euCONSENT set out to prove that it is possible to make online age checks, and the process of securing parental consent for sharing personal data from younger children, simple and convenient while guaranteeing the privacy of users. Through two pilots, involving over 2,000 children and adults across five European countries, we demonstrated this was not only achievable, but was also well-received by users. We also learnt a number of other valuable lessons and made several key recommendations for EU policymakers. As the first phase of the project completes, this is a short summary of our achievements and a look forward to what happens next.
The main question we are asked is “how did the pilots go?” The answer is they far exceeded our expectations. To recap, we set up five dummy websites, representing one which sold alcohol, another one which sold knives, a social media site, a chat website and a dating service. Pilot users were then given instructions accordingly to several given scenarios, to access one of these five websites, complete an age verification process, and then visit the other two sites. These sites represented services in other countries, which used different suppliers of age verification checks, and had varying minimum ages for accessing these services.
Our primary measure of success was the completion rate, confirming how many users managed to follow our instructions and reach all of the sites we sent them to. We saw high headline figures for the first pilot when almost 81% of the participants were able to complete at least two missions and 63% managed to complete all three missions, and marginally improved on these to reach 84.25% completing the two missions set for them in the second pilot. The sites also behaved as we hoped, allowing only those users who met the age criteria to gain access. 58% of the participants rated their experience with AV positively and 22% negatively.
We did get some feedback from the users about issues they found when completing the exercise. The vast majority of these related to their user experience when on the age verification and parental consent providers’ websites. Most of these services were originally designed to check that adult users are old enough to buy age-restricted products, so tended to be written for an adult audience. This made some of them too complex for some children to navigate. There were also some people who were confused when using facial age estimation if the age the algorithms calculated was not exactly the same as their own age – this was easily fixed by no longer sharing with users the estimated age, and just confirming if they had been judged old enough or not.
We learnt that facial estimation was by far the most popular age verification option, preferred by 68% of all participants, as they found it easy, fast and less invasive compared to the other options. Credit card verification, on the other hand, was the least chosen option, selected by only 3% of the participants.
The surveys we deployed at the same time as the pilots told us that 91% of the parents believe that it is necessary to provide their consent each time their children are about to share their personal data with a website, and 74% of them would be willing or very willing to do so in real-life scenarios.
That the technology worked was not the only achievement of euCONSENT, and arguably, it was not the greatest achievement either.
- The project brought together competing suppliers.
- It established an impressive advisory board of all the relevant stakeholders – global platforms such as meta and Google; children’s charities; EU-wide trade associations and regulatory bodies. We would like to put on record our thanks to everyone who joined this Board and gave such important advice to guide our work.
- It created new international standards and defined shared levels of assurance for age checks that allow services, regulators and suppliers to specify the level of accuracy and certainty they require, and in turn this facilitates interoperability.
So, in some ways, the open-source software created to add to each supplier’s own solution to allow them to participate in the network was secondary to these other achievements. And of course, it is the part with the shortest shelf life, as technology moves fast and euCONSENT’s computer code will need to keep up.
We also identified some challenges exacerbated by existing legislation. This was particularly the case for parental consent. It is hard to find reliable data sources that confirm the relationship between an adult and a child, whether that is a natural parent, a foster carer, an adoptor or any other legal guardian. The legislation only requires this to be done to the extent it is technically possible. This creates a perverse disincentive to innovate, as if you find a way to do this, you then raise the legal bar for compliance.
Our academic research revealed the poor levels of compliance with both AV and PC legislation across the EU. This team also set exacting ethical standards by which the project would be judged. There was a lot of learning on both sides – technical and academic. In some cases, there was some disagreement, but this was always resolved once there was enough time to bring together different perspectives. We were delighted that our professors and doctors stayed the course, and concluded at the end of the project in their independent review – albeit that they were partners in the consortium but nevertheless very independent thinkers – that euCONSENT had delivered within the ethical principles agreed with them at the outset.
And what is next? The consortium agreed to create a new non-profit to take forward the project. While we could leave it to the private sector market to simply agree between themselves to exchange age checks, we want to retain the governance and ethics that euCONSENT has established. The generous funding of the European Commission has now ended, so the new organization will need to find other sources – AV providers, large platforms, research grants etc. But we hope you will agree with all those involved that it is important to keep the euCONSENT dream alive.
