Inside the face scanning tech behind social media age limits

RTÉ News​

2 days ago

As age restrictions on social media gain political momentum, biometric software is being explored as a way to effectively enforce any potential laws. However, critics warn that privacy and surveillance issues could arise if these tools become more widespread in policing the internet. So, should this technology be used to build a safer, more secure internet?
Politicians in Australia are pushing ahead with plans to ban under-16s from social media, and early findings from a government-backed trial suggest biometric software could be central to enforcing a ban.
Yoti, a London-based tech firm, is a leader in age estimation technology and participant in the Australian research. Already used by platforms like Instagram, Yoti says its software can scan faces to estimate age without storing personal data.
It says it can tell the age of 13 to 17-year-olds within an median margin of error of 1.3 years and 18 to 24-year-olds within 2.2 years.
Better, it says, than human judgment. The face scanning technology captures a live selfie and apps and websites embed the software and apply their desired age threshold.
Prime Time visited Yoti's headquarters to test the system. It correctly identified that I was over 18 but like most users I wasn't given the opportunity to find out exactly what my estimated age was, just that I had met the threshold.
Yoti CEO Robin Tombs said the software has a vast capacity to look at patterns, making it "much more accurate at estimating age than a human would be."
While the Australian government-commissioned trials backed the use of age assurance technologies, it did raise issues with the accuracy of some systems.
People tend to misunderstand what working effectively means, Mr Tombs explained, adding that an accurate estimate to within a number of months of age is "very, very hard to do."
Yoti says that 99.3% of 13 to 17-year-olds are correctly estimated as under 21.
Companies using the software often set a higher buffer age to account for the technology's limits; however this increases the risk of wrongly restricting access of some adults.
Dublin social media star Edel Lawless explained to Prime Time what happened when she failed a digital age test on TikTok. The platform requires users who want to broadcast live to verify that they are over 18.
After being directed to take a live selfie to prove her age, Ms Lawless, who was 18 at the time, told the programme she was rejected.
"I think my baby face didn't allow it. I don't think it's a very good way of estimating someone's age."
The now 19-year-old had to submit a photo of herself holding her age card before she could proceed.
Yoti contends that notwithstanding false negatives or positives in its age estimations, the vast majority of people benefit from ease of use and not having to submit documents to prove their age.
It is also very hard to game or trick the system, Mr Tombs said. The live selfie process limits the potential for AI generated images to be used while the software is also sophisticated enough to recognise if someone is wearing a mask or other disguise.
But digital rights campaigners have warned that age estimation systems can contain biases.
"It's a normalisation of biometric surveillance that we've worked against for many years," Ella Jakubowska, Head of Policy at European Digital Rights told the programme.
Biometric software has been historically trained on white, male faces.
In 2021, Facebook apologised when an AI image tool was identifying black men as non-human primates. Yoti insists the technology has improved in the last decade and the 125,000 images it bases its model on cover all ages, three skin types and both genders.
The company's own test results show that although there are differences in the age estimation between different groups "they are not material," according to Mr Tombs.
UK Digital rights group Big Brother Watch described the moves towards age assurance technologies as a knee jerk reaction to a more complex and wider discussion around internet safety and moderation. The rate of false negatives threatens free speech and free access to the internet, the group believes.
"There are many people who are above the age of 18 but may for a host of reasons not pass an age assurance test. Adults have an important right to access legal content online," Advocacy Manager, Matthew Feeney told Prime Time.
"I don't think we want to lurch into a world where the most powerful communications platform we have in the history of our species is one where you need to step through a security booth in order to access it."
Requiring a face scan or age documents for adults to access certain content, potentially of a sensitive or adult nature presents risks of surveillance, the group contends.
"We don't want to live in a world where people feel like they cannot visit information they want or say what they believe because they don't feel like they have privacy online," Mr Feeney added.
Activists have also raised concerns over how facial scans are processed and stored.
The Yoti database is derived from an earlier product, a digital ID app in which users uploaded their image and proof of age with permission for the company to build up a large, anonymous database.
It insists the selfies uploaded today are not saved and privacy is paramount. Stricter regulation is also being implemented in many jurisdictions around storing and processing personal images.
"Regulators are requiring faces to be destroyed, deleted immediately, and not used for any other purpose. I think people do trust that if a regulator requires that, it would be very risky for a big brand or Yoti to not comply with those regulations," CEO Robin Tombs said.
