BBFC Internet Porn Censors

BBFC: Age Verification We Don't Trust



 

Offsite Article: First words from Britain's new internet porn censor...


Link Here 11th March 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
The BBFC takes its first steps to explain how it will stop people from watching internet porn

See article from bbfc.co.uk

 

 

Now that the BBFC has taken on a new role as internet censor...

Will it change its name back to the British Board of Film Censors? The Daily Mail seems to think so


Link Here 13th March 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
The Daily Mail today ran the story that the DCMS have decided to take things a little more cautiously about the privacy (and national security) issues of allowing a foreign porn company to take control of databasing people's porn viewing history.

Anyway there was nothing new in the story but it was interesting to note the Freudian slip of referring to the BBFC as the British Board of Film Censorship.

My idea would be for the BBFC to rename itself with the more complete title, the British Board of Film and Internet Censorship.

 

 

A matter of trust...

The BBFC consults about age verification for internet porn, and ludicrously suggests that the data oligarchs can be trusted with your personal identity data because they will follow 'best practice'


Link Here 26th March 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
  

Your data is safe with us.
We will follow 'best practices', honest!
 

The BBFC has launched its public consultation about its arrangements for censoring porn on the internet.

The document was clearly written before the Cambridge Analytica data abuse scandal. The BBFC gullibility in accepting the word of age verification providers and porn websites, that they will look after your data, now rather jars with what we see going on in the real world.

After all European data protection laws allow extensive use of your data, and there are absolutely no laws governing what foreign websites can do with your identity data and porn browsing history.

I think that under the current arrangements, if a Russian website were to hand over identity data and porn browsing history straight over to the Kremlin dirty tricks department, then as long as under 18s would be prohibited, then the BBFC would have to approve that website's age verification arrangements.

Anyway there will be more debate on the subject over the coming month.

The BBFC writes:

Consultation on draft Guidance on Age-Verification Arrangements and draft Guidance on Ancillary Service Providers

Under section 14(1) of the Digital Economy Act 2017, all providers of online commercial pornographic services accessible from the UK will be required to carry age-verification controls to ensure that their content is not normally accessible to children.

This legislation is an important step in making the internet a safer place for children.

The BBFC was designated as the age-verification regulator under Part 3 of the Digital Economy Act 2017 on 21 February 2018.

Under section 25 of the Digital Economy Act 2017, the BBFC is required to publish two sets of Guidance: Guidance on Age-verification Arrangements and Guidance on Ancillary Service Providers .

The BBFC is now holding a public consultation on its draft Guidance on Age-Verification Arrangements and its draft Guidance on Ancillary Service Providers. The deadline for responses is the 23 April 2018 .

We will consider and publish responses before submitting final versions of the Guidance to the Secretary of State for approval. The Secretary of State is then required to lay the Guidance in parliament for formal approval. We support the government's decision to allow a period of up to three months after the Guidance is formally approved before the law comes into force, in order to give industry sufficient time to comply with the legislation.

Draft Guidance on Age-verification Arrangements

Under section 25 of the Digital Economy Act 2017, the BBFC is required to publish:

"guidance about the types of arrangements for making pornographic material available that the regulator will treat as complying with section 14(1)".

The draft Guidance on Age-Verification Arrangements sets out the criteria by which the BBFC will assess that a person has met with the requirements of section 14(1) of the Act. The draft guidance outlines good practice, such as offering choice of age-verification solutions to consumers. It also includes information about the requirements that age-verification services and online pornography providers must adhere to under data protection legislation and the role and functions of the Information Commissioner's Office (ICO). The draft guidance also sets out the BBFC's approach and powers in relation to online commercial pornographic services and considerations in terms of enforcement action.

Draft Guidance on Ancillary Service Providers

Under section 25 of the Digital Economy Act 2017, the BBFC is required to publish: "guidance for the purposes of section 21(1) and (5) about the circumstances in which it will treat services provided in the course of a business as enabling or facilitating the making available of pornographic material or extreme pornographic material".

The draft Guidance on Ancillary Service Providers includes a non-exhaustive list of classes of ancillary service provider that the BBFC will consider notifying under section 21 of the Act, such as social media and search engines. The draft guidance also sets out the BBFC's approach and powers in relation to online commercial pornographic services and considerations in terms of enforcement action.

How to respond to the consultation

We welcome views on the draft Guidance in particular in relation to the following questions:

Guidance on Age-Verification Arrangements

  • Do you agree with the BBFC's Approach as set out in Chapter 2?

  • Do you agree with the BBFC's Age-verification Standards set out in Chapter 3?

  • Do you have any comments with regards to Chapter 4?

The BBFC will refer any comments regarding Chapter 4 to the Information Commissioner's Office for further consideration.

Draft Guidance on Ancillary Service Providers

  • Do you agree with the BBFC's Approach as set out in Chapter 2?

  • Do you agree with the classes of Ancillary Service Provider set out in Chapter 3?

Please submit all responses (making reference to specific sections of the guidance where relevant) and confidentiality forms as email attachments to:

DEA-consultation@bbfc.co.uk

The deadline for responses is 23 April 2018 .

We will consider and publish responses before submitting final versions of the Guidance to the Secretary of State for approval.

Update: Intentionally scary

31st March 2018. From Wake Me Up In Dreamland on twitter.com

The failure to ensure data privacy/ protection in the Age Ver legislation is wholely intentional. Its intended to scare people away from adult material as a precursor to even more web censorship in UK.

 

 

Offsite Article: Porn Age Verification Rules...


Link Here 12th April 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Expensive, Ineffective and a Hacker's DelightIncrease. By Vince Warrington, Founder Protective Intelligence

See article from cbronline.com

 

 

Offsite Podcast: Podcast: Steve Winyard - Age Verification and AV Secure...


Link Here 16th April 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Perhaps the most hopeful age verification technology where you can be age verified for porn at your local supermarket without providing any ID whatsoever

See article from itsadult.com

 

 

Don't forget the BBFC age verification consultation ends on Monday...

Note that BBFC has now re-opened its web pages with the consultation details


Link Here 20th April 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
The BBFC is consulting on its procedures for deciding if porn websites have implemented adequately strictly such that under 18s won't normally be able to access the website. Any websites not complying will be fined/blocked and/or pressurised by hosting/payment providers and advertisers who are willing to support the BBFC censorship.

Now I'm sure that the BBFC will diligently perform their duties with fairness and consideration for all, but the trouble is that all the horrors of scamming, hacking, snooping, blackmail, privacy etc are simply not the concern of the BBFC. It is pointless to point out how the age verification will endanger porn viewers, it is not in their remit.

If a foreign website were to implement strict age verification and then pass over all the personal details and viewing habits straight to its blackmail, scamming and dirty tricks department, then this will be perfectly fine with the BBFC. It is only their job to ensure that under 18s won't get through the ID checking.

There is a little privacy protection for porn websites with a presence in the EU, as the new GDPR rues have some generic things to say about keeping data safe. However these are mostly useless if you give your consent to the websites to use your data as they see fit. And it seems pretty easy to get consent for just about anything just be asking people to tick a box, or else not be allowed to see the porn. For example, Facebook will still be allowed to slurp all you personal data even within the constraints of GDPR, so will porn websites.

As a porn viewer, the only person who will look after you, is yourself.

The woeful flaws of this bill need addressing (by the government rather than the BBFC). We need to demand of the government: Don't save the children by endangering their parents.

At the very least we need a class of critically private data that websites simply must not use, EVER, under any circumstances, for any reason, and regardless of nominal user consent. Any company that uses this critically private data must be liable to criminal prosecution.

Anyway there have been a few contributions to the debate in the run up to the end of the BBFC consultation.

The Digital Economy Act -- The Truth: AgeID

20th April 2018. See  article from cbronline.com

AgeID says it wants to set the record straight on user data privacy under pending UK smut age check rules. As soon as a customer enters their login credentials, AgeID anonymises them. This ensures AgeID does not have a list of email addresses. We cannot market to them, we cannot even see them

[You always have to be a bit sceptical about claims that anonymisation protects your data. Eg if Facebook strips off your name and address and then sells your GPS track as 'anonymised', when in fact your address and then name can be restored by noting that you spend 12 hours a day at 32 Acacia avenue and commute to work at Snoops R Us. Perhaps more to the point of PornHub, may indeed not know that it was Damian@Green.com that hashed to 00000666, but the browsing record of 0000666 will be stored by PornHub anyway. And when the police come along and find from the ID company that Damian@Green.com hashes to 0000666 then the can simply ask PornHub to reveal the browsing history of 0000666.

Tell the BBFC that age verification will do more harm than good

20th April 2018. See  article from backlash.org.uk

MindGeek's age verification solution, AgeID, will inevitably have broad takeup due to their using it on their free tube sites such as PornHub. This poses a massive conflict of interest: advertising is their main source of revenue, and they have a direct profit motive to harvest data on what people like to look at. AgeID will allow them to do just that.

MindGeek have a terrible record on keeping sensitive data secure, and the resulting database will inevitably be leaked or hacked. The Ashley Madison data breach is a clear warning of what can happen when people's sex lives are leaked into the public domain: it ruins lives, and can lead to blackmail and suicide. If this policy goes ahead without strict rules forcing age verification providers to protect user privacy, there is a genuine risk of loss of life.

Update: Marc Dorcel Issues Plea to Participate in U.K. Age-Verification Consultation

20th April 2018. See  article from xbiz.com

French adult content producer Marc Dorcel has issued a plea for industry stakeholders to participate in a public consultation on the U.K.'s upcoming age-verification system for adult content. The consultation period closes on Monday. The studio said the following about participation in the BBFC public consultation:

The time of a wild internet where everyone could get immediate and open access to porn seems to be over as many governments are looking for concrete solutions to control it.

U.K. is the first one to have voted a law regarding this subject and who will apply a total blockage on porn websites which do not age verify and protect minors. Australian, Polish and French authorities are also looking very closely into this issue and are interested in the system that will be elected in the U.K.

