Identifying the trade-offs in online age verification

Concern about the harm social media can do to young people is growing. But to protect kids, platforms have to know who is underage. That’s why user age verification has become a focus for policymakers.

Several states have passed laws that require it. But these policies require a range of trade-offs, according to a new analysis from Utah State University’s Center for Growth and Opportunity.

Matt Perault and Scott Brennen of the University of North Carolina at Chapel Hill’s Center on Technology Policy co-wrote that research. Marketplace’s Meghan McCarty Carino discussed the costs and benefits involved in various methods with the pair and started by asking Brennen about the age verification systems that are now in place.

The following is an edited transcript of their conversation.

Scott Brennen: The first is what we call age gating. And it’s basically where users just give their age, or more often their birthdate. The second one is user-submitted hard identifiers, so things like a government ID. And then finally, there’s this category we call inferential age assurance. Basically, platforms are combing through user data to make guesses about the ages of their users. And so they can do age assurance, or age verification, that way.

Matt Perault: That latter one is actually — the age inferences — the opening scene for our report because there was this exchange between the TikTok CEO at the hearing where he testified earlier in the spring, and a member of Congress where TikTok was getting pushed on what are the practices that it uses to protect kids online. And that was something clearly lawmakers were concerned about. And so the CEO started to go into detail about how they use these inferential methods to do that because in order to protect kids online, you first have to determine who’s a kid. And the member of Congress said, “Oh, that sounds creepy.” And I think that really highlights the challenges here for policymakers, which is that if you want platforms to be more and more aggressive about identifying who children are so that we can protect them, that comes with clear downsides, and there are things about inferential approaches that I understand why a lawmaker would respond by saying, “That sounds creepy.” On the flip side, if you want to identify who kids are, that is one of the methods, and I think, in many ways, a fairly good method to try to determine who the kids on your platform might be.

Meghan McCarty Carino: Scott, what are some of the approaches that states are taking when it comes to requirements for age verification?

Brennen: So the first, big online child safety bill that was passed by the states was California. But in that, they don’t give a lot of specifics about how exactly companies should actually do the verification of user ages. Some of the other state laws, like the adult content bill that was passed by Louisiana and then subsequently a series of other states, have provisions that require things like a government ID or any commercially reasonable method that relies on public or private transactional data.

McCarty Carino: And Matt, what kinds of concerns arise with these approaches?

Perault: So if you think about ways to understand who kids are, there are some natural things that I think policymakers have thought of. For instance, platforms could collect identification from people. The challenge of that is that we’re at a moment when there are, I think, understandable concerns about data privacy and data collection online. There are other downsides, I think, of an ID-oriented approach as well, such as the equity implications of it. And if you gate access to technology tools, then even people who aren’t kids wouldn’t be able to access those tools if they lack access to the identification method.

McCarty Carino: Scott, did you want to add to that?

Brennen: The other two kinds of big trade-offs are [first] usability. So what does it mean for user experience to have to repeatedly go through sort of age verification? That might, of course, be a more minor concern when we’re talking about these big questions about keeping kids safe and protecting user privacy, but it is something that we need to consider. And then, of course, the legality of age verification itself, which [involves] ongoing arguments about the constitutionality of government-mandated age verification requirements.

McCarty Carino: So walk me through some of the key recommendations that you put out for policymakers to approach this issue.

Perault: So we have recommendations in three categories: balance, specificity and understanding. So “balance” means policymakers should look at the costs and benefits of different approaches. One clear opportunity there is to actually conduct cost-benefit analyses of proposed legislation to understand better what the benefits might be in terms of identifying who is a kid and protecting children, and then what the cost might be. As we’ve discussed, there are a lot of trade-offs as well. Specificity means providing enough detail so that companies understand their obligations and best practices and so that users understand the protections that they get and the risks that they might be exposed to when they’re online. So one of the examples there is that the Federal Trade Commission currently provides guidance on how companies can comply with current requirements in child safety. And we think that they can expand that guidance to be somewhat more detailed to provide companies with a little bit more instruction about how they should approach the issue and, again, provide additional clarity to users. The final category is understanding. We think that there’s work that policymakers can do to develop a deeper understanding of this issue, a deeper understanding of the trade-offs in it. One of the obvious ones here is that right now at this moment of experimentation at the state level, where states are trying lots of different methods for identifying who kids are and trying to protect kids more effectively, we think the federal government is really well-positioned to fund research looking across different states to identify what methods work better, and what are a little bit less effective.

McCarty Carino: Scott, what other recommendations did you have?

Brennen: All of these recommendations really kind of tie back into the trade-offs that we identify in different age verification methods. And the goal here is to provide regulators [with] a toolkit for how they can help platforms do the work of balancing those different trade-offs and understanding what are the real costs and benefits of different approaches.

McCarty Carino: Scott, what are the implications of having a patchwork approach sort of state by state that we see emerging?

Brennen: One of our recommendations is actually for the federal government to fund a comparative study that uses the fact that states are adopting kind of different approaches to better understand what might actually work and to think of this not as an unworkable patchwork, but as an opportunity to experiment and to learn from that experimentation.

Perault: Yeah, I completely agree. Often, a patchwork is viewed as problematic, and I think there are reasons that’s problematic here. But there also are some benefits in that we’re in the early days of this — online safety is an issue that’s really important for parents, teachers, for communities all over the country — and so I think it is helpful that there is some experimentation and some activity in this area. The flip side is that having a patchwork of different regulatory regimes can be hard for startups. It’s really hard for them to offer a business across state lines. Compliance burdens, I think, typically disproportionately affect smaller platforms. So it can make them harder to compete, whereas larger platforms can put more resources into developing a different approach for Louisiana, Arkansas or New York. And so there are certainly downsides as well.

More on this

I noted the growing concerns about kids and social media that spurred these policy discussions. Of course, last month the U.S. surgeon general issued an advisory about those risks. On the show, we spoke to Mitch Prinstein at the American Psychological Association about research on how kids and their developing brains are affected by social media.

Utah, California, Louisiana and a handful of other states have now passed laws attempting to regulate kids’ social media use, with stricter age verification, age limits and age-appropriate design standards.

But as Brennen pointed out, many of these laws are likely to face legal challenges on First Amendment grounds. And just last week, a group of adult entertainment business interests sued the state of Louisiana over its law that websites must verify user age with a state-issued digital driver’s license or be held liable for “content harmful to minors.” The lawsuit alleges that the state law violates free expression and due process by potentially denying access for adults who can’t provide verification documentation or who worry about their personal data being hacked.

Stories You Might Like

After Roe, what happens when the rules for online speech are different in each state?

Big Tech is gaining Americans’ trust, but not when it comes to their kids’ data, survey says

Louisiana law requiring proof of ID for porn site access has privacy advocates worried

What a privacy organization and Big Tech’s lead lobbying group think about internet regulation

How tech might clean up concrete

Is there a right kind of screen time?