Flaws found in age verification system used by six porn sites

Serious bias problems and questionable independence found with AgeVerif

An investigation by AI Forensics, a European non-profit that investigates influential and opaque algorithms, has found evidence that an age verification system used by six porn sites to prevent access by underage users is deeply flawed.

AgeVerif is a facial recognition-based age verification system operated by Portuguese companies E-Borealis Lda and PlanetSeason Lda.

It is a minor player in the age assurance business, but nevertheless AI Forensics’ findings paint a picture of fly-by-night providers able to bend the rules to suit their interests.

AgeVerif was found to be based on an open-source model built in 2019 that was not designed for age verification or intended for commercial use

It was also made up predominantly of white faces and only 7% were photos of minors, leading to highly skewed results. For example, Black children under 12 years of age were falsely classified as adults more than three times as frequently as white children, while East Asian and Southeast Asian adults were around twice as likely as white adults to be classified as minors and denied access.

AI Forensics discovered several other anomalies, too, including the ability to bypass the system by simply adding a special cookie to the browser. These special bypass cookies were specific to certain porn sites, namely Turkif and reference-sexe, two of six sites identified that deploy AgeVerif to comply with French and European law.

Things get murkier still with the discovery that AgeVerif's operating companies share directors with Tukif and reference-sexe.

AgeVerif does not disclose how age estimation is performed on its website, only claiming it relies on "AI-powered biometric analysis". It says that no data leaves the user’s device, and the researchers found no evidence to contradict that statement. Nevertheless, the lack of transparency over ownership and operational details are a cause for concern.

The UK Information Commissioners Office (ICO) granted a data protection registration certificate to PlanetSeason Lda in July. The company also boasts certification from AgeCheck.

While many countries now mandate age assurance/verification systems to gate harmful content, in many jurisdictions, including the UK, sites are free to choose their own solution from a marketplace that is a poorly regulated.

In this case, AI Forensics found that AgeVerif failed to meet requirements for accuracy, non-discrimination, resistance to circumvention and independence between provider and platform, as required by French law, yet the six sites were still able to use it.