BBFC is the organization which will define and manage the operation. In a few weeks, the BBFC will deliver the government its age-verification guidance in order to define and detail how age-verification should comply with this new law.

BBFC wants to be pragmatic and is concerned about how end users and website owners will be able to enact this measure.

The organization has launched an open consultation in order to collect the public and concerned professionals' opinion regarding this matter here .

As a matter of fact, age-verification guideline involves a major challenge for the whole industry: age-verification processor cannot be considered neither as a gateway nor a toll. Moreover, it cannot be an instrument to gather internet users' data or hijack traffic.

Marc Dorcel has existed since 1979 and operates on numerous platforms -- TV, mobile, press, web networks. We are used to regulation authorities.

According to our point of view, the two main requirements to define an independent age-verification system that would not serve specific corporate interests are: 1st requirement -- neither an authenticated adult, nor his data should belong to any processor; 2nd requirement -- processor systems should freely be chosen because of their efficiency and not because of their dominant position.

We are also thinking that our industry should have two requests for the BBFC to insure a system which do not create dependency:

  • Any age-verification processor scope should be limited to a verification task without a user-registration system. As a consequence, processors could not get benefits on any data user or traffic control, customers' verified age would independently be stored by each website or website network and users would have to age verify for any new website or network.

  • If the BBFC allows any age-verification processor to control a visitor data base and to manage login and password, they should commit to share the 18+ login/password to the other certified processors. As a consequence, users would only have one age verification enrollment on their first visit of a website, users would be able to log in with the same login/password on any age verification system to prove their age, and verified adults would not belong to any processor to avoid any dependency.

In those cases, we believe that an age-verification solution will act like a MPSP (multiple payment service provider) which processes client payments but where customers do not belong to payment processors, but to the website and where credit card numbers can be used by any processor.

We believe that any adult company concerned with the future of our business should take part in this consultation, whatever his point of view or worries are.

It is our responsibility to take our fate into our own hands.

 

 

When have internet companies ever followed 'best practice'?...

Response to the BBFC consultation on UK internet porn censorship


Link Here 23rd April 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Re Guidance on Age-Verification Arrangements

I agree with the BBFC's Approach as set out in Chapter 2

Re Age-verification Standards set out in Chapter 3

4. This guidance also outlines good practice in relation to age-verification to encourage consumer choice and the use of mechanisms that confirm age but not identity.

I think you should point out to porn viewers that your ideas on good practice are in no way enforceable on websites. You should not mislead porn viewers into thinking that their data is safe because of the assumption that websites will follow best practice. They may not.

5c. A requirement that either a user age-verify each visit or access is restricted by controls, manual or electronic, such as, but not limited to, password or personal identification numbers

This is a very glib sentence that could be the make or break of user acceptability of age verification.

This is not like watching films on Netflix, ie entering a PIN and watching a film. Viewing porn is more akin to browsing, hopping from one website to another, starting a film, quickly deciding it is no good and searching for another, maybe on a different site. Convenient browsing requires that a verification is stored for at least a reasonable time in a cookie. So that it can be access automatically by all websites using the same verification provider (or even different verification providers if they could get together to arrange this).

At the very least the BBFC should make a clearer statement about persistence of PINs or passwords and whether it is acceptable to maintain valid verifications in cookies.(or age verifier databases). The Government needs adults to buy into age verification. If the BBFC get too fussy about eliminating the risk that under 18s could view porn then the whole system could become too inconvenient for adults to be bothered with, resulting in a mass circumvention of the system with lots of information in lots of places about how and where porn could be more easily obtained. The under 18s would probably see this too, and so this would surely diminish the effectiveness of the whole idea. The very suggestion that users age verify each visit suggests that the BBFC is simply not on the right wavelength for a viable solution. Presumably not much thought has been put into specifying advance requirements, and that instead the BBFC will consider the merits of proposals as they arise. The time scales for enactment of the law should therefore allow for technical negotiations between developers and the BBFC about how each system should work.

5d. the inclusion of measures that are effective at preventing use by non-human operators including algorithms

What a meaningless statement, surely the age verification software process itself will be non human working on algorithms. Do bots need to be protected from porn? Are you saying that websites should not allow their sites to be accessed by Google's search engine bots? Unless there is an element of repeat access, a website does not really know that it is being accessed by a bot or a human. I think you probably have a more specific restriction in mind, and this has not been articulated in this vague and meaningless statement

7. Although not a requirement under section 14(1) the BBFC recommends that age-verification providers adopt good practice in the design and implementation of their solutions. These include solutions that: include clear information for end-users on data protection

When have websites or webs services ever provided clear information about data protection? The most major players of the internet refuse to provide clear information, eg Facebook or Google.

9. During the course of this age-verification assessment, the BBFC will normally be able to identify the following in relation to data protection compliance concerns: failure to include clear information for end-users on data protection and how data is used; and requesting more data than is necessary to confirm age, for example, physical location information.

Excellent! This would be good added value from the BBFC At the very least the BBFC should inform porn viewers that for foreign non-EU sites, there will be absolutely no data protection, and for EU websites, once users give their consent then the websites can do more or less anything with the data.

10. The BBFC will inform the Information Commissioner's Office where concerns arise during its assessment of the age-verification effectiveness that the arrangement does not comply with data protection legislation. The ICO will consider if further investigation is appropriate. The BBFC will inform the online commercial pornography provider(s) that it has raised concerns with the ICO.

Perhaps the BBFC could make it clear to porn users, the remit of the ICO over non-EU porn sites, and how the BBFC will handle these issues for a non-EU website.

Re Data Protection and the Information Commissioner's Office

The world's major websites such as Facebook that follow all the guidelines noted in this section but end up telling you nothing about how your data is used, I don't suppose porn sites will be any more open.

3b Where an organisation processing personal data is based outside the EU, an EU-based representative must be appointed and notified to the individual

Will the BBFC block eg a Russian website that complies with age verification by requiring credit card payments but has no EU representative? I think the BBFC/ICO needs to add a little bit more about data protection for websites and services outside of the EU. Porn viewers need to know.

General

Perhaps the BBFC could keep a FAQ for porn viewers eg Does the UK vetting service for people working with children have access to age verification data used for access to porn sites?

 

 

Offsite Article: Expect a schoolyard black market in adult login-codes...


Link Here 24th April 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
The Economist does a piece on porn age verification and quotes some bollox from the BBFC about the requirements not making life harder for adult porn viewers

See article from economist.com

 

 

The government is acting negligently on privacy and porn AV...

Top of our concerns was the lack of privacy safeguards to protect the 20 million plus users who will be obliged to use Age Verification tools to access legal content.


Link Here 8th May 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust

We asked the BBFC to tell government that the legislation is not fit for purpose, and that they should halt the scheme until privacy regulation is in place. We pointed out that card payments and email services are both subject to stronger privacy protections that Age Verification.

The government's case for non-action is that the Information Commissioner and data protection fines for data breaches are enough to deal with the risk. This is wrong: firstly because fines cannot address the harm created by the leaking of people's sexual habits. Secondly, it is wrong because data breaches are only one aspect of the risks involved.

We outlined over twenty risks from Age Verification technologies. We pointed out that Age Verification contains a set of overlapping problems. You can read our list below. We may have missed some: if so, do let us know.

The government has to act. It has legislated this requirement without properly evaluating the privacy impacts. If and when it goes wrong, the blame will lie squarely at the government's door.

The consultation fails to properly distinguish between the different functions and stages of an age verification system. The risks associated with each are separate but interact. Regulation needs to address all elements of these systems. For instance:

  • Choosing a method of age verification, whereby a user determines how they wish to prove their age.

  • The method of age verification, where documents may be examined and stored.

  • The tool's approach to returning users, which may involve either:

    • attaching the user's age verification status to a user account or log-in credentials; or

    • providing a means for the user to re-attest their age on future occasions.

  • The re-use of any age verified account, log-in or method over time, and across services and sites.

The focus of attention has been on the method of pornography-related age verification, but this is only one element of privacy risk we can identify when considering the system as a whole. Many of the risks stem from the fact that users may be permanently 'logged in' to websites, for instance. New risks of fraud, abuse of accounts and other unwanted social behaviours can also be identified. These risks apply to 20-25 million adults, as well as to teenagers attempting to bypass the restrictions. There is a great deal that could potentially go wrong.

Business models, user behaviours and potential criminal threats need to be taken into consideration. Risks therefore include:

Identity risks

  • Collecting identity documents in a way that allows them to potentially be correlated with the pornographic content viewed by a user represents a serious potential risk to personal and potentially highly sensitive data.

Risks from logging of porn viewing

  • A log-in from an age-verified user may persist on a user's device or web browser, creating a history of views associated with an IP address, location or device, thus easily linked to a person, even if stored 'pseudonymously'.

  • An age verified log-in system may track users across websites and be able to correlate tastes and interests of a user visiting sites from many different providers.

  • Data from logged-in web visits may be used to profile the sexual preferences of users for advertising. Tool providers may encourage users to opt in to such a service with the promise of incentives such as discounted or free content.

  • The current business model for large porn operations is heavily focused on monetising users through advertising, exacerbating the risks of re-use and recirculation and re-identification of web visit data.

  • Any data that is leaked cannot be revoked, recalled or adequately compensated for, leading to reputational, career and even suicide risks.

Everyday privacy risks for adults

  • The risk of pornographic web accounts and associated histories being accessed by partners, parents, teenagers and other third parties will increase.

  • Companies will trade off security for ease-of-use, so may be reluctant to enforce strong passwords, two-factor authentication and other measures which make it harder for credentials to leak or be shared.

  • Everyday privacy tools used by millions of UK residents such as 'private browsing' modes may become more difficult to use to use due to the need to retain log-in cookies, increasing the data footprint of people's sexual habits.

  • Some users will turn to alternative methods of accessing sites, such as using VPNs. These tools have their own privacy risks, especially when hosted outside of the EU, or when provided for free.

