UK Online Safety Regulations and impact on Forums
- Thread starter lazy llama
- Start date
-
- Tags
- regulation
Lol - all arguing over who should be responsible for age ID!Ultimately it seems all this age verification stuff will likely be offloaded to the OS or browser level.
Apple and and Google have been holding out for year, but thanks to the Aussie social media laws it seems solutions will be rolled out this year. They talk about it on one of the recent security now podcasts.
Apple unveils age ID tech before Aus social media ban
Age assurance features coming ‘this year’.ia.acs.org.au
I’m sure more robust cross platform solutions that include desktop browsers will eventually be available.
"The tech giant’s announcement pushes back against companies such as Snap and Meta, which have called for device manufacturers like Apple and Google to be responsible for verifying users’ ages at the app store or operating system level, instead of by social media apps."
"Apple used its whitepaper to argue why it believed the operators of apps, such as major social media platforms, should be ultimately responsible for age assurance — and not app store operators."
Alpha1
Well-known member
Age verification is very disruptive and privacy sensitive. Getting people to provide identification documents in this day and age will be like getting blood from a stone. Platforms, software and services are getting hacked by the dozens. Identity theft is a common method to scam people out of money.
Highly trusted and much used platforms like Apple and Google would be the best provider. But with strict privacy laws and high penalties it would be an insane risk for them to offer such service and guard the data.
The havoc hackers and state actors could wreak if they get hold of many millions of IDs, is beyond comprehension. They could literally loot the country.
Highly trusted and much used platforms like Apple and Google would be the best provider. But with strict privacy laws and high penalties it would be an insane risk for them to offer such service and guard the data.
The havoc hackers and state actors could wreak if they get hold of many millions of IDs, is beyond comprehension. They could literally loot the country.
Some of the age checking solutions say they don't store any data. Once it's scanned they don't store anything. The phone checking one sounds the simplest - but not sure it's acceptable enough. They just put their phone number in. Get an OTP to enter. Their records are checked in the background with the phone company and approved in seconds. However I can't see that one is any good for verifying someone is an adult because most kids phone contracts will be in their parents name.
My enquiries to various age verification companies are slowly yielding obtuse results! They clearly are not used to just talking to a person and talk vaguely and add links to faq's etc.
One ID
One ID - immediately added me to their newsletter mailing list and sending more of those than response emails. Asked more questions than gave answers and then replied with vague information and links to products, and faq's, but the gist of it is if you need the shopify app installed and then install their software via that. They offer an age verification option outside of shopify (but don't say what it is) but that needs a transactional element (ie a purchase). So they didn't answer the questions after the inital email reply asking more questions than giving answers. That option is 16p per check but I think it's the one based on checking phone records which isn't really suitable IMO as kids phones are usually on an adult account.
The shopify option sounds better. They have three different plans.
1) A "premium plan" at 35p per check, checks age via banking records (they don't say how - ie does it just check there is a bank account, or do they actually verify an age via the bank check?).
2)A "premium persist plan". Same as the premium plan but remembers the age for future transactions (not really relevant).
3) A free plan which places a button "on the cart page of your store" which means customers are required to perform an age verification check with their bank before proceeding (doesn't say how). This requires a minimum transaction value (but doesn't say what that is).
There is a link to how to install their plugin, a link to faq's (which don't give all the answers) or an option to "book" with an account executive (maybe a person who will talk to you one to one and be clearer?).
It seems more geared to shopping sites. But I think a number of sites use shopify and it might be an option. Not sure if it can still be used if you don't charge a small fee for registration though. I probably need to arrange an "account executive" appointment.
How to install their plugin:
Verifymy
@chillibear I believe has already spoken with them and obtained some information posted earlier.
They just replied asking for more information (which I'd already given in my initial enquiry!) saying they would then follow up with more information. They have the email checking solution I think sounds a good option. Just wanted a price really and more detail really!
GBG
Immediately added me to their newsletter/junk email list and sent plenty of those before replying to my query. I've had one email replying to my query saying "someone will get in touch with you".
Haven't heard back from AgeGo or Luciditi.
More info about Shopify
For using OneID
Yes, you can use Shopify for non ecommerce websites. But not without limitations. While Shopify offers various components for traditional websites, they aren’t optimized for non ecommerce.
Although Shopify is for selling products, here are four key benefits of using Shopify for non ecommerce:
Firstly, Shopify provides an intuitive drag-and-drop interface. This allows users to create professional-looking websites easily.
