YouTube asks users to show IDs for age verification
Isn't there a better solution in 2020?
Isn't there a better solution in 2020?
In a recent blog, YouTube unveiled plans to ask for ID cards or credit card details if a user's age can't be verified otherwise. The content provider needs to check users' age in order to control access to adult material.
Various market players are struggling with digital verification requirements of various kinds. One is Bol.com, the online retail platform, which recently stopped selling alcohol. When Bol started alcohol sales in 2018, it did so on the basis of agreements with agents, under which delivery personnel would check recipients' age on the doorstep. However, investigations showed that checks often weren't adequate, prompting Bol to pull the plug.
In principle it should be sufficient for YouTube and Bol.com to confirm that a user is who they say they are, providing that the user can demonstrate that they're over eighteen by reference to a reliable and verifiable source. The two service providers don't need any of the other info typically on an ID card. However, with the checking methods described, that extra data will get shared. That's not ideal from a privacy perspective, and might be seen as violating the rules. It's also a curious approach to take, given the availability of privacy-friendly alternatives, such as IRMA. With the IRMA app, the user shares only the details (attributes) that are relevant.
'Data minimisation' is an important theme of the General Data Protection Regulation (GDPR). What that boils down to is that a service provider shouldn't ask a user to share their whole birth certificate or passport, but should focus on verifying the relevant facts, such as whether the user has a driving licence or is listed in the register of health care professionals. For such verification to be reliable, the service provider shouldn't rely on the user's word, but should accept only data that originates from a trusted source.
If your organisation wants to put client privacy first, or if your clients expect that kind of approach, data minimisation and attribute-based verification have major operational benefits. Those strategies will reduce the risk of data leaks, for example. For the simple reason that you can't lose what you don't have. If you ask users only for the information you actually need in order to provide your services, you don't have the added responsibility of keeping superfluous info secure.
Users who use attribute-based systems to record and manage their own data represent a new opportunity. By enabling clients to log in using IRMA, you're allowing them to share only the info that you really need. At the same time, your own operations will be improved by data validation and enhanced knowledge of your customers (KYC). The reason being that a decentralised attribute technology such as IRMA isn't an ID system, but a platform for the exchange of relevant data. No single centralised ID system can tell you, for example, that user X is who they say they are, and that they're registered with a particular local authority and authorised to transact business on behalf of a particular company. DigiD can't tell you that so-and-so is the proprietor of such-and-such a business. The Chamber of Commerce can do that, but can't confirm that your user is indeed so-and-so. And so-and-so's local authority doesn't know anything about their relationship with that company. By contrast, the IRMA app can deliver data from multiple sources, making it a potentially invaluable operational tool.
Enabling users to manage their own attributes is a game-changer. It means enhanced privacy and more 'honest' interaction with users. While you can get the assurances you need more easily, especially where multiple sources are involved. A recent news article on Emerce highlighted how easy it is for Amsterdam residents to interact with the city authority using the IRMA app, thanks to the city's pioneering adoption of IRMA technology. Amsterdam has developed several demonstration environments where only the required attributes are requested for the relevant context.
SIDN is partnered with IRMA. We're working with Privacy by Design, the non-profit foundation behind IRMA, to further develop and grow the IRMA ecosystem. For a safe and convenient online experience, where users have control over their own data and service providers have straightforward access to the user info they need. Read more about this partnership.