Risks to teenagers' privacy

  • If age-verified log-in details are acquired by teenagers, personal and sexual information about them may become shared including among their peers, such as particular videos viewed. This could lead to bullying, outing or worse.

  • Child abusers can use access to age verified accounts as leverage to create and exploit a relationship with a teenager ('grooming').

  • Other methods of obtaining pornography would be incentivised, and these may carry new and separate privacy risks. For instance the BitTorrent network exposes the IP addresses of users publicly. These addresses can then be captured by services like GoldenEye, whose business model depends on issuing legal threats to those found downloading copyrighted material. This could lead to the pornographic content downloaded by young adults or teenagers being exposed to parents or carers. While copyright infringement is bad, removing teenagers' sexual privacy is worse. Other risks include viruses and scams.

Trust in age verification tools and potential scams

  • Users may be obliged to sign up to services they do not trust or are unfamiliar with in order to access specific websites.

  • Pornographic website users are often impulsive, with lower risk thresholds than for other transactions. The sensitivity of any transactions involved gives them a lower propensity to report fraud. Pornography users are therefore particularly vulnerable targets for scammers.

  • The use of credit cards for age verification in other markets creates an opportunity for fraudulent sites to engage in credit card theft.

  • Use of credit cards for pornography-related age verification risks teaching people that this is normal and reasonable, opening up new opportunities for fraud, and going against years of education asking people not to hand card details to unknown vendors.

  • There is no simple means to verify which particular age verification systems are trustworthy, and which may be scams.

Market related privacy risks

  • The rush to market means that the tools that emerge may be of variable quality and take unnecessary shortcuts.

  • A single pornography-related age verification system may come to dominate the market and become the de-facto provider, leaving users no real choice but to accept whatever terms that provider offers.

  • One age verification product which is expected to lead the market -- AgeID -- is owned by MindGeek, the dominant pornography company online. Allowing pornographic sites to own and operate age verification tools leads to a conflict of interest between the privacy interests of the user, and the data-mining and market interests of the company.

  • The online pornography industry as a whole, including MindGeek, has a poor record of privacy and security, littered with data breaches. Without stringent regulation prohibiting the storage of data which might allow users' identity and browsing to be correlated, there is no reason to assume that data generated as a result of age verification tools will be exempt from this pattern of poor security.

 

 

Newsagents to sell 'porn passes'...

The press picks up on the age verification offering from AVSecure that offers anonymous porn browsing


Link Here 14th May 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Adults who want to watch online porn (or maybe by adults only products such as alcohol) will be able to buy codes from newsagents and supermarkets to prove that they are over 18 when online.

One option available to the estimated 25 million Britons who regularly visit such websites will be a 16-digit code, dubbed a 'porn pass'.

While porn viewers will still be able to verify their age using methods such as registering credit card details, the 16-digit code option would be a fully anonymous option. According to AVSecure's the cards will be sold for 10 to anyone who looks over 18 without the need for any further identification. It doesn't say on the website, but presumably in the case where there is doubt about a customer's age, then they will have to show ID documents such as a passport or driving licence, but hopefully that ID will not have to be recorded anywhere.

It is hope he method will be popular among those wishing to access porn online without having to hand over personal details to X-rated sites.

The user will type in a 16 digit number into websites that belong to the AVSecure scheme. It should be popular with websites as it offers age verification to them for free (with the 10 card fee being the only source of income for the company). This is a lot better proposition for websites than most, if not all, of the other age verification companies.

AVSecure also offer an encrypted implementation via blockchain that will not allow websites to use the 16 digit number as a key to track people's website browsing. But saying that they could still use a myriad of other standard technologies to track viewers.

The BBFC is assigned the task of deciding whether to accredit different technologies and it will be very interesting to see if they approve the AVSecure offering. It is easily the best solution to protect the safety and privacy of porn viewers, but it maybe will test the BBFC's pragmatism to accept the most workable and safest solution for adults which is not quite fully guaranteed to protect children. Pragmatism is required as the scheme has the technical drawback of having no further checks in place once the card has been purchased. The obvious worry is that an over 18s can go around to other shops to buy several cards to pass on to their under 18 mates. Another possibility is that kids could stumble on their parent's card and get access. Numbers shared on the web could be easily blocked if used simultaneously from different IP addresses.

 

 

Pornhub blows a raspberry at the BBFC...

And introduces a free VPN to short circuit UK porn censorship


Link Here 25th May 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Pornhub, the dominant force amongst the world's porn websites, has sent a challenge to the BBFC's porn censorship regime by offering a free workaround to any porn viewer who would prefer to hide their tracks rather then open themselves up to the dangers of offering up their personal ID to age verifiers.

And rather bizarrely Pornhub are one of the companies offering age verification services to  porn sites who want to comply with UK age verification requirements.

Pornhub describes its VPN service with references to UK censorship:

Browse all websites anonymously and without restrictions.

VPNhub helps you bypass censorship while providing secure and private access to Internet. Access all of your favorite websites without fear of being monitored.

Hide your information and surf the Internet without a trace.

Enjoy the pleasure of protection with VPNhub. With full data encryption and guaranteed anonymity, go with the most trusted VPN to protect your privacy anywhere in the world.

Free and Unlimited

Enjoy totally free and unlimited bandwidth on your device of choice.

 

 

Offsite Article: UK push for porn passes raises privacy and data concerns...


Link Here 28th May 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Age verification requirement has raised fears about privacy, and concerns that independent providers will suffer disproportionately.

See article from wikitribune.com

 

 

Healthy scepticism...

Pandora Blake suggests that there have been about 750 responses to its consultation on age verification requirements for porn sites


Link Here 28th May 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust

Age verification has been hanging over us for several years now - and has now been put back to the end of 2018 after enforcement was originally planned to start last month.

I'm enormously encouraged by how many people took the opportunity to speak up and reply to the BBFC consultation on the new regulations .

Over 500 people submitted a response using the tool provided by the Open Rights Group , emphasising the need for age verification tech to be held to robust privacy and security standards.

I'm told that around 750 consultation responses were received by the BBFC overall, which means that a significant majority highlighted the regulatory gap between the powers of the BBFC to regulate adult websites, and the powers of the Information Commissioner to enforce data protection rules.

 

 

Whatever happened to...

The BBFC consultation on UK internet porn censorship


Link Here 17th July 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Nobody seems to have heard much about the progress of the BBFC consultation about the process to censor internet porn in the UK.

The sketchy timetable laid out so far suggests that the result of the consultation should be published prior to the Parliamentary recess scheduled for 26th July. Presumably this would provide MPs with some light reading over their summer hols ready for them to approve as soon as the hols are over.

Maybe this publication may have to be hurried along though, as pesky MPs are messing up Theresa May's plans for a non-Brexit, and she would like to send them packing a week early before they can cause trouble. ( Update 18th July . The early holidays idea has now been shelved).

The BBFC published meeting minutes this week that mentions the consultation:

The public consultation on the draft Guidance on Age Verification Arrangements and the draft Guidance on Ancillary Service Providers closed on 23 April. The BBFC received 620 responses, 40 from organisations and 580 from individuals. Many of the individual responses were encouraged by a campaign organised by the Open Rights Group.

Our proposed response to the consultation will be circulated to the Board before being sent to DCMS on 21 May.

So assuming that the response was sent to the government on the appointed day then someone has been sitting on the results for quite a long time now.

Meanwhile its good to see that people are still thinking about the monstrosity that is coming our way. Ethical porn producer Erica Lust has been speaking to News Internationalist. She comments on the way the new law will compound MindGeek's monopolitistc dominance of the online porn market:

The age verification laws are going to disproportionately affect smaller low-traffic sites and independent sex workers who cannot cover the costs of installing age verification tools.

It will also impact smaller sites by giving MindGeek even more dominance in the adult industry. This is because the BBFC draft guidance does not enforce sites to offer more than one age verification product. So, all of MindGeeks sites (again, 90% of the mainstream porn sites) will only offer their own product; Age ID. The BBFC have also stated that users do not have to verify their age on each visit if access is restricted by password or a personal ID number. So users visiting a MindGeek site will only have to verify their age once using AgeID and then will be able to login to any complying site without having to verify again. Therefore, viewers will be less likely to visit competitor sites not using the AgeID technology, and simultaneously competitor sites will feel pressured to use AgeID to protect themselves from losing viewers.

...Read the full  article from newint.org

 

 

BBFC: Age Verification We Don't Trust...

BBFC boss writes a 'won't somebody think of the children' campaigning piece in support of the upcoming porn censorship law, disgracefully from behind a paywall


Link Here 22nd July 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
David Austin as penned what looks like an official BBFC campaigning piece trying to drum up support for the upcoming internet porn censorship regime. Disgracefully the article is hidden behind a paywall and is restricted to Telegraph paying subscribers.

Are children protected by endangering their parents or their marriage?

The article is very much a one sided piece, focusing almost entirely on the harms to children. It says nothing about the extraordinary dangers faced by adults when handing over personal identifying data to internet companies. Not a word about the dangers of being blackmailed, scammed or simply outed to employers, communities or wives, where the standard punishment for a trivial transgression of PC rules is the sack or divorce.

Austin speaks of the scale of the internet business and the scope of the expected changes. He writes:

There are around five million pornographic websites across the globe. Most of them have no effective means of stopping children coming across their content. It's no great surprise, therefore, that Government statistics show that 1.4 million children in the UK visited one of these websites in one month.

...

The BBFC will be looking for a step change in the behaviour of the adult industry. We have been working with the industry to ensure that many websites carry age-verification when the law comes into force.

...

Millions of British adults watch pornography online. So age-verification will have a wide reach. But it's not new. It's been a requirement for many years for age-restricted goods and services, including some UK hosted pornographic material.

I guess at this last point readers will be saying I never knew that. I've never come across age verification ever before. But the point here is these previous rules devastated the British online porn industry and the reason people don't ever come across it, is that there are barely any British sites left.