With such a user-friendly approach, businesses can create visually appealing websites at a budget-friendly price.
It seems there are costs involved in using Shopify so maybe not an option.
heytony.ca
One ID
One ID - immediately added me to their newsletter mailing list and sending more of those than response emails. Asked more questions than gave answers and then replied with vague information and links to products, and faq's, but the gist of it is if you need the shopify app installed and then install their software via that. They offer an age verification option outside of shopify (but don't say what it is) but that needs a transactional element (ie a purchase). So they didn't answer the questions after the inital email reply asking more questions than giving answers. That option is 16p per check but I think it's the one based on checking phone records which isn't really suitable IMO as kids phones are usually on an adult account.
The shopify option sounds better. They have three different plans.
1) A "premium plan" at 35p per check, checks age via banking records (they don't say how - ie does it just check there is a bank account, or do they actually verify an age via the bank check?).
2)A "premium persist plan". Same as the premium plan but remembers the age for future transactions (not really relevant).
3) A free plan which places a button "on the cart page of your store" which means customers are required to perform an age verification check with their bank before proceeding (doesn't say how). This requires a minimum transaction value (but doesn't say what that is).
There is a link to how to install their plugin, a link to faq's (which don't give all the answers) or an option to "book" with an account executive (maybe a person who will talk to you one to one and be clearer?).
It seems more geared to shopping sites. But I think a number of sites use shopify and it might be an option. Not sure if it can still be used if you don't charge a small fee for registration though. I probably need to arrange an "account executive" appointment.
How to install their plugin:
Verifymy
@chillibear I believe has already spoken with them and obtained some information posted earlier.
They just replied asking for more information (which I'd already given in my initial enquiry!) saying they would then follow up with more information. They have the email checking solution I think sounds a good option. Just wanted a price really and more detail really!
GBG
Immediately added me to their newsletter/junk email list and sent plenty of those before replying to my query. I've had one email replying to my query saying "someone will get in touch with you".
Haven't heard back from AgeGo or Luciditi.
More info about Shopify
For using OneID
Can You Use Shopify for Non Ecommerce Websites?
Yes, you can use Shopify for non ecommerce websites. But not without limitations. While Shopify offers various components for traditional websites, they aren’t optimized for non ecommerce.
Benefits of Using Shopify for Non Ecommerce Websites
Although Shopify is for selling products, here are four key benefits of using Shopify for non ecommerce:
Build Your Website With Drag-and-Drop
Firstly, Shopify provides an intuitive drag-and-drop interface. This allows users to create professional-looking websites easily.
With such a user-friendly approach, businesses can create visually appealing websites at a budget-friendly price.
It seems there are costs involved in using Shopify so maybe not an option.
Can You Use Shopify for Non Ecommerce?
Can you use Shopify for non ecommerce? Learn how to grow your non ecommerce business online using Shopify's unique features.
heytony.ca
Last edited:
chillibear
Well-known member
You mean this age estimation solution they list, not something I've discussed with them. I have seen email mooted as a suggestion for checking, but it rather assumes people use one email address. I would imagine it costs less than their main Age Verification API which costs 80p - £1 per check depending on volume. That's the one I've integrated with. I do see they list some other options, but presumably they require more discussion as they don't seem to publish the interfaces.
Is the OneID shopify option not aimed at someone running a shopify powered shop (selling age restricted products)? - hence them talking about installing it into the shopify app (which lets you manage your shopify account). I'm not quite sure how you'd integrate that back into XenForo. Would it not just be much easier to use their age verification service directly? Although they don't list pricing I see. Likewise I do scratch my head slightly at the mobile phone checking. Also does that mean all the mobile/cell companies (UK only or global?) are just happily telling 3rd parties information about their customers. Now granted who does read the T&Cs so maybe I did agree with my mobile/cell provider that they can tell anyone my age...
In my experience you need to be fairly clear about what you are asking for from these providers - if you want a REST API to integrate with then you need to ask for that, also being up front about numbers, etc. Contacting One-ID had been on my todo list as I was curious about a few of their solutions. Other than the Stripe integration mentioned earlier in the thread I don't think there are any "simple" as in install the XF AddOn solutions available. Right now I don't think there seems to be the demand. That Stripe integration doesn't have much discussion on the resource suggesting it's maybe not extensively used and I don't think anyone else on this thread has mooted their own in-house solutions. Certainly no one has contacted me to discuss using mine. So I suspect your best bet is perhaps research some of the providers and engage one of the XF Add-On developers here to develop a solution. I've no idea what the going rate for XF software development is, but there would be a cost there. Now that cost might be re-couped through sales of the add-on or maybe if you can drum up enough interest split over multiple forum owners here.
