All adults (18+) in the UK will soon have to be age-checked when they visit pornographic websites and apps. The age check is intended to make sure that children and teenagers don’t accidentally see explicit content.

The requirement for online porn to be restricted through age verification became law in the Digital Economy Act 2017. This is expected to come into force in autumn 2019. Once in force, if your site sells or hosts more than one-third of explicit content you will have to take steps to make sure that all your customers are aged 18+.

Age verification applies to all sites and apps accessible from the UK which sell or host a large proportion (more than one-third) of explicit content.

Age verification is required regardless of whether the pornographic content is visual, audio or text.

Age verification is mainly targeted at commercial porn sites, but it is also required for websites which offer pornographic content for free but generate revenue through other means such as advertising or ‘premium’ content which must be paid for.

Sites and apps which host “extreme” pornographic material as defined in section 22 of the Digital Economy Act will be blocked outright. This definition is quite broadly worded; it may be worth seeking legal advice if you are unsure whether your content is defined as “extreme”.

The law on age verification applies whenever UK customers visit commercial porn sites and apps, whether these are hosted in the UK or overseas.

The British Board of Film Classification (BBFC) has been appointed by the government to make sure that pornography providers comply with the law. Sites that do not comply with age verification requirements could be blocked at ISP level, have their payments services blocked, be delisted from search engines, have social media accounts removed and face financial penalties.

The BBFC is likely to concentrate its regulation attentions only on the most-used and searched for porn sites and apps.

If your business is flagged as non-compliant by the BBFC, this could lead to it being blocked at ISP level. Even exoneration in any ICO investigation could have knock-on negative impacts such as advertisers withdrawing their advertising.

The law on age verification applies when UK customers visit commercial porn sites and apps, regardless of whether these are hosted in the UK or overseas.

Non-UK-based porn providers are not obliged to age-verify customers. However, where non-UK sites refuse or fail to implement age verification, the UK regulator, the British Board of Film Classification (BBFC) may ask payment providers such as VISA to refuse to process UK payments, with the aim of preventing UK-based individuals from accessing these sites and apps.

Age verification requires you to ensure that your UK customers are aged 18 or over. It is not enough to ask customers to tick a box or enter their date of birth. In order to meet compliance standards and prevent fraud, you must check the validity of the identity information being submitted.

In practice, it is difficult to reliably verify age without also verifying identity. Age verification should use data that cannot be reasonably known, obtained or predicted by another person without theft or fraud. Various sources of information can be used to verify age, including:

• Identity documents (i.e. passport or driving licence)
• Utility bills
• Credit card details (not including Debit, Solo or Electron or any other card where the card holder is not required to be 18 or over)
• Electoral roll data
• Know Your Customer (KYC) checks via specialist credit check or identity check software
• Mobile phone SMS
• Social Media identity

There are various Age verification tools on the market. You should choose a product you trust and which offers the maximum privacy protection to your customers.

The choice of which third-party age verification provider to use is up to you. To best protect yourself and your customers, we recommend you use the most robust tools that offer the most privacy.

Currently available tools include AgeID (owned by MindGeek, which also runs a range of mainstream porn sites including PornHub, YouPorn, Brazzers and RedTube), AVSecure, AgeChecked and Yoti. Each tool has different user requirements, different levels of privacy protection and different cost implications for your business.

The British Board of Film Classification (BBFC) has published guidance for age verification providers which set out the criteria for a legally compliant system. It has also developed a voluntary certification scheme for age verification providers which will assess whether systems comply with GDPR data protection requirements. Engagement with the scheme is not compulsory and we are concerned that as drafted it does little to protect user’s privacy.

Age verification carries significant data protection and privacy risks.

To protect your customers, select a trustworthy age verification tool and ensure that individuals are automatically logged out of your site after each visit.

If you believe your site to have been blocked wrongfully or unfairly, you can appeal to the BBFC’s Independent Appeal Panel. More information is available here.

If you are unsure whether your site has been blocked, use our tool at blocked.org.uk

You must inform the Information Commissioner’s Office (ICO), the UK authority responsible for overseeing data protection compliance, of any data breaches.

You do not always have to inform the people whose data is affected, although it is a part of responsible business to keep people informed where their personal data is at risk of becoming public. There could be very significant consequences for individuals if their pornographic viewing and sexual habits were to be broadcast.

It is possible that age verification requirements will lead to fewer people accessing porn that is hosted in the UK. The law is intended to stop children and teenagers from accessing explicit content. Adults might be intimidated from verifying their age on the basis that there is a risk of exposure. However, this does not mean that the overall market for online porn will shrink.

Age verification also carries an inherent risk of censorship. Porn sites will be subject to regulation by the British Board of Film Classification (BBFC). Sites and apps hosting explicit content may be shut down if they do not comply with regulatory standards. It is probable that once politicians work out that age verification is failing to make porn inaccessible to children, some will demand that more and more sites are blocked. The BBFC will likely be pushed to block ever larger numbers of websites. This could lead to thousands of sites with legal content being blocked in the UK – which could have a positive or negative impact on your business depending on individual circumstances.

Age verification will incur a commercial cost in terms of providing the service itself. This cost will have to be paid either by the site owner or the site user. Some porn viewers will not want to pay, others will not want to risk their privacy. This may reduce traffic and perhaps sales. Sites which pay to use third-party age verification services may find that age-verifying users is not cost-effective compared to the low proportion of site visitors that become paying customers. This puts low-income niche sites particularly at risk.

MindGeek’s market dominance – both in the online pornography market and in the age verification market – does lead to some commercial exploitation concerns.

MindGeek might use its porn market position and the data it obtains from its age verification tool in order to move into markets for niche porn content which it does not currently produce, but that it notices a rising interest in. This might also result in MindGeek aggressively buying-up providers of niche, kink, or LGBT content which it has identified as profitable – thereby continuing to increase its market dominance.

There is no evidence that age verification will either prevent children or teenagers from accessing pornography online or reduce demand for it among young people.

Although the Internet has given young people unprecedented access to adult content, education is far more likely than tech solutions to address the problems arising from this.

You can help to keep young people safe online by using age verification tools which carry the least potential to be fooled or worked around by under-18s, by requiring age verification for all UK customers, and by reporting data breaches promptly to the ICO and informing customers if their data is at risk of public exposure.