Are children being protected by impoverishing their parents?

Not that any proponents of age verification could care less about British people being able to make money. Inevitably the new age verification will further compound the foreign corporate monopoly control on yet another internet industry.

Having lorded over a regime that threatens to devastate lives, careers and livelihoods, Austin ironically notes that it probably won't work anyway:

The law is not a silver bullet. Determined, tech-savvy teenagers may find ways around the controls, and not all pornography online will be age-restricted. For example, the new law does not require pornography on social media platforms to be placed behind age-verification controls.

 

 

Unfinished business...

Open Rights Group comments on the missed milestone of publishing final age verification guidelines before Parliament's summer recess


Link Here 5th August 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust

MPs left behind unfinished business when they broke for summer recess, and we aren't talking about Brexit negotiations. The rollout of mandatory age verification (AV) technology for adult websites is being held up once again while the Government mulls over final details. AV tech will create highly sensitive databases of the public's porn watching habits, and Open Rights Groups submitted a report warning the proposed privacy protections are woefully inadequate. The Government's hesitation could be a sign they are receptive to our concerns, but we expect their final guidance will still treat privacy as an afterthought. MPs need to understand what's at stake before they are asked to approve AV guidelines after summer.

AV tools will be operated by private companies, but if the technology gets hacked and the personal data of millions of British citizens is breached, the Government will be squarely to blame. By issuing weak guidelines, the Government is begging for a Cambridge Analytica-style data scandal. If this technology fails to protect user privacy, everybody loses. Businesses will be damaged (just look at Facebook), the Government will be embarrassed, and the over 20 million UK residents who view porn could have their private sexual preferences exposed. It's in everybody's interest to fix this. The draft guidance lacks even the basic privacy protections required for other digital tools like credit card payments and email services. Meanwhile, major data breaches are rocking international headlines on a regular basis. AV tech needs a dose of common sense.

 

 

Howe gets animated by anime...

Elspeth Howe reveals more of the internal government debate that is delaying the BBFC internet porn censorship guidelines


Link Here 8th August 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Elspeth Howe, a member of the House of Lords, has written an article in the Telegraph outlining her case that the remit for the BBFC to censor internet porn sites should be widened to include a wider range of material that she does not like.

This seems to tally with other recent news that the CPS is reconsidering its views on what pornographic content should be banned from publication in Britain.

Surely these debates are related to the detailed guidelines to be used by the BBFC when either banning porn sites, or else requiring them to implement strict age verification for users. It probably explains why the Telegraph recently reported that the publication of the final guidelines has been delayed until at least the autumn.


Categories of Porn

For clarity the categories of porn being discussed are as follows:
 

  Current   Proposed
offline online   offline online
Softcore 18 BBFC uncut BBFC uncut BBFC uncut BBFC uncut
Hardcore R18  BBFC uncut BBFC uncut BBFC uncut BBFC uncut
Beyond R18
(proposal by CPS)
banned BBFC uncut BBFC uncut BBFC uncut
Cartoon Porn
(proposal by Howe))
banned BBFC uncut banned banned
Extreme porn banned banned banned banned
Child porn banned banned banned banned
  • Softcore porn rated 18 under BBFC guidelines

    - Will be allowed subject to strict age verification
     
  • Vanilla hardcore porn rated R18 under current BBFC guidelines

    - Will be allowed subject to strict age verification
     
  • Beyond R18 hardcore porn that includes material historically banned by the CPS claiming obscenity, ie fisting, golden showers, BDSM, female ejaculation, and famously from a recent anti censorship campaign, face sitting/breath play. Such material is currently cut from R18s.

    - Such content will be allowed under the current Digital Economy Act for online porn sites
    - This category is currently banned for offline sales in the UK, but the CPS has just opened a public consultation on its proposal to legalise such content, as long as it is consensual. Presumably this is related to the government's overarching policy: What's illegal offline, is illegal online.
     
  • Extreme Porn as banned from possession in the UK under the Dangerous Pictures Act. This content covers, bestiality, necrophilia, realistic violence likely to result in serious injury, realistic rape

    - This content is illegal to possess in the UK and any websites with such content will be banned by the BBFC regardless of age verification implementation
     
  • Cartoon Porn depicting under 18s

    - This content is banned from possession in the UK but will be allowed online subject to age verification requirements
     
  • Photographic child porn

    This is already totally illegal in the UK on all media. Any foreign websites featuring such content are probably already being blocked by ISPs using lists maintained by the IWF. The BBFC will ban anything it spots that may have slipped through the net.


'What's illegal offline, is illegal online'

Elspeth Howe writes:

I very much welcome part three of the Digital Economy Act 2017 which requires robust age verification checks to protect children from accessing pornography. The Government deserves congratulations for bringing forward this seminal provision, due to come into effect later this year.

The Government's achievement, however, has been sadly undermined by amendments that it introduced in the House of Lords, about which there has been precious little public debate. I very much hope that polling that I am placing in the public domain today will facilitate a rethink.

When the Digital Economy Bill was introduced in the Lords, it proposed that legal pornography should be placed behind robust age verification checks. Not surprisingly, no accommodation for either adults or children was made for illegal pornography, which encompasses violent pornography and child sex abuse images.

As the Bill passed through the Lords, however, pressure was put on the Government to allow adults to access violent pornography, after going through age-verification checks, which in other contexts it would be illegal to supply. In the end the Government bowed to this pressure and introduced amendments so that only one category of illegal pornography will not be accessible by adults.

[When  Howe mentions violent pornography she is talking about the Beyond R18 category, not the Extreme Porn category, which will be the one category mentioned that will not be accessible to adults].

The trouble with the idea of banning Beyond R18 pornography is that Britain is out of step with the rest of the world. This category includes content that is ubiquitous in most of the major porn websites in the world. Banning so much content would be simply be impractical. So rather than banning all foreign porn, the government opted to remove the prohibition of Beyond R18 porn from the original bill.

Another category that has not hitherto come to attention is the category of cartoon porn that depicts under 18s. The original law that bans possession of this content seemed most concerned about material that was near photographic, and indeed may have been processed from real photos. However the law is of most relevance in practical terms when it covers comedic Simpsons style porn, or else Japanese anime often featuring youthful, but vaguely drawn cartoon characters in sexual scenes.

Again there would be problems of practicality of banning foreign websites from carry such content. All the major tube sites seems to have a section devoted to Hentai anime porn which edges into the category.

In July 2017, Howe introduced a bill that would put Beyond R18 and Cartoon Porn back into the list of prohibited material in the Digital Economy Act. The bill is titled the Digital Economy Act 2017 (Amendment) (Definition of Extreme Pornography) Bill and is still open, but further consideration in Parliament has stalled, presumably as the Government itself is currently addressing these issues.

The bill adds in to the list of prohibitions any content that has been refused a BBFC certificate or would be refused a certificate if it were to be submitted. This would catch both the Beyond Porn and Cartoon Porn categories.

The government is very keen on its policy mantra: What's illegal offline, is illegal online and it seems to have addressed the issue of Beyond 18 material being illegal offline but legal online. The government is proposing to relax its own obscenity rules so that Beyond R18 material will be legalised, (with the proviso that the porn is consensual). The CPS has published a public consultation with this proposal, and it should be ready for implementation after the consultation closes on 17th October 2018.

Interestingly Howe seems to have dropped the call to ban Beyond R18 material in her latest piece, so presumably she has accepted that Beyond R18 material will soon be classifiable by the BBFC, and so not an issue for her bill.


Still to be Addressed

That still leaves the category of Cartoon Porn to be addressed. The current Digital Economy Act renders it illegal offline, but legal online. Perhaps the Government has given Howe the nod to rationalise the situation by making banning the likes of Hentai. Hence Howe is initiating a bit of propaganda to support her bill.  She writes:

The polling that I am putting in the public domain specifically addresses the non-photographic child sex abuse images and is particularly interesting because it gauges the views of MPs whose detailed consideration of the Bill came before the controversial Lords amendments were made.

According to the survey, which was conducted by ComRes on behalf of CARE, a massive 71% of MPs, rising to 76% of female MPs, stated that they did not believe it was right for the Digital Economy Act to make non-photographic child sex abuse images available online to adults after age verification checks. Only 5% of MPs disagreed.

There is an opportunity to address this as part of a review in the next 18 months, but things are too serious to wait .The Government should put matters right now by adopting my very short, but very important two-clause Digital Economy Act (Amendment) (Extreme Pornography) Bill which would restore the effect of the Government's initial prohibition of this material.

I -- along with 71 per cent of MPs -- urge the Government to take action to ensure that the UK's internet does not endorse the sexual exploitation of children.

I haven't heard of this issue being discussed before and I can't believe that anybody has much of an opinion on the matter. Presumably therefore, the survey presented out of the blue with the questions being worded in such a way as to get the required response. Not unusual, but surely it shows that someone is making an effort to generate an issue where one didn't exists before. Perhaps an indication that Howe's solution is what the authorities have decreed will happen.

 

 

Offsite Article: Time Magazine reports on the current status...


Link Here 22nd August 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
The U.K. Is About To Censor Online Porn, and Free Speech Advocates Are Alarmed

See article from time.com

 

 

PortesCard...

Pornhub partners with anonymous system based on retailers verifying ages without recording ID


Link Here 8th September 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Pornhub's Age verification system AgeID has announced an exclusive partnership with OCL and its Portes solution for providing anonymous face-to-face age verification solution where retailers OK the age of customers who buy a card enabling porn access. The similar AVSecure scheme allows over 25s to buy the access card without showing any ID but may require to see unrecorded ID from those appearing less than 25.

According to the company, the PortesCard is available to purchase from selected high street retailers and any of the U.K.'s 29,000 PayPoint outlets as a voucher. Each PortesCard will cost 4.99 for use on a single device, or 8.99 for use across multiple devices. This compares with 10 for the AVSecure card.

