Pornhub has responded after a cybersecurity expert issued a stark warning over the introduction of new age verification laws.
Websites, including Pornhub, that host adult content are now subject to legislation enforcing them to implement age checks to block under 18s from accessing pornographic and otherwise inappropriate content.
But while the Online Safety Act was brought in as a safety measure for minors in the UK, a cybersecurity expert warns we're setting a 'dangerous precedent' for 'mass surveillance'.
Jacob Kalvo, CEO and co-founder of Live Proxies, says that 'while the goal of protecting minors is absolutely justified, the technical and ethical implications of these methods are quite serious.'
Advert
Since the Online Safety Act came into effect at the start of July, Pornhub users now have to create an account and provide an email address, or share credit or debit card details for age verification purposes. Users also have to option to verify via a mobile number.
While some websites are now requiring users to upload ID such as passports or diving licences, as well as going through facial recognition technology, Pornhub chose the 'least invasive measures offered' by Ofcom; something which Jacob considers a wise decision when it comes to securing personal data.
"From a cybersecurity standpoint, requiring users to upload highly sensitive documents like a driver’s license or passport introduces a major attack surface. If these platforms don't use end-to-end encryption, zero-trust architecture, and strong data minimisation practices, they become lucrative targets for hackers," he told LADbible.
"We’ve already seen how poorly protected data in similar contexts, such as health or location tracking apps, can be breached and leaked on the dark web. If adult sites are hacked and ID details are stolen, the consequences for users would be catastrophic, ranging from blackmail to public shame."
When approached by LADbible, a representative for Pornhub agreed that age verification 'presents security challenges,' adding that 'the best way to mitigate both these risks and safety concerns is to require age verification at the device level'.
"We have implemented age verification solutions that are recommended by Ofcom, and we have chosen the least invasive measures offered," they said. "If you have questions about the security of the Ofcom-recommended solutions, you should please ask Ofcom."
When we approached Ofcom to raise our concerns over the data security of their age verification recommendations, we were told to speak to the Information Commissioners Office (ICO).
"Strong age checks can be done effectively, safely, and in a way that protects your privacy. Data protection in the UK is regulated and enforced by the ICO, with whom we have worked closely in developing our approach to highly effective age assurance," Ofcom said in a statement.
The ICO did not respond for comment.
Meanwhile, Jacob is calling on governments that are introducing legislation to enforce age checks to do so responsibly, urging them to consider 'privacy-first technologies like zero-knowledge proofs, by which users can demonstrate that they are over 18 without releasing identifiable information.'
He said: "If we don't change course, we risk creating a digital world in which mass surveillance becomes the new normal for the protection of children. That's a dangerous precedent.
"The security community must be involved in the design of these systems, or else the negative impact of poor implementation will negate the positive effects."
Topics: UK News, Technology, PornHub
Emma Rosemurgey