YNOT Magazine by YNOT

CONTENTS

Age Verification: Coming Soon to an Adult Industry Near You? Gene Zorkin

UK Delays Age-Verification, May Extend Measure to Social Media Gene Zorkin

What Say You, AgeID – Pornhub’s InHouse Age Verification Tool?

Amber Gold

Is Age Verification Coming for US Porn Sites? Experts Weigh In

Gene Zorkin

Age Verification without Friction: AgeChecked’s CEO Describes Seamless Goals

Amber Gold

Should the Adult Industry Voluntarily Adopt Age Verification? Has It Already?

Gene Zorkin

Age Verification: It’s Cam-Relevant, Too

Amber Gold

PAGE

Featured Article

Age Verification: Coming Soon to an Adult Industry Near You? By Gene Zorkin While it’s probably safe to say adult entertainment products and the industry which produces them have never enjoyed greater social acceptance than they do now, this does not mean attempts to regulate their distribution more strictly have gone away. Within the United States, dating back to the late ’90s, there have been attempts to impose some manner of meaningful age-verification process on adult websites. And in many countries where there is nothing akin to the First Amendment, barriers to accessing porn have long been in place, although their efficacy is often called into question in the age of Virtual Private Networks and other means of getting around government-imposed access restrictions. One of the age verification efforts getting the most attention right now is the one pending in the U.K., where officials

say it’s “anticipated age verification will be enforceable by the end of” 2018. (Editor’s Note: More recently officials announced a slight delay to the enforcement schedule, which we get into later in this issue.) The age verification requirement was established under the Digital Economy Act of 2017 (“DEA”), the third part of which is dedicated entirely to online pornography. What the DEA did not do was define how the age verification it mandates is to work, leaving the details to be determined by the British Board of Film Classification (BBFC) – which wasn’t declared the regulatory agency responsible for overseeing the age verification component of the DEA until February of 2018, almost a year after the Act received Royal Assent. Watching the somewhat chaotic rollout of the DEA’s age

verification requirement across the pond, American adult entrepreneurs might reasonably wonder whether a similar system could be imposed in the U.S., despite past failures like the Child Online Protection Act and the Internet Safety and Child Protection Act of 2005. Beyond the possibility of government-imposed age verification requirements, there’s also the possibility of private sector policies pushing adult merchants into the position of having to adopt age verification measures to remain in compliance with possible future rules and policies established by entities like banks, billing companies, ISPs and social networking platforms. Age Verification: Issues and Debates Impacting Porn Today In this fourth issue of YNOT Magazine we examine the topic of age verification from multiple perspectives. We’ll look at whether government-imposed age verification requirements are feasible, given the current state of First Amendment case law. At the same time, we’ll explore arguments that the industry might be well-served to embrace age verification proactively and voluntarily. We’ll talk to industry leaders in the age verification space about their systems and technologies and the cost of using them – and about what they anticipate the eventual rules of the road will be in the U.K.’s age verification regime. YNOT will also look at how age verification has impacted other industry sectors which are already subject to such requirements, with a focus on other “vice” products which are age-restricted, and the burden on smaller companies presented by the costs of implementing age verification systems.

Whether one sees age verification as a necessary prophylactic against the exposure of minors to pornography, a troublesome invasion of privacy and potential security risk, or somewhere in between, the debate over its necessity and efficacy isn’t going away any time soon. Several legislatures across the U.S. have declared pornography a public health crisis (or something similar) and many others are considering doing the same, creating a momentum to push back against the greater social acceptance porn and the porn industry have attained in recent years. Some of these same legislatures have debated passing the Human Trafficking and Child Exploitation Prevention Act, a frankly bizarre proposal which would require vendors of internet-connected devices to preinstall content filters which prevent the devices from displaying “obscene” content. Even if these legislative efforts don’t amount to much in terms of direct regulation, they contribute to the narrative that “something must be done” to prevent minors from accessing online porn. In such an environment, some activists, politicians and parents likely will continue to push for age verification to be established, one way or another, until they either get what they want, or have exhausted all their options in working toward the goal. All these factors add up to make age verification an area on which adult businesses are wise to keep a wary eye. With our focus on the subject, YNOT aims to do its part in making sure you’re up to date – and aware of what may be coming next.

