OTTAWA — Security and privacy researchers have warned that using age-verification technology to enforce a social media ban in Canada could do more harm than good. 

Prime Minister Mark Carney recently returned from a trip to Australia, which late last year banned children under the age of 16 from using social media sites. Asked whether he planned to adopt the idea, Carney said Canada’s online safety laws are lagging behind other countries, especially when it comes to preventing the exploitation of children. “I think this is something that merits an open and considered debate in Canada. I don’t have a settled view on it,” he said on Saturday. 

Australia’s system requires platforms, including TikTok, Instagram, Facebook and X, to prevent anyone under the age of 16 from having an account. Companies that fail to block youths risk fines of up to AUD$49.5 million ($47.3 million). A month after the policy was introduced, social media companies had deactivated 4.7 million accounts belonging to Australian youths. 

The Australian government told social media firms they can’t rely on age attestations, and urged them to employ age-verification technologies.

Privacy and security experts have warned that such technologies are unproven, which makes them risky.

“We don’t have enough evidence right now of age verification being effective, and we also don’t have enough assessment of the broader consequences that it might have,” said Nicolas Papernot, a University of Toronto professor and Canada CIFAR AI Chair at the Vector Institute, an AI research non-profit.

Papernot said he hasn’t raised the issue of age verification directly with the government since Carney was elected, but he did sign an open letter saying it would be “dangerous and socially unacceptable” to introduce access-control technology without understanding the potential implications for security, privacy and equality. 

As of March 5, 430 researchers from all over the world signed the letter, including seven from Canada.

Companies are already using several types of age-verification systems, including age-guessing AI, to prevent minors from accessing adult spaces online, but all come with inherent privacy risks, said Papernot. 

“Collecting biometrics like faces is very sensitive and could be misused. It also could be very ineffective and discriminate against minoritized populations,” he said. “There is a long history of research showing the limitations of these technologies, of facial recognition, and how it can have very disparate performance on people with different ethnicities, for instance.”

Collecting photos of government-issued identification can also go sideways, as Discord learned last year when hackers breached one of its third-party vendors, compromising 70,000 users’ IDs. 

“This is creating a precedent and goes against the principle of minimising the amount of sensitive and private information that we’re sharing,” Papernot said. 

The technology can also be thwarted with a virtual private network, or VPN to make the platform believe the user is in a country that doesn’t require age verification, as well as by other means. 

Despite such concerns, use of such systems is already widespread. In January, the online gaming platform Roblox introduced its age-verification system as a way to limit chats between adults and children. It works by making users show their faces to an AI that guesses their approximate age. It is part of the company’s latest bid to overcome allegations the platform exposes children to sexual content and predators, financial exploitation and political extremism. 

The AI facial-recognition system garnered its own criticism, though, for labelling kids and adults and vice-versa. Some kids were able to get around the rules by showing an adult’s face, or even, in the case of some particularly inventive scamps, the faces of video game characters. Wired also found instances of people selling age-verified accounts on eBay. 

Representatives from Meta told a House of Commons committee last fall that the company’s platforms use AI technology to assess users’ posts and photos to determine their approximate age as well. Users can also upload ID, Meta Canada’s director of public policy Rachel Curran told the committee, but she said the company would rather not have to collect any personal identification. 

Curran has pressed Ottawa to introduce legislation that would make Google and Apple’s app stores responsible for checking ages, rather than leaving it up to individual platforms. “When users set up their phones, Google and Apple are getting reliable information about what age someone is,” she told the committee. 

Papernot said he would like to see policy makers focus on harmful content, including the “toxic nature of these algorithms” behind social media platforms, rather than limiting access to minors. 

Government ministers have said they haven’t decided what shape the upcoming online harms legislation will take, but are expected to table a bill in Parliament this year.