Once a card or voucher is purchased, its unique validation code must be activated via the Portes app within 24 hours before expiring. Once the user has been verified they will automatically be granted access to all adult sites using AgeID. Maybe this 24 hour limit is something to do with an attempt to restrict secondary sales of porn access codes by ensuring that they get tied to devices almost immediately. It all sounds a little hasslesome.

As an additional layer of protection, parents can quickly and simply block access on their children's devices to sites using Portes, so PortesCards cannot be associated with AgeID.

But note that an anonymously bought card is not quite a 100% safe solution. One has to consider whether if the authorities get hold of a device whether the can then see a complete history of all websites accessed using the app or access code. One also has to consider whether someone can remotely correlate an 'anonymous' access code with all the tracking cookies holding one's id.

 

 

Campaign: ResistAV...

Pandora Blake and Myles Jack launch a new campaigning website to raise funds for a challenge to the government's upcoming internet porn censorship regime


Link Here 11th September 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust

Niche porn producer, Pandora Blake, Misha Mayfair, campaigning lawyer Myles Jackman and Backlash are campaigning to back a legal challenge to the upcoming internet porn censorship regime in the UK. They write on a new ResistAV.com website:

We are mounting a legal challenge.

Do you lock your door when you watch porn 203 or do you publish a notice in the paper? The new UK age verification law means you may soon have to upload a proof of age to visit adult sites. This would connect your legal identity to a database of all your adult browsing. Join us to prevent the damage to your privacy.

The UK Government is bringing in age verification for adults who want to view adult content online; yet have failed to provide privacy and security obligations to ensure your private information is securely protected.

The law does not currently limit age verification software to only hold data provided by you just in order to verify your age. Hence, other identifying data about you could include anything from your passport information to your credit card details, up to your full search history information. This is highly sensitive data.

What are the Privacy Risks?

Data Misuse - Since age verification providers are legally permitted to collect this information, what is to stop them from increasing revenue through targeting advertising at you, or even selling your personal data?

Data Breaches - No database is perfectly secure, despite good intentions. The leaking or hacking of your sensitive personal information could be truly devastating. The Ashley Madison hack led to suicides. Don't let the Government allow your private sexual preferences be leaked into the public domain.

What are we asking money for?

We're asking you to help us crowdfund legal fees so we can challenge the new age verification rules under the Digital Economy Act 2017. We re asking for 210,000 to cover the cost of initial legal advice, since it's a complicated area of law. Ultimately, we'd like to raise even more money, so we can send a message to Government that your personal privacy is of paramount importance.

 

 

The new UK porn censor lays out its stall...

The BBFC launches a new website


Link Here 11th October 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
There's loads of new information today about the upcoming internet porn censorship regime to be coordinated by the BBFC.

The BBFC has launched a new website, ageverificationregulator.com , perhaps to distance itself a bit from its film censorship work.

The BBFC has made a few changes to its approach since the rather ropey document published prior to the BBFC's public consultation. In general the BBFC seems a little more pragmatic about trying to get adult porn users to buy into the age verification way of thinking. The BBFC seems supportive of the anonymously bought porn access card from the local store, and has taken a strong stance against age verification providers who reprehensibly want to record people's porn browsing, claiming a need to provide an audit trail.

The BBFC has also decided to offer a service to certify age verification providers in the way that they protect people's data. This is again probably targeted at making adult porn users a bit more confident in handing over ID.

The BBFC tone is a little bit more acknowledging of people's privacy concerns, but it's the government's law being implemented by the BBFC, that allows the recipients of the data to use it more or less how they like. Once you tick the 'take it or leave it' consent box allowing the AV provider 'to make your user experience better' then they can do what they like with your data (although GDPR does kindly let you later withdraw that consent and see what they have got on you).

Another theme that runs through the site is a rather ironic acceptance that, for all the devastation that will befall the UK porn industry, for all the lives ruined by people having their porn viewing outed, for all the lives ruined by fraud and identity theft, that somehow the regime is only about stopping young children 'stumbling on porn'... because the older, more determined, children will still know how to find it anyway.

So the BBFC has laid out its stall, and its a little more conciliatory to porn users, but I for one will never hand over any ID data to anyone connected with a servicing porn websites. I suspect that many others will feel the same. If you can't trust the biggest companies in the business with your data, what hope is there for anyone else.

There's no word yet on when all this will come into force, but the schedule seems to be 3 months after the BBFC scheme has been approved by Parliament. This approval seems scheduled to be debated in Parliament in early November, eg on 5th November there will be a House of Lords session:

Implementation by the British Board of Film Classification of age-verifications to prevent children accessing pornographic websites 203 Baroness Benjamin Oral questions

So the earliest it could come into force is about mid February.

 

 

A significant number of responses raised concerns about the introduction of age-verification...

BBFC publishes its summary of the consultation repsonses


Link Here 11th October 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust

BBFC Executive Summary

The British Board of Film Classification was designated as the age-verification regulator under Part 3 of the Digital Economy Act on 21 February 2018. The BBFC launched its consultation on the draft Guidance on Age-verification Arrangements and draft Guidance on Ancillary Service Providers on 26 March 2018. The consultation was available on the BBFC's website and asked for comments on the technical aspects on how the BBFC intends to approach its role and functions as the age-verification regulator. The consultation ran for 4 weeks and closed on 23 April 2018, although late submissions were accepted until 8 May 2018.

There were a total of 624 responses to the consultation. The vast majority of those (584) were submitted by individuals, with 40 submitted by organisations. 623 responses were received via email, and one was received by post. Where express consent has been given for their publication, the BBFC has published responses in a separate document. Response summaries from key stakeholders are in part 4 of this document.

Responses from stakeholders such as children's charities, age-verification providers and internet service providers were broadly supportive of the BBFC's approach and age-verification standards. Some responses from these groups asked for clarification to some points. The BBFC has made a number of amendments to the guidance as a result. These are outlined in chapter 2 of this document. Responses to questions raised are covered in chapter 3 of this document.

A significant number of responses, particularly from individuals and campaign groups, raised concerns about the introduction of age-verification, and set out objections to the legislation and regulatory regime in principle. Issues included infringement of freedom of expression, censorship, problematic enforcement powers and an unmanageable scale of operation. The government's consultation on age-verification in 2016 addressed many of these issues of principle. More information about why age-verification has been introduced, and the considerations given to the regulatory framework and enforcement powers can be found in the 2016 consultation response by the Department for Digital Culture Media and Sport1.

 

 

Preventing children and non human operators from being able to access porn...

BBFC publishes its sometimes bizarre Guidance on Age-verification Arrangement


Link Here 11th October 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust

The BBFC has published its Age Verification Guidance document that will underipin the implementation of internet porn censorship in the UK.

Perhaps a key section is:

5. The criteria against which the BBFC will assess that an age-verification arrangement meets the requirement under section 14(1) to secure that pornographic material is not normally accessible by those under 18 are set out below:

a. an effective control mechanism at the point of registration or access to pornographic content by the end-user which verifies that the user is aged 18 or over at the point of registration or access

b use of age-verification data that cannot be reasonably known by another person, without theft or fraudulent use of data or identification documents nor readily obtained or predicted by another person

c. a requirement that either a user age-verify each visit or access is restricted by controls, manual or electronic, such as, but not limited to, password or personal identification numbers. A consumer must be logged out by default unless they positively opt-in for their log in information to be remembered

d. the inclusion of measures which authenticate age-verification data and measures which are effective at preventing use by non-human operators including algorithms

It is fascinating as to why the BBFC feels that bots need to be banned, perhaps they need to be 18 years old too, before they can access porn. I am not sure if porn sites will appreciate Goggle-bot being banned from their sites. I love the idea that the word 'algorithms' has been elevated to some sort of living entity.

It all smacks of being written by people who don't know what they are talking about.

In a quick read I thought the following paragraph was important:

9. In the interests of data minimisation and data protection, the BBFC does not require that age-verification arrangements maintain data for the purposes of providing an audit trail in order to meet the requirements of the act.

It rather suggests that the BBFC pragmatically accept that convenience and buy-in from porn-users is more important than making life dangerous for everybody, just n case a few teenagers get hold of an access code.

 

 

Paying for unsafe legislation...

The Government picks up the tab for legal liabilities arising from the BBFC being sued over age verification issues


Link Here 12th October 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
As far as I can see if a porn website verifies your age with personal data, it will probably also require you tick tick a consent box with a hol load of small print that nobody ever reads. Now if that small print lets it forward all personal data, coupled with porn viewing data, to the Kremlin's dirty tricks and blackmail department then that's ok with the the Government's age verification law. So for sure some porn viewers are going to get burnt because of what the government has legislated and because of what the BBFC have implemented.

So perhaps it is not surprising that the BBFC has asked the government to pick up the tab should the BBFC be sued by people harmed by their decisions. After all it was the government who set up the unsafe environment, not the BBFC.

Margot James The Minister of State, Department for Culture, Media and Sport announced in Parliament:

I am today laying a Departmental Minute to advise that the Department for Digital, Culture, Media and Sport (DCMS) has received approval from Her Majesty's Treasury (HMT) to recognise a new Contingent Liability which will come into effect when age verification powers under Part 3 of the Digital Economy Act 2017 enter force.

The contingent liability will provide indemnity to the British Board of Film Classification (BBFC) against legal proceedings brought against the BBFC in its role as the age verification regulator for online pornography.

As you know, the Digital Economy Act introduces the requirement for commercial providers of online pornography to have robust age verification controls to protect children and young people under 18 from exposure to online pornography. As the designated age verification regulator, the BBFC will have extensive powers to take enforcement action against non-compliant sites. The BBFC can issue civil proceedings, give notice to payment-service providers or ancillary service providers, or direct internet service providers to block access to websites where a provider of online pornography remains non-compliant.

The BBFC expects a high level of voluntary compliance by providers of online pornography. To encourage compliance, the BBFC has engaged with industry, charities and undertaken a public consultation on its regulatory approach. Furthermore, the BBFC will ensure that it takes a proportionate approach to enforcement and will maintain arrangements for an appeals process to be overseen by an independent appeals body. This will help reduce the risk of potential legal action against the BBFC.