About the Author Gene Zorkin has been covering legal and political issues for various adult publications (and under a variety of different pen names) since 2002.

Interviews

UK Delays Age-Verification, May Extend Measure to Social Media By Amber Gold Appearing before the UK Parliament’s Science and Technology Select Committee Tuesday, Margot James, the Minister of State for the Department for Digital, Culture, Media and Sport, announced that age-verification measures which had been due to come into force by the end of 2018 will be delayed until April of next year. Originally, the system was slated to begin operating last April, meaning that if the government sticks to its new schedule, the rules will come into force a full year after the initial deadline.

“We can expect it to be in force by Easter of next year and I make that timetable through the knowledge we have laid the necessary secondary legislation before parliament,” James said. “I am hopeful of getting a slot to debate it before the end of the year.” James said the April date reflects a planned delay in implementation of the rules, once they have been finalized, to give those websites subject to them some extra time to come into compliance.

“We have always said that we will permit the industry three months of getting up to speed with the practicalities and delivering the age verification that they will be required by law to deliver,” James said. “We have also had to establish with the British Board for Film Classification (BBFC), which has become the regulator, and they have had to consult on the methods of age verification.” Along with relating the new time frame for implementation of the rules, James confirmed the UK government is looking at extending the age-verification requirement to cover social media platforms, as well. Under questioning from MPs about why the ageverification system didn’t apply to social media, James said this fact was “a weakness” in the current legislation, adding that the government was keeping an eye on the level of adult content published to social media. “We have decided to start with the commercial operations while we bring in the age verification techniques that haven’t been widely used to date,” James said. “We will keep a watching brief on how effective those age verification techniques turn out to be with the commercial (adult content) providers. We will also keep a close eye on how social media platforms develop in terms of the extent of pornographic material on those platforms, particularly if they are platforms that appeal to children.”

Margot James, the Minister of State for the Department for Digital, Culture, Media and Sport

“Our priority is to make the internet safer for children and this is best achieved by taking time to get the implementation of this important law right,” said a spokesman for the Department for Digital, Culture, Media and Sport in a statement issued following James’ testimony at the select committee hearing. “We hope to have the legislation in place by the end of the year, subject to Parliamentary proceedings. The powers will then come into force following a three-month implementation period.” Last month, the BBFC unveiled AgeVerificationRegulator. com, which provides information on the coming ageverification requirements, but as the documents available on the site reveal, a great many details of the system remain to be determined.

About the Author Gene Zorkin has been covering legal and political issues for various adult publications (and under a variety of different pen names) since 2002.

Interviews

What Say You, AgeID – Pornhub’s In-House Age Verification Tool? By Amber Gold

In March of this year, Engadget posited that Pornhub could become the de facto age verification gatekeeper for adult content in the U.K. via its age verification tool, AgeID. Per Engadget, AgeID asks people to create an encrypted login that verifies their age across compatible sites, saving them from having to prove they’re of-age every time they want to view adult content. The system will draw on third-party age verification companies, but Mindgeek (which owns Pornhub, which obvs draws the lion’s share of porn-seeking traffic on the interwebs today) promises that AgeID won’t store any personal info. It’ll only keep “standard technical data” to prevent fraud, as well as the protected login. There are real questions to consider here, and Engadget raised the obvious: If there aren’t viable age verification

alternatives, Mindgeek and its brands may effectively determine how the U.K. and other nation states check ages. What mainstream news sources may not know though is that there are several age verification options unrolling onto the marketplace, including AgeID. Earlier this year YNOT checked in with representatives from the three major existing service providers — AVSecure, AgeChecked and AgeID. Here’s what James Clark, a spokesperson for AgeID, told us via email through a member of the organization’s press team. YNOT: What are some specific age verification actions and initiatives that your company is implementing? James Clark: “Customers will always follow the path of least resistance.” A simple statement, but a vitally

important one. Age verification will undoubtedly affect one of the adult industry’s most critical components – traffic. Without traffic, there’s no conversion, no advertising sales, no revenue. Throughout AgeID’s development over the last two years, we have kept this at the center of our thinking. We anticipate verifying over 25 million U.K. adults within the first few days of launch, achieved in part due to our huge reach and site install base. This ensures that AgeID will very quickly become one of the most used age verification platforms in the U.K. for adult content. More importantly, sites which use AgeID will benefit greatly from the verified adult traffic levels it provides.