But even if the software is effective and properly regulated, the risk of adding age restrictions to parts of the internet could lead to a less vibrant online society and a tech environment with safeguards that may not achieve what they're intended to, according to Big Brother Watch.
"What I'm worried about is that these kinds of regulations are going to incentivize children to go into the dark web, to use encrypted web browsers, to get into places where it's actually much, much harder to moderate where they're going," Matthew Feeney explained.
"There are websites all across the world that make YouTube, Instagram look relatively tame."
Social media ban debate
Australian Prime Minister Anthony Albanese has said its world-leading legislation will protect young people from the "harms" of social media adding that the onus will be on platforms to demonstrate they are taking reasonable steps to prevent access to those under 16.
A similar law should be considered here, Tánaiste Simon Harris has said, describing smartphone use as a "ticking time bomb". The Irish Medical Organisation also debated a motion to consider such a move at its recent AGM.
But there isn't consensus on the merits or efficacy of such bans. In the UK, the Technology Secretary Peter Kyle has backed away from following the Australian path.
Campaigners argue social media platforms themselves should police their content and algorithms to be less harmful for everyone, not just children.
"It feels like a really unsophisticated solution," Ella Jakubowska of European Digital Rights told Prime Time.
"Any sledgehammer approach that tries to cut young people out of the internet is missing the point that there's a lot we need to do to keep all people safe from platforms.
Imposing age gates on internet access will disempower both adults and children, she argued.
"All the evidence shows that young people are the most resilient and the most able to deal with online harms when they have a parent or guardian or other adult figure that they can confide in that helps them navigate the internet safely and in ways that build resilience, not just shutting them out," Ms Jakubowska said.
Distinct from any potential social media ban, next month the first age assurance regulations will come into force in Ireland requiring video sharing platforms that allow pornographic or gratuitously violent content to have "effective" age assurance. Self-declaration by users will not be accepted.
However, as most social media companies that are based here already prohibit such content and most adult sites are based outside of the country, users are unlikely to see a significant impact in the short term.
Europe, meanwhile, is moving towards more harmonised age assurance standards with some countries like Germany and France already requiring stricter age verification. The Commission has recently recommended that the highest form of age assurance – age verification with documentation – is necessary in certain cases such as alcohol, pornographic content, or gambling.
A digital identity wallet is being developed to let users verify their age without directly sharing personal information with online platforms. The plan is for identity documents to be securely stored in an EU-wide app.
The large tech companies are also steeling themselves for a battle over how future age assurance requirements are enforced.
Social media platforms have argued that such verification should be done at the app-store or operating system level, rather than by each individual app.
Digital rights campaigners remain concerned about the use of facial scanning generally. Oppressive States have historically exploited data putting campaigners and members of marginalised groups, among others, at risk, Ella Jakubowska said.
"I'm aware that we can sometimes sound as if we're being a bit cynical or doomsdayish but it's legitimate to be aware of the potential of creating mass surveillance systems," Ms Jakubowska said.
Beyond social media
Regulators are also now grappling with broader questions around AI and what decisions it should be allowed to make. Should AI be permitted to decide who gets a job or a bank loan? Or what about who is served in a retail store?
Ireland's largest shop-fitting company expects new age estimation screens to be in stores within months. At the showroom of Mercury Retail Services, MD Garry Doyle explained how vape stores are among the potential clients of the new technology.
"With the growth of age-restricted sales it's really important that a retailer is able to give their staff the tools they need to be able to make the decisions at the till," Mr Doyle explained.
A tablet screen is positioned facing customers to scan their face and indicate if they meet a set age threshold. When I tested the system, it accurately verified that I was over 21, confirming this with a green light after scanning my face.
It gives business owners a tool to show they are taking their responsibilities seriously, Mr Doyle said.
"It's not saying you can't serve this customer. It's helping the retailer make an informed decision of whether they need to ask for identification."
Contending that Ireland is a long way away from a purely autonomous 24-hour store, Mr Doyle added: "I don't think you'll ever get to a situation whereby you are replacing shop staff with AI because retail in Ireland is about the experience and relationships that retailers have with their customers."
As biometric age estimation technologies become increasingly integrated into online platforms and everyday interactions, governments and regulators will be tasked with navigating a complex and delicate balance - ensuring that measures designed to protect vulnerable users, particularly children, do not come at the expense of individual privacy, civil liberties, and digital freedom.