It has been a big week for the digital identity sector in the UK this week because of the imposition of age verification for adult services. This means that I’ve been thinking about such services a lot this week. I realise it is a sensitive topic to cover in family-oriented publication, but it is important, so I will do my best to highlight the implications without offending.
Age Verification Is A Sensitive, But Important Topic
Let me begin at the beginning. I remember seeing a tweet from Gillan Branstetter, Communications Strategist at the ACLU’s Women’s Rights Project in which she said that “The biggest red flag to me about crypto is most sex workers wanted nothing to do with it. I would trust a single sex worker on digital finance and security more than a conference hall of VCs and tech bros”. This tweet stuck in my mind at the time because I was curious as to whether the evident demand for adult services would translate into a demand for cryptocurrency.
I just logged in to a popular adult side to create an account for research purposes — not in my real name, of course — and found that I could choose between Bitcoin, Ethereum, Ripple, Tether and some other cryptocurrencies to pay with. Not that I bothered with any of them, because using cryptocurrency is such a hassle, but it did make me wonder whether there is now any real take up of cryptocurrencies in the adult sector. It seems not, by the way: a quick survey of the available literature would seem to indicate that adult services represent a tiny fraction of Bitcoin transactions, for example.
That in turn reminded me of the BBC’s excellent documentary on the technology of the modern payment card (The Secret Genius of Modern Life Series 1: Bank Card), in which the presenter Hannah Fry explored the role of the adult sector in the evolution of the modern bank card industry. She made the point that rampant chargebacks for adult services of all kinds in the early days of the internet drove the rapid development of authorisation and authentication techniques for “card not present” transactions.
Why do I remain so fascinated by this history? Well, as one adult industry executive summarised rather nicely for the Financial Times:
The story of the porn industry is the story of trying to take payments.
Indeed. And I remember a very interesting Slate podcast that touched on this, featuring Samantha Cole talking about her book “How Sex Changed the Internet, and the Internet Changed Sex”. She made the point that a great many payment-related innovations came directly from the demands of the adult sector: subscriptions, paywalls, online card use and so on.
These people have a point: adult services have pushed the development of new technologies is well-established and it is clearly especially true about the world of payments.
(As an aside, I don’t know if you’ve ever seen the movie Middle Men, but it’s an enjoyable 2009 fictionalised version of the story of the men who invented online commerce by figuring out how to take credit card numbers over the internet. The adult industry was early into the space, has constantly evolved paid content technology and business models, and has all sorts of experience with anti-fraud techniques and all the rest of it. And it is certainly true that well beyond the internet, the demands of the adult sector have driven technological development. The movie, by the way, has an amazing backstory, because the producer Christopher Mallick was one of the real-life inspirations behind the film.)
I am now beginning to wonder if adult services might also have a similar impact on the world of identity. The UK has just implemented age verification for adult services, in common with many US states, and the initial statistics seem to show a substantial uptake in the use of new identity technologies (not mention a substantial uptake in the use of Virtual Private Networks, VPNs. Proton, the Swiss-based company behind the top VPN app, said it had experienced a more than 1,800 per cent increase in daily sign-ups from UK-based users. Similarly, Nord said there had been a 1,000 per cent increase in UK purchases of VPN subscriptions.)
So what is the impact on digital identity services? How exactly are the online checks being done? Well, under the UK’s new Online Safety Act (OSA), the regulator has outlined age verification methods that it considers “highly effective” (which is the compliance benchmark). These are:
- Open banking which asks your bank to verify you are over 18 (don’t worry, the bank doesn’t know which site you are visiting). I used this in my first experiment to test the age verification paths and it was quick and easy. There were a million such checks within the first week of going live.
- Credit card checks, which work because you must be over 18 to obtain a credit card.
- Photo identification which compares a photo of your with submitted identification, such as a passport;
- Age estimation that uses AI to analyse your age based on a photo of your face;
- Mobile network operator age checks in which look at whether or not your mobile phone number has age filters applied to it;
- Digital identity wallets, which store information proving your age. I tried this as well and it was again quick and easy.
- Email-based age estimation that takes your email address and somehow works out how old you are. I used to this to prove my age for Discord (using an old email address that does not contain my actual name of course!) and it worked fine.
Different services have chosen different subsets of this list and I am sure over the coming weeks they will begin to work out which combinations work best with given demographics, but the key takeaway for me is that with millions of monthly users, a substantial fraction of the British population will soon have experience in using age verification, and not only for adult sites.
I am watching these dynamics closely, because age verification is a canary in the coal that raises serious questions about privacy protections. A database of people who visit pornographic sites, for instance, would be a rich target for scammers and extortionists. Thus, getting people used to credential-based transactions that are based on cryptography and not the storage of personally-identifiable information is a big win for both privacy and security.
Adult Services As Trailblazer
Of course, in time, the new identity technologies and the new payment technologies will come together. If I can have a pseudonymous wallet from (for example) my bank and I can use that wallet to hold stablecoins or central bank digital currency and I can use that money to visit an adult services site without adult site ever knowing my real name or any other personal details, and the money issuers having no idea who it was who used the currency at the site, then we have a much better infrastructure for the post-industrial always-on society and not only for adult services.
For this to work, the wallet needs to provide two functions to the adult sites: a persistent and unique site-specific identifier, and a cryptographic proof that the wallet owner is over 18.
Just as adult services drove the evolution of the online payments sector, so perhaps it will be the adult sector that drives the adoption of convenient and effective privacy-enhacing identity services just as it drove the adoption of convenient and effective payment services!