to spend time and money integrating an age verification product, so we re-evaluated our integration process and have recently been developing some incredibly fast ways for merchants to add AgeID to their sites with just a few clicks. These methods are still undergoing some internal testing but will be live later this quarter. In terms of payment, we took the decision very early on not to pass the cost onto the customer, so we are completely free to end-users. We are also free to independent merchants based in the U.K. as they will be feeling the pressure of age verification more than many and we wanted to give them a leg up. In order to maintain a robust, long-term age verification platform and offer our wide-range of age verification options, AgeID charges a license fee to sites based outside the U.K. This fee varies depending on the size of the site. We have to make it affordable for all, with lighter users paying less. We consider this a fair approach and are not seeking to make money with AgeID, just to cover our costs. Our goal is traffic flow and retention of existing revenue. How are these services being promoted?

Our install base is only half the story. In order to get as many adults into AgeID as possible, we have to make the process fast and simple: Register > Choose a method > Verify once > browse any AgeID site without re-logging in. It sounds simple, but optimizing that flow has been a constant evolution. Registration has to be fast, yet protect privacy and support anti-fraud. Our age verification methods must be broad, and we cannot leave any adult unable to verify their age. We therefore evaluated every age verification method on the market, worked with our partners to innovate new methods and considered customers switching devices or browsers, as well as turning on incognito mode, upgrading their phone, attempting fraudulent verifications, wishing to use login on shared devices — and that’s before we even moved on to designing the frontend and addressing the huge topic of privacy. The amount of development hours that have gone into AgeID — with multiple engineers across multiple offices — is huge, and we’ve still got plenty more features and polish to come. What does it take to implement these services – and who’s paying? AgeID keeps it all simple — simple for the user, and simple for the merchant. We understand that site owners don’t want

AgeID will be used by the largest adult sites in the U.K. such as Pornhub, which guarantees extremely high awareness, usage and adoption. Once a user has verified their age, likely on a large tube site, if they visit any other adult site with AgeID, they simply get straight in the door just as they would now. We are sponsoring multiple industry events both in the U.K. and abroad and advertising in trade press. AgeID is already the most talked about age verification platform for the adult industry, but it’s vital that all adult sites are made aware of age verification and the consequences of non-compliance. We also expect the regulator and the government to run their own messaging campaigns to fully prepare the public for what is expected to be one of the largest changes to the internet in the democratic world. How do you confirm age when you can’t really confirm identity? A great question. This isn’t simply a case of clicking “Yes, I am over 18.” — There has to be a robust age check using methodology approved by the U.K. regulator. AgeID simply has to know whether the person accessing age-restricted content is over 18. We neither need nor wish to know their identity. We therefore took the decision very early on to use 3rdparties to age verify our users. A user chooses their preferred verification method from within AgeID, then leaves AgeID completely to input their information into their chosen, approved third party site. This ensures that AgeID cannot even see, let alone store, any data entered during the age verification process. The third-party then simply reports back a pass/fail flag to AgeID. No date of

birth, no name — nothing more than over/under 18. Since the law passed back in April 2017, many methods from various age verification providers have been put forward, with more entering the market even now. AgeID uses a wide range of multiple third-party age verification methods, all from many different companies. We do not want to rely on one supplier, one server or one method that could break and bring down the system.

Even with all that in place, there is certainly still the issue of consumer apprehension. How do you convince consumers that all this is safe and secure? When a customer first creates an AgeID account, they provide an email address and password which is encrypted so that it cannot be reverse engineered and exposed in the highly unlikely event of a data breach… We are hugely mindful of public trust, and will shortly be releasing further information in this area.

