone else. To be honest I am still not sure how that verifies someone's age as they could just get an adult or older person to do the face scan for them! But it covers the "provider".

I agree it is offputting to have a membership charge at sign up. Even if it's just £1. I suppose another alternative would be to ask for a donation of £3 to cover age verification costs. Of course many people might just not make a donation but if enough people donated £3 it might cover those who didn't! It depends how big the site is. Mine was quite a small site. Most people who registered didn't post - they joined to read articles or follow and read. It was a regular group of posters but not a particularly large group.

 

[Alvin63]

This is some info from One ID's page. It says they use phone records, not banking records (confusingly - maybe they have different options). Whether someone would be willing to input their phone number though is another matter. I think some would be put off by that for privacy reasons.

I'm also not sure phone number is foolproof because children don't have their own mobile phone accounts - it would be in the name of an adult. Children as young as 6 (or maybe younger) have their own smartphones these days so presumably it would verify them as an adult?

 

[benFF]

Most people who registered didn't post - they joined to read articles or follow and read. It was a regular group of posters but not a particularly large group.

This is also an issue.

I have over 30 registrations a day, I can't cover the cost of id checking that.

I guess my point is, I can't believe ofcom really expects that.

Now if it was just id checking to enable direct messaging (which could be done with group upgrades) then that's more reasonable (but still ridiculous!)

 

[Alvin63]

On the lighter side, a photo of an audio cassette with a Q&A could age verify anyone over 40 possibly

 

[Alvin63]

This is also an issue.

I have over 30 registrations a day, I can't cover the cost of id checking that.

I guess my point is, I can't believe ofcom really expects that.

Now if it was just id checking to enable direct messaging (which could be done with group upgrades) then that's more reasonable (but still ridiculous!)

They don't necessarily expect it. But if you don't have it, you have to complete a lengthy child assessment and and child risk assessment. Including all kinds of "harms" for 2 year olds upwards - not just the heavy stuff, but photos of injured animals, "stunts" and all sorts. To exclude absolutely everything would mean extreme censorship on a forum IMO and software to cover every possible "harm".

If you have age ID you are exempt from the Child assessments. Damned if you do and damned if you don't. IMO

 

[benFF]

Now if it was just id checking to enable direct messaging (which could be done with group upgrades) then that's more reasonable (but still ridiculous!)

If I was going to go this route, I'd just use the following addon

Stripe Identity - Reviews

xenforo.com

And restrict it so only donated users can verify.

It can then add them to a group automatically on verification which enables messaging.

 

[Alvin63]

If I was going to go this route, I'd just use the following addon

Stripe Identity - Reviews

xenforo.com

And restrict it so only donated users can verify.

It can then add them to a group automatically on verification which enables messaging.

Does that mean scanning some form of ID? I'm becoming more inclined towards the email checking. Apparently it scans all kinds of places the email has been used so it can tell if it's an adult or not (eg if it's used with a mortgage company). Minimal interaction for the user. If it can't guarantee someone is over 18 it fails and they're asked to use another id method. Not foolproof either as people have more than one email address and may use a separate one for official things and a separate one for site sign ups etc.

We have used the face scanning method here at home for registering for various things and it often fails due to bad lighting etc. Likewise taking a photo of id fails numerous times for various reasons - lighting, not being right inside the frame etc. It gets too tedious and you give up.

I don't think anything can be foolproof - but as long as it's accepted by Ofcom ........

 

[benFF]

Does that mean scanning some form of ID? I'm becoming more inclined towards the email checking. Apparently it scans all kinds of places the email has been used so it can tell if it's an adult or not (eg if it's used with a mortgage company). Minimal interaction for the user. If it can't guarantee someone is over 18 it fails and they're asked to use another id method. Not foolproof either as people have more than one email address and may use a separate one for official things and a separate one for site sign ups etc.

We have used the face scanning method here at home for registering for various things and it often fails due to bad lighting etc. Likewise taking a photo of id fails numerous times for various reasons - lighting, not being right inside the frame etc. It gets too tedious and you give up.

I believe it scans an id document then also takes a selfie to compare and make sure they match

Stripe Identity | Identify Verification for Payments

Secure your business effortlessly with Stripe Identity. Verify the identity of users globally, and safeguard against fraud with minimal friction.

stripe.com

It can return the metadata as well including the dob. (although I don't think the addon right now supports handing that)

 

[Ozzy47]

So users would have to register on Stripe then register on your site? Seems like that would prevent a lot of people from joining, to many hoops to jump through.

 

[benFF]

So users would have to register on Stripe then register on your site? Seems like that would prevent a lot of people from joining, to many hoops to jump through.

No.

They register on your forum as usual, then follow a verification link which is powered by stripe.

All that does is verify id (no stripe registration required) and then pass the result back to the forum.

 

[Alvin63]

@chillibear I know you've been in contact with Verifymy. Which type of age checking was that for? I've messaged them enquiring about the cost of email checking.

Edit: The email option only comes under "Age Estimation" as opposed to "Age verification". However it seems acceptable to Ofcom

What does highly effective age assurance mean?​

Our approach to highly effective age assurance and how we expect it to be implemented in practice applies consistently across three pieces of industry guidance, published today[5]. Our final position, in summary:

• confirms that any age-checking methods deployed by services must be technically accurate, robust, reliable and fair in order to be considered highly effective;
• sets out a non-exhaustive list of methods that we consider are capable of being highly effective. They include: open banking, photo ID matching, facial age estimation, mobile network operator age checks, credit card checks, digital identity services and email-based age estimation;

Age checks to protect children online

Children will be prevented from encountering online pornography and protected from other types of harmful content under Ofcom’s new industry guidance which sets out how we expect sites and apps to introduce highly effective age assurance.

www.ofcom.org.uk

 

[Alvin63]

No.

