What does the EU really want from Meta?

And does it really think digital IDs will solve minor age verification?

May 28, 2024

Recently the European Commission announced its second investigation1 in three weeks into Meta’s compliance with the new Digital Services Act (DSA). This time it’s about whether Facebook and Instagram are complying with their obligations to protect children and teens. The formal inquiry will assess whether their algorithms encourage addiction and worsen “rabbit-hole effects.” Further, the Commission will look at how Meta stops minors accessing inappropriate content, “notably age-verification tools […], which may not be reasonable, proportionate and effective.”2

The scope is basically identical to an investigation launched in February into TikTok.

An EU official doubled down: “One of the underlying questions of all of these grievances is how can we be sure who accesses the service and how effective are the age gates — particularly for avoiding that underage users access the service” (emphasis mine).3

On the same day, a Commission official told MLex (paywall) that new guidelines on age verification under the DSA were forthcoming and suggested their focus would be on age assurance solutions that make use of new EU digital wallets, based on the Digital Identity Regulation that has just come into force. Separately, we know that that uber-privacy regulator, the European Data Protection Board (EDPB), will publish a set of criteria around age assurance technologies and their interplay with the GDPR. Presumably that’s a key input to the DSA guidance as it will establish how to balance privacy protections with the requirement to collect more information to verify age.

Let’s try to brush away the bureaucratese and look at what’s really at stake here.

First, what is age assurance for?

Until recently, it was only about complying with privacy laws like COPPA or GDPR’s Article 8. The platforms need age (13/16+) to work out whether or not someone can access the service, or whether it can only be accessed after parents consent to the processing of a kid’s personal data.

Then came age-appropriate design codes, which require operators to adapt their service to different age bands “in the best interest of the child.” Suddenly all those who age gated users under privacy laws and then threw away the age, or just kept a log without holding onto the birthdate (to enable ageing up), had to collect age all over again.

Then we had content laws like the legacy Audiovisual Media Services Directive (AVMSD) and more potently the DSA, which require knowing a user’s age (or age range) in order to protect them from illegal and harmful-but-not-illegal content.

Note that suddenly there are three (!) separate legal requirements to obtain age information of young people, for different purposes, and with different guidance (or lack of guidance) from each regulator on the appropriate standard. Not easy! (And I have ignored the plethora of US state laws that are mandating age verification, many still being challenged in the courts)4.

So, what is Meta doing for age assurance?

Facebook and Instagram have long followed global practice and use self-declared age (via ‘neutral’ age gates) to determine if you can open an account under prevailing privacy laws like COPPA or GDPR, eg you are 13+ in most countries (higher in some).

As the design codes came into force and public pressure mounted to do more to protect their younger users from various harms, they added layers of age assurance. Notably, they use AI tools, human moderators and user reports to identify existing accounts that might be under the self-declared age, and to adapt their service accordingly, or close the account.

Finally, they use more rigorous age verification in two scenarios (as far as I’m aware). If an under-18 user tries to change their age to over 18, they have to prove they are an adult before they will be allowed to make the change. And if a user who has been flagged as under-age wants to appeal, they can prove their age and restore their account. For these use cases, Meta employs best-in-class facial age estimation or ID verification services from trusted providers like Yoti.5

In parallel, Meta has been investing significantly in expanded parental controls, content protections for teens, and — in relation to its Quest walled garden environment — an Age API concept that allows it to exchange age information with app developers.

Then what’s the issue with the DSA?

Between the lines, the DSA and its authors are giving expression to a longstanding frustration: that age gates don’t work. This is because ~50% of kids lie about their age, often with their parents' knowledge or approval. As a result, the registered age of users on these platforms is often wrong, which means a lot of the safety and content moderation efforts are for naught. The Commission wants to fix this such that the DSA’s protections for children and teens will be effective.

The problem is, as we have discussed, that there is no easy-to-use, widely accessible, privacy-preserving and accurate way to assess the age of a minor. Until now the state of the art is: age gates + AI detection + appeals using age verification. Exactly what Meta (and TikTok and Snap et al) are doing.

