UK Online Safety Regulations and impact on Forums

[Miyevan]

In UK you must be at least 18 to have a credit card. You then charge 0.1£ for membership in certain areas of your forum where adults most likely will post not so nice content. You only need a platform that can force credit card payments only.

After the payment, a photo of a passport / id with everything but first and last name censored to be submitted for approval.
-- This can be faked but at least you do your best part.

You can also combine this with a consent tick before register or regular messages sent across the forums where you state clearly that any underage user will be banned indefinitely.
It's the cheapest solution I can think of.

 

[zappaDPJ]

You then charge 0.1£ for membership in certain areas of your forum where adults most likely will post not so nice content.

Credit card providers charge between 1.5% and 3.5% for each transaction as a percentage of the total sale so a transaction that low may not be a viable option.

 

[Alvin63]

I don't have a credit card. Appreciate the suggestion though.

 

[Alvin63]

Actually I'm quite excited about it. He sent a video showing the user journey. User taps to agree to share data. (presumably you could have a message appear first saying - the only data shared will be your age). They then choose their bank from a list. A window opens showing their age or dob and they tap to agree to share it. And that's it. The age is then sent to the forum (somehow).

So presumably then the only cost would be paying someone to implement an API for the forum. And the API would need to be set up to say if it;s this then accept registraton (presumably).

Ok the downside - the free version is Uk coverage only. The paid for, full identity check version, is global......

So that could be complicated if you only want to age verify Uk members and let everyone else register without a check.

 

[Alvin63]

I don't really understand API integration, but would it be possible to have a layer that allows some people to register without doing the age verify check, if they are not from the Uk? That would be small numbers on my site. Ie a question - are you from the Uk? If they tick yes they get asked to verify age. If they tick no they can just register and go into a group where their location can be checked after registering just to be sure they're not from the Uk. No that wouldn't work as some could tick no to avoid the age check.

So maybe the IP address would need scanning? If it's uk they get asked to verify, if it's not they get to register.

 

[Alvin63]

Seems Youtube/google are age checking now - unless it's only for certain videos perhaps. This came up when I clicked on a link from Facebook to a youtube medical video.

 

[Alvin63]

I opted for the selfie option. I was on computer. After clicking to go ahead (screenshot below), It asked me to point my phone camera at a QR code, which then took me to Private ID's site. It asks you to consent to using your camera. Then a circle appears to frame your face in. It gave various instructions like hold it higher, hold it further away. And take your glasses off ..... so I took my glasses off and then couldn't read the instructions Anyway must have got it right as a big tick appeared on the phone, and on computer it just came up with "thank you for confirming". Notice it says once it's done the selfie will be deleted.

 

[Alvin63]

Can't see how to contact Private ID but they have this online. Thought it could be worth asking how much they charge etc.

Private ID Web SDK

Private Identity Web SDK Documentation

docs.websdk.privateid.com

Identity Security for the Digital Enterprise | Ping Identity

support.pingidentity.com

They seem to have an app on the Apple webstore

‎PrivateID Age

‎Decentralized biometrics using fully homomorphic encryption Private Identity® provides extremely fast, accurate, and efficient face, voice, and fingerprint solutions on browsers, phones, platforms, and clouds with full privacy. This app can estimate user's age.

apps.apple.com

This seems to be the same company - the link in the Apple webstore leads here - something to do with Github

Private Identity

Private Identity - Decentralized Biometrics with Fully Homomorphic Encryption

devel.private.id

At the bottom of the page (last link) is a contact email so I've emailed them to ask about it. sales@private.id

 

[Alvin63]

Also contacted this company which has Face ID. But I expect all will have charges whereas OneID option is free (but only works for uk users).

Multi-modal age estimation | Face, voice & NFC ID | Privately

High accuracy & reliability - the only digital multi-modal age verification solution on the market. Fully privacy preserving, customisable technology

www.privately.eu

@chillibear when you did the Shufti trial was it a standalone trial of the software, or did you first need to integrate the API into your site?

 

[chillibear]

Can't see how to contact Private ID

If you scroll down the page at https://privateid.com/ you'll find a form to join their waitlist, but I expect the email is just as good.

Regarding the other company Privately.eu

Also contacted this company which has Face ID. But I expect all will have charges

Privately Developer

developer.privately.eu

£200/month for up to 10,000 checks.

They have a demo page of their other tools - https://showroom.privately.swiss/ all very neat. Alas they don't list pricing for access to any of those, so probably out of reach. It's one of the few other places I've seen to offer a CSAM scanning option.

when you did the Shufti trial was it a standalone trial of the software, or did you first need to integrate the API into your site?