However, despite the effective work with industry, charities and the public to promote and encourage compliance, this is a new law and there nevertheless remains a risk that the BBFC will be exposed to legal challenge on the basis of decisions taken as the age verification regulator or on grounds of principle from those opposed to the policy.

As this is a new policy, it is not possible to quantify accurately the value of such risks. The Government estimates a realistic risk range to be between 21m - 210m in the first year, based on likely number and scale of legal challenges. The BBFC investigated options to procure commercial insurance but failed to do so given difficulties in accurately determining the size of potential risks. The Government therefore will ensure that the BBFC is protected against any legal action brought against the BBFC as a result of carrying out duties as the age verification regulator.

The Contingent Liability is required to be in place for the duration of the period the BBFC remain the age verification regulator. However, we expect the likelihood of the Contingent Liability being called upon to diminish over time as the regime settles in and relevant industries become accustomed to it. If the liability is called upon, provision for any payment will be sought through the normal Supply procedure.

It is usual to allow a period of 14 Sitting Days prior to accepting a Contingent Liability, to provide Members of Parliament an opportunity to raise any objections.

 

 

Not taking censorship lying down...

MoneySupermarket survey finds that 25% of customers will take action if their porn is blocked


Link Here 16th October 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
In a survey more about net neutrality than porn censorship, MoneySupermarket noted:

We conducted a survey of over 2,000 Brits on this and it seems that if an ISP decided to block sites, it could result in increasing numbers of Brits switching - 64 per cent of Brits would be likely to switch ISP if they put blocks in place

In reality, this means millions could be considering a switch as nearly six million having tried to access a site that was blocked in the last week - nearly one in 10 across the country.

It's an issue even more pertinent for those aged 18 to 34, with nearly half (45 per cent) having tried to access a site that was blocked at some point.

While ISPs might block sites for various reasons, a quarter of Brits said they would switch ISP if they were blocked from viewing adult sites - with those living with partners the most likely to do so!

Now switching ISPs isn't going to help much if the BBFC, the government appointed porn censor, has dictated that all ISPs block porn sites. But maybe these 25% of internet users will take up alternatives such as subscribing to a VPN service.

 

 

Offsite Article: Millions of porn videos will not be blocked by UK online age checks...


Link Here 21st October 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
The government makes changes such that image hosting sites, not identifying as porn sites, do not need age verification for porn images they carry

See article from theguardian.com

 

 

BBFC: Age verification we don't trust...

Analysis of BBFC's Post-Consultation Guidance by the Open Rights Group


Link Here 8th November 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Following the conclusion of their consultation period, the BBFC have issued new age verification guidance that has been laid before Parliament. It is unclear why, if the government now recognises that privacy protections like this are needed, the government would also leave the requirements as voluntary.

Summary

The new code has some important improvements, notably the introduction of a voluntary scheme for privacy, close to or based on a GDPR Code of Conduct. This is a good idea, but should not be put in place as a voluntary arrangement. Companies may not want the attention of a regulator, or may simply wish to apply lower or different standards, and ignore it. It is unclear why, if the government now recognises that privacy protections like this are needed, the government would also leave the requirements as voluntary.

We are also concerned that the voluntary scheme may not be up and running before the AV requirement is put in place. Given that 25 million UK adults are expected to sign up to these products within a few months of its launch, this would be very unhelpful.

Parliament should now:

  • Ask the government why the privacy scheme is to be voluntary, if the risks of relying on general data protection law are now recognised;
  • Ask for assurance from BBFC that the voluntary scheme will cover the all of the major operators; and
  • Ask for assurance from BBFC and DCMS that the voluntary privacy scheme will be up and running before obliging operators to put Age Verification measures in place.

The draft code can be found here .

Lack of Enforceability of Guidance

The Digital Economy Act does not allow the BBFC to judge age verification tools by any standard other than whether or not they sufficiently verify age. We asked that the BBFC persuade the DCMS that statutory requirements for privacy and security were required for age verification tools.

The BBFC have clearly acknowledged privacy and security concerns with age verification in their response. However, the BBFC indicate in their response that they have been working with the ICO and DCMS to create a voluntary certification scheme for age verification providers:

"This voluntary certification scheme will mean that age-verification providers may choose to be independently audited by a third party and then certified by the Age-verification Regulator. The third party's audit will include an assessment of an age-verification solution's compliance with strict privacy and data security requirements."

The lack of a requirement for additional and specific privacy regulation in the Digital Economy Act is the cause for this voluntary approach.

While a voluntary scheme above is likely to be of some assistance in promoting better standards among age verification providers, the "strict privacy and data security requirements" which the voluntary scheme mentions are not a statutory requirement, leaving some consumers at greater risk than others.

Sensitive Personal Data

The data handled by age verification systems is sensitive personal data. Age verification services must directly identify users in order to accurately verify age. Users will be viewing pornographic content, and the data about what specific content a user views is highly personal and sensitive. This has potentially disastrous consequences for individuals and families if the data is lost, leaked, or stolen.

Following a hack affecting Ashley Madison -- a dating website for extramarital affairs -- a number of the site's users were driven to suicide as a result of the public exposure of their sexual activities and interests.

For the purposes of GDPR, data handled by age verification systems falls under the criteria for sensitive personal data, as it amounts to "data concerning a natural person's sex life or sexual orientation".

Scheduling Concerns

It is of critical importance that any accreditation scheme for age verification providers, or GDPR code of conduct if one is established, is in place and functional before enforcement of the age verification provisions in the Digital Economy Act commences. All of the major providers who are expected to dominate the age verification market should undergo their audit under the scheme before consumers will be expected to use the tool. This is especially true when considering the fact that MindGeek have indicated their expectation that 20-25 million UK adults will sign up to their tool within the first few months of operation. A voluntary accreditation scheme that begins enforcement after all these people have already signed up would be unhelpful.

Consumers should be empowered to make informed decisions about the age verification tools that they choose from the very first day of enforcement. No delays are acceptable if users are expected to rely upon the scheme to inform themselves about the safety of their data. If this cannot be achieved prior to the start of expected enforcement of the DE Act's provisions, then the planned date for enforcement should be moved back to allow for the accreditation to be completed.

Issues with Lack of Consumer Choice

It is of vital importance that consumers, if they must verify their age, are given a choice of age verification providers when visiting a site. This enables users to choose which provider they trust with their highly sensitive age verification data and prevents one actor from dominating the market and thereby promoting detrimental practices with data. The BBFC also acknowledge the importance of this in their guidance, noting in 3.8:

"Although not a requirement under section 14(1) the BBFC recommends that online commercial pornography services offer a choice of age-verification methods for the end-user".

This does not go far enough to acknowledge the potential issues that may arise in a fragmented market where pornographic sites are free to offer only a single tool if they desire.

Without a statutory requirement for sites to offer all appropriate and available tools for age verification and log in purposes, it is likely that a market will be established in which one or two tools dominate. Smaller sites will then be forced to adopt these dominant tools as well, to avoid friction with consumers who would otherwise be required to sign up to a new provider.

This kind of market for age verification tools will provide little room for a smaller provider with a greater commitment to privacy or security to survive and robs users of the ability to choose who they trust with their data.

We already called for it to be made a statutory requirement that pornographic sites must offer a choice of providers to consumers who must age verify, however this suggestion has not been taken up.

We note that the BBFC has been working with the ICO and DCMS to produce a voluntary code of conduct. Perhaps a potential alternative solution would be to ensure that a site is only considered compliant if it offers users a number of tools which has been accredited under the additional privacy and security requirements of the voluntary scheme.

GDPR Codes of Conduct

A GDPR "Code of Conduct" is a mechanism for providing guidelines to organisations who process data in particular ways, and allows them to demonstrate compliance with the requirements of the GDPR.

A code of conduct is voluntary, but compliance is continually monitored by an appropriate body who are accredited by a supervisory authority. In this case, the "accredited body" would likely be the BBFC, and the "supervisory authority" would be the ICO. The code of conduct allows for certifications, seals and marks which indicate clearly to consumers that a service or product complies with the code.

Codes of conduct are expected to provide more specific guidance on exactly how data may be processed or stored. In the case of age verification data, the code could contain stipulations on:

  • Appropriate pseudonymisation of stored data;
  • Data and metadata retention periods;
  • Data minimisation recommendations;
  • Appropriate security measures for data storage;
  • Security breach notification procedures;
  • Re-use of data for other purposes.

The BBFC's proposed "voluntary standard" regime appears to be similar to a GDPR code of conduct, though it remains to be seen how specific the stipulations in the BBFC's standard are. A code of conduct would also involve being entered into the ICO's public register of UK approved codes of conduct, and the EPDB's public register for all codes of conduct in the EU.

Similarly, GDPR Recital 99 notes that "relevant stakeholders, including data subjects" should be consulted during the drafting period of a code of conduct - a requirement which is not in place for the BBFC's voluntary scheme.

It is possible that the BBFC have opted to create this voluntary scheme for age verification providers rather than use a code of conduct, because they felt they may not meet the GDPR requirements to be considered as an appropriate body to monitor compliance. Compliance must be monitored by a body who has demonstrated:

  • Their expertise in relation to the subject-matter;
  • They have established procedures to assess the ability of data processors to apply the code of conduct;
  • They have the ability to deal with complaints about infringements; and
  • Their tasks do not amount to a conflict of interest.
Parties Involved in the Code of Conduct Process

As noted by GDPR Recital 99, a consultation should be a public process which involves stakeholders and data subjects, and their responses should be taken into account during the drafting period:

"When drawing up a code of conduct, or when amending or extending such a code, associations and other bodies representing categories of controllers or processors should consult relevant stakeholders, including data subjects where feasible , and have regard to submissions received and views expressed in response to such consultations."

The code of conduct must be approved by a relevant supervisory authority (in this case the ICO).