AgeID gives real choice to the user and contains backup methods from different providers in case servers are flooded. Currently the guidance from the regulator has not been finalized, but they are expected to allow methods such as Mobile SMS, Credit Card, Passport, Driving License, plus several others we are keeping under AgeID’s hood for the time being.

About the Author Born and raised in the San Fernando Valley, the adult industry has always been a presence in Amber Gold’s life. At an early age, she became acutely aware that narratives often take shocking creative license when she noted there was no way Daniel LaRusso could’ve made it to the beach from Reseda (and back again) so quickly. She’s been seeking out various forms of truths ever since.

2018 YNOT Cam Awards Red Carpet

The First YNOT Cam Awards in Hollywood

Viewpoints

Is Age Verification Coming for US Porn Sites? Experts Weigh In By Gene Zorkin With the proliferation of state legislatures passing resolutions terming pornography a “public health crisis” (or something similar) and many states considering some version of the so-called “Human Trafficking Prevention Act,” it’s clear that however much the public’s acceptance and tolerance of pornography may have grown in recent years, it remains a popular political football for legislators to kick around. Some of these legislators doubtlessly are casting an envious glance across the pond to the United Kingdom, which is poised to enact age verification requirements for sites which distribute sexually explicit content and looking for some means by which the U.S. can impose the same sort of measure, domestically. This mix of political circumstances raises an important, fundamental question: Can the U.S. Congress pass a law mandating online age verification of users who visit adult sites which would survive court scrutiny? According to both case law in this area and legal experts interviewed by YNOT, the short answer appears to be no.

“Imposing age verification requirements on adults restricts access to protected speech, and results in constitutional concerns,” said attorney Larry Walters – who, among other things, is part of the legal team currently challenging the constitutionality of the (FOSTA) on behalf of the Woodhull Freedom Foundation and other plaintiffs. “Like the other state and federal age verification laws that have been struck down by the courts, it is expected that any new bill would use definitions that are overbroad.” The problem of overbreadth is part of what doomed a previous attempt to regulate sexually-explicit expression online, when the courts shot down the Child Online Protection Act (“COPA”). In a decision issued in March 2007, U.S. District Judge Lowell A. Reed, Jr. concluded that “under COPA, the terms ‘commercial purposes’ and ‘engaged in the business’ are defined very broadly and include within their reach Web sites which only receive revenue from advertising or which generate profit for their owners only indirectly” – a

conclusion which spoke to the law’s likelihood of implicating speech which falls well outside the realm of commercially produced pornography. In a stinging footnote in the same decision, Reed eviscerated the government’s contention that COPA targeted only commercial speech – and highlighted what he appeared to think was a meaningless dodge in the first place. “Defendant’s contention that COPA regulates only commercial speech and, thus, should be analyzed under the less exacting standard for such speech is utterly meritless,” Reed wrote. “If accepting advertising or selling subscriptions transformed speech into commercial speech, the First Amendment protections afforded to many modes of communication, including print, would be completely destroyed.” This is significant, in part because if Congress were to pass a law mandating online age verification, defining the scope of the law would be crucial to defending it against an inevitable legal challenge. As Walters noted, the term “pornographic websites” is “difficult to constitutionally define in a way that does not result in a chilling effect on protected speech.”

“Terms like ‘erotic’ are extremely broad and could include a wide variety of material that is legal for minors to access,” Walters said. “It is impossible to determine in advance what content might arouse sexual interest or excitement in particular viewers. The overbreadth of terms like this violates the First Amendment, in my view. Moreover, there is a due process concern with vague definitions, which results in self-censorship and erring on the side of caution.” Attorney Marc Randazza, who often handles cases which involve online speech many find to be objectionable, said the challenge of online age verification runs deeper than the law, even if it were possible to craft a statute which could survive strict scrutiny. Asked how it was possible to confirm a user’s age in an environment which makes it nigh impossible to even definitively determine his or her identity, Randazza answered flatly: “You can’t and you don’t.” “Technologically, I don’t see how you can do it, and legally, I don’t see how it can be imposed by law and be constitutional,” Randazza added. Beyond the technological challenge of coming up with an effective age verification system, adopting and employing any such solution would likely add a financial burden for companies and individuals who publish sexually-explicit speech on the internet. This burden would introduce another constitutional hurdle – and again duplicate one of the legal vulnerabilities of COPA cited by the court when it struck down the law. “Requiring the use of a payment card to enter a Web site would impose a significant economic cost on Web site owners,” Reed wrote in his decision. “In addition to set-up fees and administrative fees, website owners would also need to pay fees for processing payment card information for each transaction.”