I suspect once the child risk assessment stuff is published perhaps that will help determine if people feel they need to use age-verification. It may be that it's less onerous than we presently fear - you never know!
Yes. It's acceptable to Ofcom apparently. Hopefully they will get back to me with more info. I agree that people could have more than one email address. As I understand it, it's a bit like when you go on Verifalia to check out if an email address is genuine. The results come up with info like: valid, no high risk factors, not a role organisation email, not associated with a disposable email, not a honeypot ... That kind of thing - but the verifymy also checks to see where the email is registered - eg mortgage companies, utility bill sites or other sites that only adults can use. Maybe similar to an Experian type check? And comes back with a pass or fail. All done in seconds just by entering an email address. I think if it fails it asks for alternative ID though. Scanning an ID document or similar. And although it's only age "estimation" it's supposed to be very high standard and Ofcom guidance seems to accept it.
The issue, as you say, is people might use different email addresses for different things. Whether it gives them the option to try a different email address, if the check fails, I don't know. I can ask about that. Waiting to hear back with further info.
And while these things need to be reliable, neither does a site owner want numerous "fails" and people give up trying to register.
Well from what I've seen on the guidance I don't want to do it! Not doing any further in depth and more detailed risk assessments. And even if doing it, it would most likely lead to more software integration needed to "mitigate" the lesser "harms". So I'm sticking with trying to find this solution for now. Although it does seem extremely difficult to resolve and most of these companies are really geared to dealing with large commercial companies it seems.
I did ask Chat GPT for some alternative solutions, to the ones mentioned before and it mentioned Shufti. I've contacted them and waiting for someone to get back to me. Apparently they also have email estimation.
I don't think OneID is an option. The phone checking doesn't sound useful. For example we have a teenager with a smart phone. His contract is on our account - no information about him or his age at all. Just the adult account paying for it.
One site (can't remember which) said the phone checking method goes by whether or not the adult filter has been turned on or not. ie the adult filter is automatically set and people have to manually remove it. If the adult filter is still set they assume it's a child. Which sounds extremely unreliable to me! I don't think we have never "turned on" the adult filter with ours - why bother when it works fine as it is. And some adults also want to filter out adult content!
As these results are supposed to take seconds, I assume the companies have a deal with the phone companies, to instantly scan certain options. Without storing any personal info.
One thing that occurred to me for the child assessment stuff later, is sites with adverts on. If any of your adverts are inappropriate for kids eg. I only tried adverts on the forum once and it was paying peanuts so I stopped bothering, but some, while not being over the top, were definitely not suitable to the topic and membership!
I think the guidance has already been published - linked earlier. I've read a lot of it. Although I believe it says it may still change as they're still consulting. But if it changes it would be to tighten things up more I suspect - due to the people they are consulting with IMO
Last edited:
I also don't think members would want to enter a phone number. They might have concerns someone could call them - privacy issue. Whereas most people accept signing up with an email address. Tbh I had never heard of "Stripe" until this post. Is it a Uk thing as well as a US thing?
This is the info about VerifyMy email age estimation. Just need a price now!
verifymy.io
A video about how it works from their COO (company based in London)
Assurance level 3 with Agecheck. 0% false positive rate. 84% true positive Success rate. 16% were just not verifiable - not children - just not enough info. Those 16% can be asked to use another method of age verification if not successful.
Verifymy's white paper with further details. The white paper doesn't show much more but is up to speed with all Ofcom compliance and the OSA. And has a few charts with statistics.
verifymy.io
Email address age estimation
Quickly and accurately estimate a user's age using just their email address and ensure compliance with global regulations while prioritising privacy.
verifymy.io
A video about how it works from their COO (company based in London)
Assurance level 3 with Agecheck. 0% false positive rate. 84% true positive Success rate. 16% were just not verifiable - not children - just not enough info. Those 16% can be asked to use another method of age verification if not successful.
Verifymy's white paper with further details. The white paper doesn't show much more but is up to speed with all Ofcom compliance and the OSA. And has a few charts with statistics.
Email address as the new benchmark for frictionless age estimation
Download our white paper to explore how email-based age estimation offers frictionless, privacy-preserving solutions for online platforms to ensure age compliance.
verifymy.io
Last edited:
Shufti. Offers ID based, face based or email verification (but email only via an ID based verification). Says pricing is usage based and they can offer a "cost effective" package but the lowest initial amount you can start with is $1000!. Doesn't say what the cost per usage is. So that's not an option.
chillibear
Well-known member
I've got a meeting with OneID on Friday so will see what they can offer. They look very UK centric however and I'm not totally sure, but it'll be interesting to see.