An accredited body (BBFC) that establishes a code of conduct and monitors compliance is able to establish their own structures and procedures under GDPR Article 41 to handle complaints regarding infringements of the code, or regarding the way it has been implemented. BBFC would be liable for failures to regulate the code properly under Article 41(4), [1] however DCMS appear to have accepted the principle that the government would need to protect BBFC from such liabilities. [2]

GDPR Codes of Conduct and Risk Management

Below is a table of risks created by age verification which we identified during the consultation process. For each risk, we have considered whether a GDPR code of conduct may help to mitigate the effects of it.

Risk CoC Appropriate? Details
User identity may be correlated with viewed content. Partially This risk can never be entirely mitigated if AV is to go ahead, but a CoC could contain very strict restrictions on what identifying data could be stored after a successful age verification.
Identity may be associated to an IP address, location or device. No It would be very difficult for a CoC to mitigate this risk as the only safe mitigation would be not to collect user identity information.
An age verification provider could track users across all the websites it's tool is offered on. Yes Strict rules could be put in place about what data an age verification provider may store, and what data it is forbidden from storing.
Users may be incentivised to consent to further processing of their data in exchange for rewards (content, discounts etc.) Yes Age verification tools could be expressly forbidden from offering anything in exchange for user consent.
Leaked data creates major risks for identified individuals and cannot be revoked or adequately compensated for. Partially A CoC can never fully mitigate this risk if any data is being collected, but it could contain strict prohibitions on storing certain information and specify retention periods after which data must be destroyed, which may mitigate the impacts of a data breach.
Risks to the user of access via shared computers if viewing history is stored alongside age verification data. Yes A CoC could specify that any accounts for pornographic websites which may track viewed content must be strictly separate and not in any visible way linked to a user's age verification account or data that confirms their identity.
Age verification systems are likely to trade off convenience for security. (No 2FA, auto-login, etc.) Yes A CoC could stipulate that login cookies that "remember" a returning user must only persist for a short time period, and should recommend or enforce two-factor authentication.
The need to re-login to age verification services to access pornography in "private browsing" mode may lead people to avoid using this feature and generate much more data which is then stored. No A CoC cannot fix this issue. Private browsing by nature will not store any login cookies or other objects and will require the user to re-authenticate with age verification providers every time they wish to view adult content.
Users may turn to alternative tools to avoid age verification, which carry their own security risks. (Especially "free" VPN services or peer-to-peer networks). No Many UK adults, although over 18, will be uncomfortable with the need to submit identity documents to verify their age and will seek alternative means to access content. It is unlikely that many of these individuals will be persuaded by an accreditation under a GDPR code.
Age verification login details may be traded and shared among teenagers or younger children, which could lead to bullying or "outing" if such details are linked to viewed content. Yes Strict rules could be put in place about what data an age verification provider may store, and what data it is forbidden from storing.
Child abusers could use their access to age verified content as an adult as leverage to create and exploit relationships with children and teenagers seeking access to such content (grooming). No This risk will exist as long as age verification is providing a successful barrier to accessing such content for under-18s who wish to do so.
The sensitivity of content dealt with by age verification services means that users who fall victim to phishing scams or fraud have a lower propensity to report it to the relevant authorities. Partially A CoC or education campaign may help consumers identify trustworthy services, but it can not fix the core issue, which is that users are being socialised into it being "normal" to input their identity details into websites in exchange for pornography. Phishing scams resulting from age verification will appear and will be common, and the sensitivity of the content involved is a disincentive to reporting it.
The use of credit cards as an age verification mechanism creates an opportunity for fraudulent sites to engage in credit card theft. No Phishing and fraud will be common. A code of conduct which lists compliant sites and tools externally on the ICO website may be useful, but a phishing site may simply pretend to be another (compliant) tool, or rely on the fact that users are unlikely to check with the ICO every time they wish to view pornographic content.
The rush to get age verification tools to market means they may take significant shortcuts when it comes to privacy and security. Yes A CoC could assist in solving this issue if tools are given time to be assessed for compliance before the age verification regime commences .
A single age verification provider may come to dominate the market, leaving users little choice but to accept whatever terms the provider offers. Partially Practically, a CoC could mitigate some of the effects of an age verification tool monopoly if the dominant tool is accredited under the Code. However, this relies on users being empowered to demand compliance with a CoC, and it is possible that users will instead be left with a "take it or leave it" situation where the dominant tool is not CoC accredited.
Allowing pornography "monopolies" such as MindGeek to operate age verification tools is a conflict of interest. Partially As the BBFC note in their consultation response, it would not be reasonable to prohibit a pornographic content provider from running an age verification service as it would prevent any site from running their own tool. However, under a CoC it is possible that a degree of separation could be enforced that requires an age verification tools to adhere to strict rules about the use of data, which could mitigate the effects of a large pornographic content provider attempting to collect as much user data as possible for their own business purposes.
 

[1] "Infringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines up to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the preceding financial year, whichever is higher: the obligations of the monitoring body pursuant to Article 41(4)."

[2] "contingent liability will provide indemnity to the British Board of Film Classification (BBFC) against legal proceedings brought against the BBFC in its role as the age verification regulator for online pornography."

 

 

Fireworks in the House...

The Lords discuss when age verification internet censorship will start


Link Here 13th November 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust

Pornographic Websites: Age Verification - Question

House of Lords on 5th November 2018 .

Baroness Benjamin Liberal Democrat

To ask Her Majesty 's Government what will be the commencement date for their plans to ensure that age-verification to prevent children accessing pornographic websites is implemented by the British Board of Film Classification .

Lord Ashton of Hyde The Parliamentary Under-Secretary of State for Digital, Culture, Media and Sport

My Lords, we are now in the final stages of the process, and we have laid the BBFC 's draft guidance and the Online Pornography (Commercial Basis) Regulations before Parliament for approval. We will ensure that there is a sufficient period following parliamentary approval for the public and the industry to prepare for age verification. Once parliamentary proceedings have concluded, we will set a date by which commercial pornography websites will need to be compliant, following an implementation window. We expect that this date will be early in the new year.

Baroness Benjamin

I thank the Minister for his Answer. I cannot wait for that date to happen, but does he share my disgust and horror that social media companies such as Twitter state that their minimum age for membership is 13 yet make no attempt to restrict some of the most gross forms of pornography being exchanged via their platforms? Unfortunately, the Digital Economy Act does not affect these companies because they are not predominantly commercial porn publishers. Does he agree that the BBFC needs to develop mechanisms to evaluate the effectiveness of the legislation for restricting children's access to pornography via social media sites and put a stop to this unacceptable behaviour?

Lord Ashton of Hyde

My Lords, I agree that there are areas of concern on social media sites. As the noble Baroness rightly says, they are not covered by the Digital Economy Act . We had many hours of discussion about that in this House. However, she will be aware that we are producing an online harms White Paper in the winter in which some of these issues will be considered. If necessary, legislation will be brought forward to address these, and not only these but other harms too. I agree that the BBFC should find out about the effectiveness of the limited amount that age verification can do; it will commission research on that. Also, the Digital Economy Act itself made sure that the Secretary of State must review its effectiveness within 12 to 18 months.

Lord Griffiths of Burry Port Opposition Whip (Lords), Shadow Spokesperson (Digital, Culture, Media and Sport), Shadow Spokesperson (Wales)

My Lords, once again I find this issue raising a dynamic that we became familiar with in the only too recent past. The Government are to be congratulated on getting the Act on to the statute book and, indeed, on taking measures to identify a regulator as well as to indicate that secondary legislation will be brought forward to implement a number of the provisions of the Act. My worry is that, under one section of the Digital Economy Act , financial penalties can be imposed on those who infringe this need; the Government seem to have decided not to bring that provision into force at this time. I believe I can anticipate the Minister 's answer but--in view of the little drama we had last week over fixed-odds betting machines--we would not want the Government, having won our applause in this way, to slip back into putting things off or modifying things away from the position that we had all agreed we wanted.

Lord Ashton of Hyde

My Lords, I completely understand where the noble Lord is coming from but what he said is not quite right. The Digital Economy Act included a power that the Government could bring enforcement with financial penalties through a regulator. However, they decided--and this House decided--not to use that for the time being. For the moment, the regulator will act in a different way. But later on, if necessary, the Secretary of State could exercise that power. On timing and FOBTs, we thought carefully--as noble Lords can imagine--before we said that we expect the date will be early in the new year,

Lord Addington Liberal Democrat

My Lords, does the Minister agree that good health and sex education might be a way to counter some of the damaging effects? Can the Government make sure that is in place as soon as possible, so that this strange fantasy world is made slightly more real?

Lord Ashton of Hyde

The noble Lord is of course right that age verification itself is not the only answer. It does not cover every possibility of getting on to a pornography site. However, it is the first attempt of its kind in the world, which is why not only we but many other countries are looking at it. I agree that sex education in schools is very important and I believe it is being brought into the national curriculum already.

The Earl of Erroll Crossbench

Why is there so much wriggle room in section 6 of the guidance from the DCMS to the AV regulator? The ISP blocking probably will not work, because everyone will just get out of it. If we bring this into disrepute then the good guys, who would like to comply, probably will not; they will not be able to do so economically. All that was covered in British Standard PAS 1296, which was developed over three years. It seems to have been totally ignored by the DCMS. You have spent an awful lot of time getting there, but you have not got there.

Lord Ashton of Hyde

One of the reasons this has taken so long is that it is complicated. We in the DCMS , and many others, not least in this House, have spent a long time discussing the best way of achieving this. I am not immediately familiar with exactly what section 6 says, but when the statutory instrument comes before this House--it is an affirmative one to be discussed--I will have the answer ready for the noble Earl.

Lord West of Spithead Labour

My Lords, does the Minister not agree that the possession of a biometric card by the population would make the implementation of things such as this very much easier?

Lord Ashton of Hyde

In some ways it would, but there are problems with people who either do not want to or cannot have biometric cards.

