French researchers find major flaws in AI age-verification software for porn

A new report by AI Forensics (AIF) has found that a legally-compliant age verification software has conflicts of interest, high error-rates, biases, and is easy to bypass.

Their research report, released this week (28 October), investigated age-verification software AgeVerif that's used by pornography platforms operating in France, finding major flaws in their system.

AIForensics, founded in 2021, is based in France and describes itself as "digital detectives who shine a light on hidden algorithmic injustices." 

AgeVerif was first registered in 2020, and uses “AI biometric analysis” to verify age,  explicitly stating it is a service that allows platforms to comply with regulations to protect minors.

The researchers found that AgeVerif could allow up to 10 percent of minors to access websites, with this error-rate partially due to only seven percent of the system's training data consisting of images of minors.  

Additionally, because of more problems with the training data, they estimated that the model would, in certain contexts, misidentify 27 percent of black minors as adult, but only 11 percent of white minors; generally finding wide differences in verification across different skin tones.

The software was also easily bypassed by pasting a bit of code into a web browser. 

Mapping the corporate side of the business, AIF also discovered that one of AgeVerif's directors is also involved with pornography companies that the software is trying to regulate. 

The EU currently sees age-verification as a solution to protect minors online. 

Under the 2023 Digital Services Act, the law requires websites operating in the EU to implement measures to protect minors and recommends "age-assurance methods," with individual member states, such as France in 2024, passing their own laws requiring age verification for adult content websites.

The issue with the French law, however, is that platforms "can rely on the age-verification provider of their choosing, without any approval or certification process. The issues identified in the implementation of AgeVerif are therefore unsurprising," said Paul Bouchaud, lead computational researcher at AIF to EUobserver. 

The researchers do point out that there are other more verified systems which inspire greater confidence, and that the EU itself is currently developing its own age-verification system with EU principles in mind; however, problems with the technology remain unresolved. 

Age-verification workarounds continue to be a constant issue; beyond the coding method, the researchers say a "VPN can bypass a simple country-specific check. Some solutions can even be bypassed by a simple ad-blocker, making their use, in practice, basically non-existent," said Bouchaud. 

Currently, the Danish EU council presidency is seeking to pass age-verification requirements across the EU as part of its proposed compromise on the Child Sexual Abuse (CSA) Regulation and Directive, which calls for technology that is privacy-preserving and non-discriminatory. 

But civil society questions about the current risks of age-verifications to user privacy, effectiveness, and discrimination — questions echoed by the researchers themselves.

With all the known flaws, "we are strongly questioning the deployment of existing 'age verification' solutions on an even broader scale," said Bouchaud.

AgeVerif was contacted for comment, but did not reply in time for publication.

Every month, hundreds of thousands of people read the journalism and opinion published by EUobserver. With your support, millions of others will as well.

If you're not already, become a supporting member today.