Given time was limited I just wrote enough code to generate the URLs I would have sent to members for them to visit to do the verification and enough code to check the status of those verifications. So I've not integrated it yet. You could in theory do it all manually if you really wanted to I suppose!

 

[Alvin63]

Thanks. Ok so we can forget Privately.eu then! I think it's Swiss so bound to be expensive!

What do you reckon to One ID's free option for Uk users only? I am very tempted - if I can work out a way to filter out non uk registrations and offer them some alternative. I had so few non uk ones that I could just check them manually. Or even just "allow" them. If we're technically only supposed to age check uk users .........

 

[chillibear]

What do you reckon to One ID's free option for Uk users only?

Seems like a good solution and for whatever reason I quite liked OneID, the guy I spoke with seemed to know his stuff. If you're happy to handle anyone who can't do that option manually I don't see why it wouldn't work. I've not tried writing any code for it - but the flow is pretty standard. If I get a chance I'll try it out just from curiosity.

 

[Alpha1]

If its free, they must be selling data.

Not necessarily. Companies like Patreon and OneID offer products and services that already require age verification. So anyone that signs up for such service is age verified. It could make sense for OneID to offer this free service as they benefit from getting more customers on their Payment platform. That's also why Patreon offers Oauth login that can be implemented in other websites.

 

[Alvin63]

Google also showed me One ID has received 16 million in funding. I'm not saying they are doing a free option out of the goodness of their hearts but, there is something behind the investment funding perhaps - and also the free option is indeed a leader to a paid for one as the free one only covers the uk.

Investors back OneID®'s Bank-verified digital identity solution

OneID is one of the leading angel-funded businesses in the world, having raised over £16m from more than 200 UK, Swedish and US Angel Investors.

oneid.uk

I actually prefer the Shufti Face Id, but don't want to pay for it! And I'd also want to try it and see if it's as good as the one I did yesterday. (Private ID for Google).

 

[Alvin63]

Seems like a good solution and for whatever reason I quite liked OneID, the guy I spoke with seemed to know his stuff. If you're happy to handle anyone who can't do that option manually I don't see why it wouldn't work. I've not tried writing any code for it - but the flow is pretty standard. If I get a chance I'll try it out just from curiosity.

So - what would be the easiest way to filter out non uk people at the time of registration? When you can't see their IP address BEFORE they've registered? I suppose a two layer thing like you mentioned before @chillibear - ie let everyone register and go into a basic group where they are then presented with proving their age to be able to "enter" the forum. After registration, IP addresses would be checkable. But ideally then I'd need some automated IP address checker to "filter out" those not from the UK (ignoring VPN for now). And present them with a different message, while those from the Uk get presented with the age verification button.

But ideally I'd like to just have everyone presented with something at first registration and avoid another hoop to jump through.

Can't work this out. I suppose it could be a message saying - if you're outside the Uk please contact us to verify age. But that would just put them off. I wouldn't want to pay 35p for registration for the global option, when it could be 20c for Shufti. I assume the global option isn't the bank verification option either.

 

[Alvin63]

I guess it could say "If you're not from the Uk, please click here" and take them to registration and then some alert so I can check the IP address. Or send them to a link to "Contact us". Hmm. The difficulty is, it's usually spammers who are outside the uk ........How does cloudflare turnstile check them? Does it just scan the email address?

 

[Alvin63]

Don't suppose I'll hear back from anyone until after the Bank Holiday week-end now ..............

 

[zappaDPJ]

OFCOM needs to develop their own robust age verification app and the necessary code/API instead of expecting a bazillion small sites to individually do their work for them.

People are far more likely to accept a verify once to access all scenario rather than have to fiddle around with different procedures for every site they wish to remain on or join. And let's face it, the majority will simply walk on by.

 

[Alvin63]

That would be good. I doubt it will happen. Their remit is probably to give guidance, investigate and enforce. Leaving the onus on site owners. I think it's the Gov who should have made age verification and API available. They aren't going to because they just don't get the whole thing. They probably only think about big sites like X.

 

[chillibear]

Getting the Gov to do it wholesale is rather like asking for a Digital ID service - which putting politics to one side - you may or may not be keen on. That said they could have done a privacy conscious system, but I expect there would be a huge temptation to log which sites each person was age-checking with!

As an aside I just clarified with Shufti that they don't have a mechanism to offer an either/or type check - so you can't have a user choose between say Selfie estimation OR ID scan. You can only chain them. They also clarified that unless you delete a user's verification from the backend (where you see their selfie, ID scan, etc) they retain the data for seven years. So for now I think I'll stick with what I have and if time permits maybe do a proof of concept for OneID.