David Inserra
The Australian government pulled its misinformation bill after the revised version continued to face domestic backlash and international criticism for empowering the government to police online speech. The bill would have allowed the government to censor speech based on vague, contradictory standards that would all but guarantee biased enforcement by the government of the day.
But before we give the Australian government a “good on ya,� they’ve already proposed another bill that is about as useful as an ashtray on a motorbike. Both major parties are backing a bill that would ban all users under 16 from using social media platforms. The legislation is similar to other age verification-type proposals that have been passed in some US states, several of which have been enjoined by the courts, as well as the UK’s Online Safety Act.
While such efforts are constitutionally dubious in the US, the UK and other nations like Australia do not have such robust speech protections. For example, the UK’s Online Safety Act threatens to unravel encryption and demands that online platforms either verify the age of users or otherwise sanitize their products for all users so that children do not see any harmful content. Add in the UK’s frightening increase in policing a host of speech and thought crimes, and the lack of legal protections for expression becomes obvious.
But not to be outdone, Australia’s new bill simply bans those under 16 from expressing themselves online. Australia is not only learning the wrong lessons from the UK, but it has, unfortunately, also served as an incubator for bad online speech policies that then spread around the world. Take for example their “link tax� bill which was copied in Canada and has been proposed in the US or their “E‑safety Commission,� which Canada considered copying.
So Australians, Americans, and all other “liberal� nations have good reason to be concerned about what is going on in Australia and its proposed ban on social media for youth.
The harmful consequences of the bill far outweigh the noble intentions that may animate policymakers. The problems and challenges with such proposals are well-known and can be organized into three buckets.
Privacy and Security: Any effort to determine the age of a user will require some degree of evidence. The Australian bill doesn’t require hard verification but calls for effective “age-assurance,� which includes a broader array of ways for companies to estimate or confirm a user’s age. The least invasive assurance technique is to simply use the declared age of the user, but this can be easily bypassed. To increase the effectiveness of the age-assurance, companies might instead opt for tools that attempt to estimate a user’s age based on on-platform activity. But they only work for users currently online and they generally can only estimate an age range. Similarly, there are tools that use facial recognition that can estimate the age range of users but are more invasive.
Even more invasive solutions using documents ranging from government IDs to credit cards are in theory more accurate. But in some cases they might be fooled with fake IDs or by older siblings or friends. Even putting such evasion aside, such methods still require a collection of documents and/​or biometrics from more than just teenagers, impacting the privacy and security of all online users. The point is that there is no verification system that can, with high confidence and low privacy impact, systematically assure us of the age of a user, especially for users that are right around 16 years old, without impacting adults in the process. And for the more data-intensive methods, all of these data must be gathered somewhere. Having large amounts of personal and identifying info in one place is a cybersecurity nightmare. While data minimization—the idea that the least amount of data is collected and kept— is a best practice across much of the technology space to reduce the impact of data breaches, these laws incentivize companies to keep more info on hand. When inevitably some significant number of minors get around the law to access social media, regulators will want to investigate or punish social media companies for failing to follow the law. Companies, then, will want to store significant amounts of data to prove that they did check those users. Australian policymakers know this is a real security problem and so they require social media companies to delete such information. Companies are between a rock and a hard place—ignore the data deletion provision and keep data on hand to prove they are in compliance with the age assurance provisions when regulators come knocking, or comply with the data deletion provision, but be unable to prove effective compliance with the age assurance requirements. So age assurance, for various technical and regulatory realities, will entail significant privacy and security flaws, while not providing sufficient accuracy to keep social media in compliance.
While politicians in Australia and elsewhere may want to help keep children safe online, banning wide swaths of teenagers will result in the widespread chilling of all online speech, poor data security practices, and the suppression of information and communities important to the next generation.
Rather than follow Australia down this dangerous road, policymakers around the world would be better suited to put more resources into investigating actual allegations of serious criminality online and finding ways to support, educate, and empower families and parents to decide for themselves how to best make use of new online technologies.