Lhe Superior Audiovisual Council (CSA) has ordered five pornographic sites (Tukif, Pornhub, Xhamster, Xvideos and Xnxx) to cut off their access to minors by December 28. However, if identity verification solutions exist, they raise questions in terms of data protection. One option widely used by porn sites is the use of third-party verifiers, companies specializing in identity verification.
These service providers offer different systems to check whether Internet users are over 18: scanning an identity document, estimating the user’s age by taking a selfie or analyzing information posted on social networks. To guarantee the anonymity of Internet users, the personal data collected is generally not sent to servers or stored. The cost of these service providers can represent 500 euros per year, or even more depending on the volumes processed. The sites also use credit card verification.
READ ALSOInternet pornography: the consequences for adolescents
Limited data retention
The Penal Code prohibits exposing minors to pornographic photos and videos and the law on domestic violence of July 30, 2020 specifies that the companies concerned cannot exonerate themselves from their responsibilities by simply asking an Internet user if he is major. Since the entry into force of this law, the CSA can seize the justice which can ask to the providers of access to Internet the blocking of the infringing sites.
For the National Commission for Information Technology and Freedoms (Cnil), the devices adopted by pornographic sites must in any case respect several principles such as limited and adequate use and conservation of personal data. In June, the CNIL also warned that the establishment of a verification system could not lead to a « general identification obligation » before the consultation of such a site. The verification of the age of the Internet user should not make it possible to “collect directly identifying data from their users”.
READ ALSOOnlyFans victim of state censorship
Rely on a trusted third party
For the committee: such a practice would present “significant risks” for users, since their sexual orientation – real or supposed – could be deduced from the content viewed and directly linked to their identity. The regulator therefore says it prefers « the use of devices consisting in the provision of proof of the majority of age » relying for example on a trusted third party. The latter would have to integrate a mechanism preventing the identification of the site or application at the origin of a verification request, but also from transmitting to the pornographic content service identifying data concerning the user.