You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<pid="section-1-1">Increasingly, policymakers are proposing and implementing regulation that restricts what content young people can access online. A recurring theme in these efforts is that it is no longer considered sufficient to rely on self-assertions of age, and so stronger guarantees are deemed necessary.<ahref="#section-1-1" class="pilcrow">¶</a></p>
1199
1188
<pid="section-1-2">Age restrictions are already deployed on the Internet: for example, some Web sites already require proof of age to create an account. However, when such deployments become more prevalent, they tend to have greater impact upon the Internet architecture, thereby endangering other properties that we depend upon for a healthy online ecosystem. Systems that are designed for deployment in a single, homogenous domain rarely are suitable for the diversity of requirements and considerations that apply to Internet-scale systems.<ahref="#section-1-2" class="pilcrow">¶</a></p>
1200
-
<pid="section-1-3"><ahref="#risks" class="auto internal xref">Section 2</a> catalogues the risks that such systems might incur, expressed in terms of the Internet's architectural principles. <ahref="#recommendations" class="auto internal xref">Section 3</a> suggests the properties that an age restriction system should have to be a healthy part of the Internet infrastructure.<ahref="#section-1-3" class="pilcrow">¶</a></p>
<pid="section-2.2-6">This is the case when verifying services over-collect such information (for example, age estimation services that use photos and biometrics), and it is also the case when users' activity is exposed to the verifying service when age restriction takes place. The latter risk is similar to the risk of tracking and profiling seen on the Web, which the Internet standards community has expended considerable effort to mitigate (see e.g., <span>[<ahref="#RFC7258" class="cite xref">RFC7258</a>]</span>).<ahref="#section-2.2-6" class="pilcrow">¶</a></p>
1240
1228
<pid="section-2.2-7">Furthermore, exposing information beyond age to services creates additional privacy and security risks. For example, an age verification system that also exposes the country a person is a citizen of allows sites to discriminate against that attribute, which is beyond the purpose of age restriction.<ahref="#section-2.2-7" class="pilcrow">¶</a></p>
1241
1229
<pid="section-2.2-8">Finally, even on its own a simple attribute like 'age in years' or 'birthdate' can be used to add entropy to an identifier for the end user, creating a new tracking vector when exposed to services that collect such information. See <span>[<ahref="#TRACKING" class="cite xref">TRACKING</a>]</span>.<ahref="#section-2.2-8" class="pilcrow">¶</a></p>
1242
-
<pid="section-2.2-9">Therefore, age restriction systems that are intended to become part of Internet infrastructure MUST:
1230
+
<pid="section-2.2-9">In all cases, the privacy and security of an age restriction system needs to be proven: considerable experience has shown that merely trusting assertions of these properties is ill-founded.<ahref="#section-2.2-9" class="pilcrow">¶</a></p>
1231
+
<pid="section-2.2-10">Therefore, age restriction systems that are intended to become part of Internet infrastructure MUST:
1243
1232
* Avoid over-collection of information by age verifiers
1244
1233
* Avoid sharing information about service usage with age verifiers
1245
1234
* Avoid sharing information other than age information with services
1246
-
* Minimise the amount of age information shared with services (e.g., using age brackets)<ahref="#section-2.2-9" class="pilcrow">¶</a></p>
1247
-
<pid="section-2.2-10">See also <span>[<ahref="#PRIVACY" class="cite xref">PRIVACY</a>]</span>.<ahref="#section-2.2-10" class="pilcrow">¶</a></p>
1235
+
* Minimise the amount of age information shared with services (e.g., using age brackets)
1236
+
* Be based upon publicly available specifications that have had adequate security and privacy review to the level that Internet standards are held to<ahref="#section-2.2-10" class="pilcrow">¶</a></p>
1237
+
<pid="section-2.2-11">See also <span>[<ahref="#PRIVACY" class="cite xref">PRIVACY</a>]</span>.<ahref="#section-2.2-11" class="pilcrow">¶</a></p>
<pid="section-2.3-3">For example, many people only have Internet access from public computers (such as those in libraries), and do not have exclusive or reliable access to a smartphone. Others lack government-issued identity documents that some schemes rely upon.<ahref="#section-2.3-3" class="pilcrow">¶</a></p>
1258
1248
<pid="section-2.3-4">While such restrictions may be palatable in a closed system (such as on a single platform or in a single jurisdiction), they are not suitable for Internet-wide deployment.<ahref="#section-2.3-4" class="pilcrow">¶</a></p>
1259
1249
<pid="section-2.3-5">Therefore, age restriction systems that are intended to become part of Internet infrastructure MUST:
1260
-
* Avoid requiring hardware capabilities not widely available in desktop and mobile computers globally, both in terms of performance and specific features
1250
+
* Avoid requiring hardware capabilities not widely available in desktop and mobile computers globally, both in terms of overall performance and specific features
1261
1251
* Avoid relying on a single mechanism for proving age<ahref="#section-2.3-5" class="pilcrow">¶</a></p>