Just email would be very neat. I know VeryifyMy keep a hashed copy of emails that pass (not sure about fail) their verification. So say you buy something age restricted through Toolstation and hop through the VerifyMy age checking there - then using the same email do the age-check on my forum using the same email - you'd wizz through that immediately. It make business sense - doing actual ID checks and things like that will cost money and resources so if you can bypass it all why not! I expect if your "primary" email fails they might do a email and validate check on another one. I might give them a shout about it, not that they are very fast at dealing with support calls it seems ...! I'm certainly keen to avoid gathering more data. My main concern is how well all these tools will work globally.
Just email would be very neat. I know VeryifyMy keep a hashed copy of emails that pass (not sure about fail) their verification. So say you buy something age restricted through Toolstation and hop through the VerifyMy age checking there - then using the same email do the age-check on my forum using the same email - you'd wizz through that immediately. It make business sense - doing actual ID checks and things like that will cost money and resources so if you can bypass it all why not! I expect if your "primary" email fails they might do a email and validate check on another one. I might give them a shout about it, not that they are very fast at dealing with support calls it seems ...! I'm certainly keen to avoid gathering more data. My main concern is how well all these tools will work globally.
Just another payment provider like PayPal, got fairly well known for having more modern slick interfaces and being better a bridging the online and physical worlds (mobile card terminals). See https://xenforo.com/community/resources/stripe-identity.8832/ and https://stripe.com/gb/identity#pricing I've not bought the add-on to have a look and I did start to knock up a proof of concept myself. I may yet explore it some more. Right now that's the only immediate solution I know of for XF, but I don't know quite what the add-on offers feature wise (and obviously you do need a Stripe account - which you need to do a fair amount of identifying yourself/company for). Beyond that no one else has shouted about a solution that I've noticed so it looks like just old Stripy and my own Ruby/VerifyMy solutions floating about. speaking of which I should get back to doing some more testing in anger!
Thanks - I don't think any of my members will be wanting to get a stripe account. A lot of them don't even use paypal.
I'm waiting to hear back further from VerifyMy after replying to them with what I'm looking for. Just want a price! How you would "install" it on a forum is another matter. Might need a developer maybe?
JamesBrown
Well-known member
I've written to my MP about small communities; age verification and how it might impact us. Thing is, the subs charging forums might get away with paying a couple of quid per member going forward. But it's the 50,000 existing members that would mean you'd need a mortgage!
chillibear
Well-known member
You don't need a stripe account to use stripe as a customer, much as you don't need a paypal account to use paypal as a customer (although they do rather encourage you to do so). The site owner needs a Paypal or Stripe account to accept payments using those services of course.
I would expect their email-only solution to be much like the others - so you can look at the API for the full on age-verification to get an idea of what is likely to look like - you probably throw an email at an endpoint and either check for status or get a webhook back. I would guess pricing will be between 25p and £1 per check based off everything else we've seen from them. If the API interface is similar it wont be too hard to write something to talk to it. Guessing you don't write software yourself then.
I would expect their email-only solution to be much like the others - so you can look at the API for the full on age-verification to get an idea of what is likely to look like - you probably throw an email at an endpoint and either check for status or get a webhook back. I would guess pricing will be between 25p and £1 per check based off everything else we've seen from them. If the API interface is similar it wont be too hard to write something to talk to it. Guessing you don't write software yourself then.
Shufti just got back to me with some proposals and said it might be possible to pay in instalments if it's a non profit site. They're checking with their manager. Just checking what the proposals are!
Ok so the price per verification isn't bad - about 20 cents per verification. But - for that you need to pay $750 upfront (they reduced that from $1000 dollars for me). But....it's still $750! The more you pay upfront, the cheaper the price per verification. This is for the face detection option.
I could go with paying 20 cents per verification, but not paying such huge sums of money upfront.
Ok so the price per verification isn't bad - about 20 cents per verification. But - for that you need to pay $750 upfront (they reduced that from $1000 dollars for me). But....it's still $750! The more you pay upfront, the cheaper the price per verification. This is for the face detection option.
I could go with paying 20 cents per verification, but not paying such huge sums of money upfront.
Last edited:
MentaL
Well-known member
what about bogus sign ups?