First Amendment Attorney Larry Walters

Reed also noted that financial institutions “will not process or verify a payment card in the absence of a financial

transaction,” rendering the idea of having free sites accept credit cards as a measure of age verification problematic, to say the least. “Express policies of the payment card associations prohibit online merchants who sell content from processing transactions in the amount of zero dollars,” Reed wrote. “Verification by payment card will therefore be practically unfeasible for all of the plaintiffs and most other Web site operators and content providers covered by COPA who distribute their content for free.” Theoretically, if age verification services could be offered free of cost to consumers and publishers alike, would this aid the government’s constitutional defense of the law? “A decreased financial burden might be considered by the courts in evaluating whether the bill used the least restrictive means to serve a compelling governmental interest (as is required by the strict scrutiny test),” Walters said. “However, it would not be enough to justify mandatory age verification by all adults seeking to access erotic material.” In other words, to the extent a truly free-of-charge age verification system would help the government’s case in the context of the “least restrictive means” analysis, this alone likely wouldn’t come close to overcoming the other constitutional defects in such a law.

Randazza noted that even if an age verification law could be constructed to survive a legal challenge, it would create a bizarre circumstance with respect to other laws pertaining to sex and minors. “The age of consent in many states is lower than 18,” Randazza observed. “So, we’re going to have a situation in which it’s legal for a kid to fuck, but not to acquire images of people fucking? How does that make sense?” Maybe someday, technology will emerge which enables website operators to reliably determine the age of those who visit the site. And perhaps changes in case law (or, far less likely, an amendment to the Constitution itself) will someday create a legal playing field in the U.S. which is more favorable to imposing an age verification system along the lines of what is now pending in the U.K. That day is not today, however. For the time being, it appears highly unlikely age verification can be imposed on American website operators and users as a matter of law. But what of the notion of the adult industry embracing such a system voluntarily? Are there sound arguments for doing so, rooted in public relations and perception, if nothing else? These and other questions will be examined elsewhere in this issue of YNOT Magazine.

About the Author Gene Zorkin has been covering legal and political issues for various adult publications (and under a variety of different pen names) since 2002.

Interviews

Age Verification without Friction: AgeChecked’s CEO Describes Seamless Goals By Amber Gold For Alastair Graham, the CEO of AgeChecked, age verification happened by accident.

CEO of AgeChecked, told us via Skype audio interview. (Transcription edited for length and clarity.)

“[Approximately three years ago,] I saw my young nephew watching something on YouTube that was clearly not appropriate for someone of his age,” Graham explained. “It started me off thinking How could I have prevented that situation? and ended up becoming a business for me.”

YNOT: Can you describe the services AgeChecked provides?

As part of this issue’s in-depth exploration of age verification, we corresponded with representatives from the three major existing service providers — AVSecure, AgeChecked and AgeID. Here’s what Alastair Graham, the