<pid="section-2.4-1">If an age restriction system relies too much on legal controls rather than technical capabilities, those controls are likely to be inconsistently applied in different jurisdictions, leading to different experiences for Internet users around the globe.<ahref="#section-2.4-1" class="pilcrow">¶</a></p>
1270
-
<pid="section-2.4-2">Likewise, a solution that requires special access to computers (such as in “trusted platform modules” or otherwise mandates conformance on people’s computers introduces a risk of limiting the kinds of computers that can be used on the Internet – for example, Open Source Operating Systems and Web browsers are generally unable to provide such assurances.<ahref="#section-2.4-2" class="pilcrow">¶</a></p>
1271
-
<pid="section-2.4-3">While these tradeoffs may be reasonable in a single jurisdiction, too many differences will create barriers to Internet-wide deployment of services, creating not only centralization risks, but also fragmentation risks -- that the Internet will work in different ways depending on where you are.<ahref="#section-2.4-3" class="pilcrow">¶</a></p>
1259
+
<pid="section-2.4-1">The likelihood of incompatible age restriction systems being deployed in different jurisdictions around the world introduces a risk of fragmentation -- i.e., that the Internet will not work the same way in different places.<ahref="#section-2.4-1" class="pilcrow">¶</a></p>
1260
+
<pid="section-2.4-2">Fragmentation is a growing concern for the Internet: various local requirements are creating friction against global deployment of new applications, protocols, and capabilities. As the Internet fragments, the benefits of having a single, globe-spanning networking technology are correspondingly lessened. Although a single factor (such as diverging approaches to age restriction) is unlikely to fragment the Internet on its own, the sum of such divergences increases the risk of fragmentation greatly, risking the viability of the Internet itself.<ahref="#section-2.4-2" class="pilcrow">¶</a></p>
1261
+
<pid="section-2.4-3">In the context of age restriction, fragmentation is most concerning if someone were to need to understand and interact with (possibly after some onboarding procedure) a new system for each jurisdiction they visit. This would represent a significant barrier for users who travel, and would also present increased complexity and regulatory burden for businesses, potentially leading to further lack of competitiveness in some industries by increasing costs.<ahref="#section-2.4-3" class="pilcrow">¶</a></p>
1262
+
<pid="section-2.4-4">Fragmentation is best addressed by adoption of common technical standards across jurisdictions. However, it is important to recognise that the mere existence of an international standard does not imply that it is suitable for deployment: experience has shown that voluntary adoption by implementers is important to prove their viability.<ahref="#section-2.4-4" class="pilcrow">¶</a></p>
1263
+
<pid="section-2.4-5">Therefore, age restriction systems that are intended to become part of Internet infrastructure MUST:
1264
+
* Be based upon internationally recognised, open technical standards
1265
+
* Be based upon technical standards that are voluntarily adopted by implementers
1266
+
* Be coordinated across jurisdictions wherever feasible<ahref="#section-2.4-5" class="pilcrow">¶</a></p>
<pid="section-2.5-1">The Internet is designed to be used without permission, both be servers and clients. Easy-to-use age restriction mechanisms risk creating a ‘papers please’ Internet, where a credential is required to access large portions of the Internet. Such an outcome would amplify the other harms listed.<ahref="#section-2.5-1" class="pilcrow">¶</a></p>
1280
-
<pid="section-2.5-2">This risk is heightened if there are incentives for sites to deploy it, such as access to non-age data.<ahref="#section-2.5-2" class="pilcrow">¶</a></p>
1274
+
<pid="section-2.5-1">The Internet is designed to be used without permission, both be servers and clients. Easy-to-use age restriction mechanisms risk creating a ‘papers please’ Internet, where a credential is required to access large portions of the Internet's services. Such an outcome would amplify the other harms listed.<ahref="#section-2.5-1" class="pilcrow">¶</a></p>
1275
+
<pid="section-2.5-2">This risk is heightened if there are incentives for sites to deploy it, such as increased access to non-age data.<ahref="#section-2.5-2" class="pilcrow">¶</a></p>
1281
1276
<pid="section-2.5-3">Access to more granular age information also heightens many risks, because it makes a restriction system simultaneously useful in a broader variety of cases, and more attractive for misuse, because it offers more information about users.<ahref="#section-2.5-3" class="pilcrow">¶</a></p>
1282
-
</section>
1283
-
</div>
1284
-
</section>
1285
-
</div>
1286
-
<divid="recommendations">
1287
-
<sectionid="section-3">
1288
-
<h2id="name-recommendations-for-age-res">
1289
-
<ahref="#section-3" class="section-number selfRef">3. </a><ahref="#name-recommendations-for-age-res" class="section-name selfRef">Recommendations for Age Restriction Systems</a>
<pid="section-5-1">Age restriction systems undoubtedly have numerous security considerations, should they be deployed.<ahref="#section-5-1" class="pilcrow">¶</a></p>
1297
+
<pid="section-4-1">Age restriction systems undoubtedly have numerous security considerations, should they be deployed.<ahref="#section-4-1" class="pilcrow">¶</a></p>
0 commit comments