They register on your forum as usual, then follow a verification link which is powered by stripe.

All that does is verify id (no stripe registration required) and then pass the result back to the forum.

That sounds fairly efficient. I think some of my group would be cautious about their id being seen. Even if it's explained it's not stored anywhere. Do you know what the costs are?

Verifymy has a similar option - scan of id and face.

 

[benFF]

But being realistic, I run a car repair site.i don't have children using it.

Dodgy posts are acted on right away by a moderator responding to reports so that's ok there.

Conversations are only accessible once you've made 10 validated posts.

No one is going to sign up, make 10 useful posts to then try and find children to private message....

I'm sure most forums are the same.

 

[Alvin63]

So you'd just need to do the child assessment and child risk assessment paperwork then. Good moderation really helps. On the list of child risk assessment is bullying, and various race and gender comments etc plus negative comments about women (in so many words). I guess it's unlikely but as I see it it's either a lot of word and phrase blocking - or age verification to avoid having to comply with the child risk assessment.

Ofcom's guidance is that any child could "view" any site from the age of 2 upwards. So if you don't have age verification, you need to do a child assessment and then a child risk assessment.

 

[zappaDPJ]

No one is going to sign up, make 10 useful posts to then try and find children to private message....

This is where the act falls flat on its face. Groomers are obviously going to home in on sites that cater for young people, sites that don't require age verification. This recent BBC article on the Roblox platform is a prime example of how ineffectual the act really is.

Roblox: Boss' online safety advice for children sparks debate

Hundreds of people contacted the BBC after Dave Baszucki spoke about safety on the hugely popular gaming platform.

www.bbc.co.uk

 

[Alvin63]

He has a point and it's what I was saying earlier - parents need to take some responsibility. Even so, age verification would stop grooming as mentioned in that article. In this case age verifcation for UNDER 18! Except kids usually need an adult to sign up for them and pay for things. Thankfully ours are past that age group now. But we taught the risks and they took it seriously. ie don't "friend" anyone you don't know in real life.

Bullying is one of the worst things on kids sites so I think the provider does need some way of preventing that. I assume Roblox doesn't have moderators?

 

[Alvin63]

This is where the act falls flat on its face. Groomers are obviously going to home in on sites that cater for young people, sites that don't require age verification. This recent BBC article on the Roblox platform is a prime example of how ineffectual the act really is.

Roblox: Boss' online safety advice for children sparks debate

Hundreds of people contacted the BBC after Dave Baszucki spoke about safety on the hugely popular gaming platform.

www.bbc.co.uk

I see your point. So the owner of Roblox would need to comply with the full child risk assessment and show how they are mitigating the risks. It wouldn't be enough to say - tell the parents to deal with it. So I think the act does cover his site and it's the site owner's responsibility to prove how they are preventing online harms to kids. They are not going to add age verification and limit the site to 18 year olds. Although it's possible they might get round the act that way. So only adults can sign up and let kids use it - which doesn't protect the kids from adults! Is that what you mean?

 

[chillibear]

No one is going to sign up, make 10 useful posts to then try and find children to private message....

Actually I think the whole reason this is a bit of a pointless exercise is that some people are willing to work entire careers in order to have contact with children they can then leverage to their own perversions. So it becomes one of those impossible to protect fully against. Now as to the best way to at least reduce the odds I don't know. I've never been a huge fan of forced mandates to change behaviour, but I do get that if this act were not landing on everyone we'd have even fewer people discussing mitigations.

I know you've been in contact with Verifymy. Which type of age checking was that for? I've messaged them enquiring about the cost of email checking.

If you scrub back though my posts I outline their process. In essence however: You provide them with a name and address which they check for age (we get that from the purchase of the "age-verification" via PayPal). If that is good then we're done. If not they can use age-estimation (AI checking of selfies) or ID check or Credit Card check.

just a photo that is held up - which could be of someone else.

Fundamentally all these systems can to an extent be bypassed. Once an account is checked off as being 18+ then no one is suggesting it needs checking again. So on big popular sites I expect 18+ accounts might be traded and sold. Mine fails if anyone over 18 is happy to make the initial purchase (just as if you convince someone 18+ to buy booze or whatever from the cornershop). Some of the age-estimation systems let you use any camera (others seem to force built in cameras) and so you can feed in a video of someone older (already plenty of videos like that out there since this started to be a thing). So it'll never be anywhere near perfect and so you wonder what the cost/risk/benefit ratios really are.

All that does is verify id (no stripe registration required) and then pass the result back to the forum.

Thanks for finding that Ben. I somehow totally missed that in scanning through add-ons when I was first looking and literally started last night to look at what it would take to integrate Stripe's solution. Glad I was beaten to it!

Now if it was just id checking to enable direct messaging (which could be done with group upgrades) then that's more reasonable (but still ridiculous!)

Totally agree. This is what I was going to do. Granted it does mean I need to do the Children's risk assessment, but I don't want to make everyone pay to post. Pay to post privately I can live with. That should mean the worst someone can do is at least going to be seen and can be dealt with. I think it'll work on my forum, but I'm not sure it would on lots. One larger one we host I think would be rather put out by asking them to ID themselves. Any solution there I think would have to be 100% third party. Given we've never had any trouble (I am aware of) ever then I would hope trolls excepted we wont going forward, but I am willing to do some bits to improve things. There are some features I'd just like for myself to improve moderation (such as subject categories for reports - I know Xon has a queue add-on that kinda does that)

Do you know what the costs are?

Stripe have that on their site I mentioned earlier £1.25 per check.