Alastair Graham: We provide a range of age verification services that cover requirements across a number of sectors. In the U.K. and in other countries, there are many different categories of age restricted products and services that have rules and regulations that restrict access for children. The regulations are quite varied, yet our services give the website operator the ability to understand the

person they’re doing business with is of a right age for them to be buying a particular product or service. You mentioned “other countries,” but it seems like everyone is very focused on the U.K. – why? That’s a really good question. The U.K. is leading the way, to a certain extent, in age verification because the government decided to tackle the adult content industry for the whole internet. This is a difference in approach from other countries that have tried to introduce age verification where they’ve primarily just been looking at content providers within their own territory. What makes this different in terms of scale and ambition is that the U.K. decided they don’t mind where the content is coming from, they want to make sure there’s age verification in the U.K. on all of those sites. They’re being ambitious because they’re taking on an issue that hasn’t yet been solved on the internet, so there’s a lot eyes on how the government is taking this on. A lot of interested parties are watching from the sidelines to see the solutions that the U.K. is going to bring in and see how well they succeed. Depending on how well it goes, there’ll be either copying or taking their own particular versions and then running with it themselves. But it very much does seem that the U.K., at the moment at least, is at the forefront of this. How are age verification services in this context implemented? Well, the actual implementation can be very straightforward. We can provide a merchant with simple plugins that

would fit certain CMS builds, or we can provide APIs. We have a modular system, so depending on the complexity and capability of the operator, we allow them to use our services in a number of ways that best suits the customer flow that they want. Ideally, we’re providing the most frictionless type of age verification possible each time a customer visits a site. We are acutely aware, especially in the adult industry, that measures that cause the website user to pause, to think, to enter information are not good for the customer flow. So, we look always look to minimize actual requests for information. We don’t want somebody having to go through age verification many times. We don’t want them to go from one site to another site to another site and still have to do age verification. So, core behind our services for the adult industry is the ability to log in once and use that age verified login many times — to seamlessly go from site to site without any sort of further intervention. So then, the only main roadblock would be if a consumer is age verified within one service provider’s system but not in others? Yes and no. There’s a group of us — age verification providers — that have been talking about the ability to take each other’s credentials. So, one of the comments that came back very clearly from the industry last year was, “Why can you guys not be working together?” There are technical and commercial challenges, but there’s a number of us out there that have basically been tackling [this issue]. We have agreements in place so that you could use another competitor’s login to log in to sites

measures aren’t about 100 percent accuracy. This is about fixing 80 percent of the issue in a sensible manner. It’s about protecting young children rather than smart sixteen-year-olds.

such as ours, and vice versa — we would accept somebody else’s login. Who pays for this service, and what are the costs? This service is paid for by the website operators. Cost is largely dependent on the amount of volume, the amount of traffic, the amount of server load. So, there’s not a set fee, there’s a scaling cost. What I can say that’s worth noting is that the costs of using age verification solutions have dramatically come down from the initial prices that were discussed in the industry three years ago when we were all thinking about the old style of [verifications]. The technologies that we’ve developed are largely the reason behind this. The cost of age verification should not be a challenge to a business model at all. In your view, what’s the core purpose behind age verification? The core of the legislation, the goal of it, is to prevent young children from accidentally stumbling across adult content. This is not an anti-porn measure. Somebody who’s sixteen, who actively is looking to get to adult content, is out of scope. You may ask, “What if I’m sixteen and I steal my father’s details and try to get around it this way?,” but the question is addressing something we have not been asked to fix. It is not the role that age verification providers should take. If we were to take it, we’d all have extremely difficult clunky systems to put on websites and nobody would use them. Instead, it’s a risk-based approach. It’s light touch. These

How are you marketing this to the public? As an industry, most of the industry providers in the U.K. have come together to create an organization – the Age Verification Providers Association — where, collectively, we can talk about this in a positive way that’s not biased to any particular solution. We talk about the advantages of what we’re doing, how we’re doing it, how we’re protecting people’s data, etc. What we are also doing is demanding that, as soon as possible, the British regulator or the associated ministry can get behind a public education program to get the message out. It’s sometimes a little frustrating, the speed that these things work at, when as an industry we’re ready and the adult industry [itself is] ready. We seem to be waiting for the regulator to get the story out to the British public and press the green button. Certainly more can be done, but this is a case of holding fire until everything is lined up. I’m very much looking forward to the day when we get support from the actual organizations that are responsible for governing this, and they start explaining these measures to the public. There are some serious issues that need to be understood. We are asking people to trust organizations that might be completely new to them, to take them through verification and look after their data and behave responsibly. The public still needs to know what age verification is all about.