POSR0015
Written evidence submitted by The Age Verification Providers Association
Thank you for the opportunity to comment on the National Audit Office’s insightful report on Ofcom’s preparations for implementing the Online Safety Act.
The Age Verification Providers Association (‘AVPA’ or ‘Association’) is the global trade body representing suppliers of age verification and age estimation technologies, collectively termed “age assurance”.
Age assurance is a critical success factor in the implementation of the new Online Safety Act because Parliament decided to focus the protections this legislation offers on children. In order to do so, online platforms (i.e. user-to-user services and sites publishing pornographic content) will need to distinguish between adult and child users, unless they consider their site safe for users of all ages.
The NAO report Ofcom has increased its estimate of the number of sites affected by the legislation from 25,000 to 100,000. It wisely adds that this could be considerably more.
We know that it will be. The inclusion of all pornographic websites in Part 5 puts some 4-5 million websites into scope.
It is essential that Ofcom considers how to enforce at scale. We sought to amend the Bill to explicitly provide powers to the regulator to go to court to seek business disruption and access blocking orders for multiple sites at once, by presenting a schedule (which could have thousands of non-compliant sites listed). Both Houses were repeatedly reassured by Ministers that the existing Civil Procedure Rules allow for multi-party claims. We are still concerned that the volumes involved will test the CPR to breaking point but must take on good faith the reassurances from ministers.
Our focus on this point arises from the experiences in France and Germany, where regulators have targeted only a handful of major adult sites. The result is that these sites, realistically view this as an existential threat to their commercial viability as they have evidenced levels of user attrition above 99% when age verification is required of them but not of their close competitors.
The adult industry is not opposed to age verification per se. Indeed, many within it are parents themselves who would not wish their own children to stumble across the content their employers host. So they are willing to cooperate with the new regime provided it immediately establishes a level playing field. Ofcom needs to be able to realistically threaten enforcement again any site accessed from the UK which does not have age verification in place on the day the code comes into force. It needs to articulate this approach loudly and clearly to the adult industry.
When implementing the Audio-Visual Media Services Directive, affecting only 20 or so video sharing platforms established in the UK, we saw slowly Ofcom can move. It also celebrated its success in engaging with OnlyFans to persuade them to comply, in the same way it might engage with the management of GB News, or work with a handful of UK mobile network operators to improve number portability. Ofcom will need to make a step change in its approach from the persona touch to mass communication and enforcement. If it does not do this, it will find itself in court for years, as well funded larger sites use every avenue available to delay the impact of this legislation. They will probably not succeed in the long run, but every day of delay could be worth over a £1 million to some sites. An army of KCs is cheap by comparison.
There is an 18-month deadline – notably described by the Minister at the despatch box in the House of Lords as “a backstop not a target” – for submitting “a draft of the first code of practice prepared under section 41(3) relating to a duty set out in section 12 or 29 (children’s online safety).” We note that this period ends in April 2025. The Secretary of State must lay the Code before Parliament as soon as practicable and, if Parliament does not object during 40 days while Parliament is sitting, it will come into force with a 21 day notice period, so nine weeks or so later, probably in the summer of 2025.
Members of the Committee will be aware that a General Election must be held while Ofcom is making preparations. The regulator must include scenario plans for several potential periods when the election may take place so it can still meet the deadline. It cannot be possible for Ofcom to invoke the 12-month emergency brake already in the legislation, for a completely inevitable and foreseeable event of this nature.
It would be helpful of course if political parties would make clear in their manifestos a commitment to implement the Act in line with the 18 month deadline. Technology moves too fast to delay action in search of a perfect cure to its ills, which has been the record so far e.g.
the repeated delays and then the (unlawful until its repeal) abandonment of Part 3 of the Digital Economy Act.
We can report to the Committee that Ofcom has made a very strong start in their new role, from our own engagement with their growing team of experts, many of whom are dedicated specifically to age assurance. We have observed staff climb a steep learning curve adeptly, and there are already experts in our field within key policy and technology teams at Ofcom.
We believe they understand the need for a level playing field to avoid provoking unnecessary legal resistance from the adult, and indeed other regulated sectors, learning from the experience of the British Board of Film Classification, whose own expertise by experience of the Digital Economy Act preparations, and ongoing content rating skills should be leveraged as far as possible within the legal framework.
The Ofcom teams have become involved in the work to develop international standards for age assurance through the ISO and IEEE, sitting as observers on the working groups of volunteers who devote many hours to achieving consensus across the world’s leading experts. Representatives of Ofcom have put themselves forward to speak at key conferences and to engage with civil society, such as the extremely useful calls arranged by the Carnegie Institute.
Ofcom staff have been cautious in what they say, understandably while the legislation was still in flux, but must now be given the latitude by their legal advisors, to engage more freely and openly with stakeholders. A fear that an Ofcom employee may say something in public that undermines a future legal case must be weighed against the impact this can have on their ability to do the job at hand, and do so transparently and in partnership with stakeholders. We must trust the courts to recognise the value of this approach and not to penalise Ofcom for any slips of the tongue in future.
Ofcom has a strong track record as a regulator, but the scale of its new responsibilities dwarfs its current role. The speed of technological change online means Ofcom cannot let the best be the enemy of the good, as it will never achieve regulation that is anything other than a bit behind bleeding-edge technology. The test is how well it can keep up while mitigating the most pervasive risks of harm as they emerge. We look forward to working with them, and commend their progress thus far to the Committee.
October 2023