"Cybersecurity professionals voice concerns over the UK's age verification law, labeling it as a potential catastrophe"
The UK's age verification law, aimed at protecting children and vulnerable internet users, has sparked a wave of concern among cybersecurity experts. They argue that the legislation, in its current form, poses significant risks to privacy, security, and digital rights.
According to Jonsson, the discussion around AgeGO, an age-check service, necessitates a broader reflection on the underlying issues. He advocates for privacy-preserving, decentralized approaches like device-based enforcement and anonymous credentials for age verification checks.
Experts view the law as an online privacy nightmare and a cybersecurity risk. They warn that the legislation requires users to provide sensitive personal data, such as government-issued IDs, biometric data, credit card information, or facial recognition scans, to access adult content online. This, they say, creates a significant risk of mass data collection and digital surveillance.
Key concerns include the potential for data breaches and misuse of the stored personal information in centralized databases, which could be targeted by malicious actors for blackmail, extortion, or fraud. Experts highlight that many current age verification systems force users to over-disclose personal data without strong guarantees that the data will be securely stored or only used for their intended purpose.
The lack of clear implementation standards raises further cybersecurity vulnerabilities, exposing users to identity theft and scams. There are also worries about cross-platform behavioral profiling since third-party verification services may link an individual’s identity to all the content they access, reducing online anonymity and privacy.
Privacy advocates describe the law as a major expansion of digital surveillance, potentially infringing on users’ rights to free speech and online privacy. The backlash has led many UK internet users to seek VPNs to circumvent age checks, causing a surge in VPN downloads.
However, experts warn that many free VPNs lack adequate security measures and could themselves put user data at risk, compounding the privacy issues introduced by the law.
IPVanish, a VPN provider, supports efforts to protect children from harmful content online but believes the UK's age verification law poses serious risks to privacy, security, and digital rights. Denis Vyazovoy, Chief Product Officer at AdGuard VPN, supports a safer internet for everyone, but he believes uploading sensitive documents to be checked is "simply too much for many."
Mullvad VPN's CEO, Jan Jonsson, believes that identification should be issued by the state and that third parties should be able to verify age without needing to know users' personal data. Hendry Parsons calls for improved public education and greater transparency around age verification systems.
Experts argue that privacy and freedom of access matter, and the UK's current approach sets a troubling precedent and fails to strike a balance between safety and individual freedom. Some believe more effective and less harmful options, such as anonymous age tokens and device-level parental controls, should be explored.
Dr Ilia Kolochenko, CEO of security company ImmuniWeb, suggests that we may have to accept a compromise of our privacy as a new reality in many countries. He hypothesizes that VPN traffic may be targeted in the near future, and about 90% of popular free and commercial VPN services could be blocked by adult-content providers.
A petition calling for the repeal of the Online Safety Act has been signed by 450,000 people, but the U.K. government has not indicated plans to repeal the act. The law requires age verification checks for accessing certain websites, which can be done through photo ID, credit card checks, or AI scanning faces.
In the face of these concerns, it is crucial for authorities to find a balance between protecting children and maintaining privacy and security online.
Cycling through various VPN providers, experts voice their apprehensions about insecure free services, fearing that they may further endanger users' data. Privacy-preserving, device-based age verification methods, like those advocated by Mullvad VPN's CEO, Jonsson, may offer a more secure and privacy-focused alternative to current centralized systems. The debate continues on striking a balance between safeguarding children and upholding privacy and technology rights, as concerns loom over mass data collection and digital surveillance.