 

 

UK adult businesses to be crucified from Easter 2019...

DCMS minister Margot James informs parliamentary committee of the schedule for the age verification internet porn censorship regime


Link Here 15th November 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Age Verification and adult internet censorship was discussed by the Commons Science and Technology Committee on 13th November 2018.

Carol Monaghan Committee Member: The Digital Economy Act made it compulsory for commercial pornography sites to undertake age verification, but implementation has been subject to ongoing delays. When do we expect it to go live?

Margot James MP, Minister for Digital and the Creative Industries: We can expect it to be in force by Easter next year. I make that timetable in the knowledge that we have laid the necessary secondary legislation before Parliament. I am hopeful of getting a slot to debate it before Christmas, before the end of the year. We have always said that we will permit the industry three months to get up to speed with the practicalities and delivering the age verification that it will be required to deliver by law. We have also had to set up the regulator--well, not to set it up, but to establish with the British Board of Film Classification , which has been the regulator, exactly how it will work. It has had to consult on the methods of age verification, so it has taken longer than I would have liked, but I would balance that with a confidence that we have got it right.

Carol Monaghan: Are you confident that the commercial pornography companies are going to engage fully and will implement the law as you hope?

Margot James: I am certainly confident on the majority of large commercial pornography websites and platforms being compliant with the law. They have engaged well with the BBFC and the Department , and want to be on the right side of the law. I have confidence, but I am wary of being 100% confident, because there are always smaller and more underground platforms and sites that will seek ways around the law. At least, that is usually the case. We will be on the lookout for that, and so will the BBFC. But the vast majority of organisations have indicated that they are keen to comply with the legislation.

Carol Monaghan: One concern that we all have is that children can stumble across pornography. We know that on social media platforms, where children are often active, up to a third of their content can be pornographic, but they fall outside the age verification regulation because it is only a third and not the majority. Is that likely to undermine the law? Ultimately the law, as it stands, is there to safeguard our children.

Margot James: I acknowledge that that is a weakness in the legislative solution. I do not think that for many mainstream social media platforms as much of a third of their content is pornographic, but it is well known that certain social media platforms that many people use regularly have pornography freely available. We have decided to start with the commercial operations while we bring in the age verification techniques that have not been widely used to date. But we will keep a watching brief on how effective those age verification procedures turn out to be with commercial providers and will keep a close eye on how social media platforms develop in terms of the extent of pornographic material, particularly if they are platforms that appeal to children--not all are. You point to a legitimate weakness, on which we have a close eye.

 

 

Offsite Article: Online porn filters will never work...


Link Here 26th November 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
Beyond the massive technical challenge, filters are a lazy alternative to effective sex education. By Lux Alptraum

See article from theverge.com

 

 

Defective Age Verification Law...

Parliamentary scrutiny committee condemns as 'defective' a DCMS Statutory Instrument excusing Twitter and Google images from age verification. Presumably one of the reasons for the delayed introduction


Link Here 3rd December 2018
Full story: BBFC Internet Porn Censors...BBFC: Age Verification We Don't Trust
There's a joint committee to scrutinise laws passed in parliament via Statutory Instruments. These are laws that are not generally presented to parliament for discussion, and are passed by default unless challenged.

The committee has now taken issue with a DCMS law to excuse the likes of social media and search engines from requiring age verification for any porn images that may get published on the internet. The committee reports from a session on 21st November 2018 that the law was defective and 'makes an unexpected use of the enabling power'. Presumably this means that the DCMS has gone beyond the scope of what can be passed without full parliamentary scrutiny.

Draft S.I.: Reported for defective drafting and for unexpected use of powers Online Pornography (Commercial Basis) Regulations 2018

7.1 The Committee draws the special attention of both Houses to these draft Regulations on the grounds that they are defectively drafted and make an unexpected use of the enabling power.

7.2 Part 3 of the Digital Economy Act 2017 ("the 2017 Act") contains provisions designed to prevent persons under the age of 18 from accessing internet sites which contain pornographic material. An age-verification regulator 1 is given a number of powers to enforce the requirements of Part 3, including the power to impose substantial fines. 2

7.3 Section 14(1) is the key requirement. It provides:

"A person contravenes [Part 3 of the Act] if the person makes pornographic material available on the internet to persons in the United Kingdom on a commercial basis other than in a way that secures that, at any given time, the material is not normally accessible by persons under the age of 18".

7.4 The term "commercial basis" is not defined in the Act itself. Instead, section 14(2) confers a power on the Secretary of State to specify in regulations the circumstances in which, for the purposes of Part 3, pornographic material is or is not to be regarded as made available on a commercial basis. These draft regulations would be made in exercise of that power. Regulation 2 provides:

"(1) Pornographic material is to be regarded as made available on the internet to persons in the United Kingdom on a commercial basis for the purposes of Part 3 of the Digital Economy Act 2017 if either paragraph (2) or (3) are met.

(2) This paragraph applies if access to that pornographic material is available only upon payment.

(3) This paragraph applies (subject to paragraph (4)) if the pornographic material is made available free of charge and the person who makes it available receives (or reasonably expects to receive) a payment, reward or other benefit in connection with making it available on the internet.

(4) Subject to paragraph (5), paragraph (3) does not apply in a case where it is reasonable for the age-verification regulator to assume that pornographic material makes up less than one-third of the content of the material made available on or via the internet site or other means (such as an application program) of accessing the internet by means of which the pornographic material is made available.

(5) Paragraph (4) does not apply if the internet site or other means (such as an application program) of accessing the internet (by means of which the pornographic material is made available) is marketed as an internet site or other means of accessing the internet by means of which pornographic material is made available to persons in the United Kingdom."

7.5 The Committee finds these provisions difficult to understand, whether as a matter of simple English or as legal propositions. Paragraphs (4) and (5) are particularly obscure.

7.6 As far as the Committee can gather from the Explanatory Memorandum, the policy intention is that a person will be regarded as making pornographic material available on the internet on a commercial basis if:

(A) a charge is made for access to the material; OR

(B) the internet site is accessible free of charge, but the person expects to receive a payment or other commercial benefit, for example through advertising carried on the site.

7.7 There is, however, an exception to (B): in cases in which no access charge is made, the person will NOT be regarded as making the pornographic material available on a commercial basis if the material makes up less than one-third of the content on the internet site--even if the person expects to receive a payment or other commercial benefit from the site. But that exception does not apply in a case where the person markets it as a pornographic site, or markets an "app" as a means of accessing pornography on the site.

7.8 As the Committee was doubtful whether regulation 2 as drafted is effective to achieve the intended result, it asked the Department for Digital, Culture, Media and Sport a number of questions. These were designed to elicit information about the regulation's meaning and effect.

7.9 The Committee is disappointed with the Department's memorandum in response, printed at Appendix 7: it fails to address adequately the issues raised by the Committee.

7.10 The Committee's first question asked the Department to explain why paragraph (1) of regulation 2 refers to whether either paragraph (2) or (3) "are met" 3 rather than "applies". The Committee raised this point because paragraphs (2) and (3) each begin with "This paragraph applies if ...". There is therefore a mismatch between paragraph (1) and the subsequent paragraphs, which could make the regulation difficult to interpret. It would be appropriate to conclude paragraph (1) with "is met" only if paragraphs (2) and (3) began with "The condition in this paragraph is met if ...". The Department's memorandum does not explain this discrepancy. The Committee accordingly reports regulation 2(1) for defective drafting.

7.11 The first part of the Committee's second question sought to probe the intended effect of the words in paragraph (4) of regulation 2 italicised above, and how the Department considers that effect is achieved.

7.12 While the Department's memorandum sets out the policy reasons for setting the one-third threshold, it offers little enlightenment on whether paragraph (4) is effective to achieve the policy aims. Nor does it deal properly with the second part of the Committee's question, which sought clarification of the concept of "one-third of ... material ... on ... [a] means .... of accessing the internet ...".

7.13 The Committee is puzzled by the references in regulation 2(4) to the means of accessing the internet. Section 14(2) of the 2017 Act confers a power on the Secretary of State to specify in regulations circumstances in which pornographic material is or is not to be regarded as made available on the internet on a commercial basis. The means by which the material is accessed (for example, via an application program on a smart phone) appears to be irrelevant to the question of whether it is made available on the internet on a commercial basis. The Committee remains baffled by the concept of "one-third of ... material ... on [a] means ... of accessing the internet".

7.14 More generally, regulation 2(4) fails to specify how the one-third threshold is to be measured and what exactly it applies to. Will the regulator be required to measure one-third of the pictures or one-third of the words on a particular internet site or both together? And will a single webpage on the site count towards the total if less than one-third of the page's content is pornographic--for example, a sexually explicit picture occupying 32% of the page, with the remaining 68% made up of an article about fishing? The Committee worries that the lack of clarity in regulation 2(4) may afford the promoter of a pornographic website opportunities to circumvent Part 3 of the 2017 Act.

7.15 The Committee is particularly concerned that a promoter may make pornographic material available on one or more internet sites containing multiple pages, more than two-thirds of which are non-pornographic. For every 10 pages of pornography, there could be 21 pages about (for example) gardening or football. Provided the sites are not actively marketed as pornographic, they would not be regarded as made available on a commercial basis. This means that Part 3 of the Act would not apply, and the promoter would be free to make profits through advertising carried on the sites, while taking no steps at all to ensure that they were inaccessible to persons under 18.

7.16 The Committee anticipates that the shortcomings described above are likely to cause significant difficulty in the application and interpretation of regulation 2(4). The Committee also doubts whether Parliament contemplated, when enacting Part 3 of the 2017 Act, that the power conferred by section 14(2) would be exercised in the way provided for in regulation 2(4). The Committee therefore reports regulation 2(4) for defective drafting and on the ground that it appears to make an unexpected use of the enabling power.

 


Censor Watch logo
censorwatch.co.uk
 

Top

Home

Links
 

Censorship News Latest

Daily BBFC Ratings

Melon Farmers