Digital IDs to the rescue?

Let’s assume the EC’s investigation into Meta’s age assurance approach concludes that it works OK-ish given what has been possible with technology and (a lot of!) human resources until now. By the time we get to that conclusion, presumably, we’ll have both the EDPB and the DSA guidance on age assurance technologies. The latter may well hold up digital IDs as a universal solution to validating age information, including for minors.

The Digital Identity Framework requires EU states to bring digital IDs to their citizens by 2026, and for companies and agencies to accept them by 2027. It will rely on a mix of private companies, state agencies and other entities to be the providers of the actual digital wallets, based on the EU’s reference framework. The EU is making available a €20m grant for pilot projects that demo key use cases, including “Wallets for Age Verification [and…] the issuance of pseudonymous attestation containing only age verification by a trusted third party.”6

Meanwhile, various EU privacy regulators are weighing in with their own requirements, and pressuring the EDPB to include them in its guidance. France’s CNIL insists any age verification solution must be ‘double-blind’, ie the operator can’t identify the user, and the provider of the age token can’t know what site the user visited. This is handy for visitors of porn sites, but hobbles the business model for age token interoperability as the parties operating and benefiting from the service can’t identify each other (and hence share transaction costs).

But here’s the thing. None of the proposed infrastructure actually solves verifying the age of a minor. Getting your identity and age into a digital wallet requires an upfront ID verification process. That process faces the same constraints as today — most kids don’t have IDs; requiring passports is exclusive; asking for birth certificates too invasive. Even the EUConsent project, which innovated the use of interoperable tokens to share age signals, relied on existing ID solution vendors to generate the original tokens, which they could only really do for adults.

If the DSA team believes they can pressure Meta to adopt digital IDs as a replacement for self-declared age, they may inadvertently undermine the momentum behind the digital ID rollout. By pushing this use case, they risk exposing its inherent weakness when it comes to verifying the ages of minors. This could be counterproductive, as age verification is often touted as a key driver for widespread digital ID adoption.

Ultimately, it’s the parents, stupid

Some day we’ll all have digital IDs issued at birth and a safe way to share attributes like age with trusted operators. My libertarian friends shudder at the thought, but let’s assume that’s all OK and governments don’t abuse the system. In the meantime (and it could be a long one), we need to improve the reliability and distribution of age information so that privacy laws, design codes and content laws can protect kids & teens as they intended.

In my view, there are two incremental solutions that can help a lot and are relatively easy to implement. We’ve talked before about the idea of a Universal Age API, which is basically an agreement among operators to exchange existing age information in a privacy-preserving way, and to aggregate age signals from multiple sources to increase their reliability.

One way the Universal Age API gets better quickly is by enabling kids and teens to volunteer to verify their age with an ID if they have one, or ask a parent to confirm their age (and have the parent verify with an ID instead). This is where digital wallets can definitely be useful. As they are adopted, more adults can avoid uploading physical IDs. If we agree that parent-provided age (though not perfect) is better than self-declared age, then we should focus only on how best to share those age signals securely and privately with the maximum number of operators. (And we should stop conflating that with the problem of enabling adults to access porn anonymously. They are not the same.)

The best idea I’ve seen so far for obtaining parent-confirmed age and then sharing the age signal is Bandio’s tokenised approach. This improves on age info attached to a hashed email address, as the token can sit on multiple devices and doesn’t require the user to input their email to validate. It may also solve the traditional problem of distribution by being able to access parents and families via the network and reputation of its founding partner Common Sense Media.

As with the idea of the Universal Age API, we already have many many places where parents have confirmed the age of a child or teen — mobile phone operators, iPhone set-up, gaming console set-up, schools, healthcare systems, etc. If we can harness what exists and agree on a secure way to share the signals, we can solve most of the problem. And I’m pretty sure Meta and other large operators would gladly adopt the solution — no DSA investigation needed.