Transcript: Growing up digital: the age of verification

00:00 Dave: Welcome to the AP+ Point of View podcast where we explore the theme of trust from a number of different angles. Today we'll be exploring the social media ban for under 16s and the role that digital identity can play in that. And today I'm joined by two esteemed speakers, Tony Allen and Kieran Donovan. Tony is the founder and CEO of UK Age Verification Scheme, which provide independent testing and certification for online and offline age and identity. Welcome Tony. 

00:35 Tony: Hello. 

00:36 Dave: And Kieran is the CEO and founder of KID, which uses age assurance to create safer online experiences for kids. So, welcome Kieran.

00:45 Kieran: Yeah, great to be here!

00:46 Dave: Really great to have you both on the podcast today. So, I'll start with a question for both of you and maybe to you first, Tony. So, what does trust mean to you personally?

00:55 Tony: I think people build trust and confidence and safety in just their experience they have online and so it's important that you maintain that. It's a bit like building a brand, building a reputation. If you build a brand, build that reputation around trust and safety and confidence, you build that that buy-in from your customers. You treat your customers with that huge amount of respect for them trusting you with what you're doing with their data.

01:28 Dave: Yep, great. And for you, Kieran?

01:31 Kieran: For me, trust in the online environment is no different to the real world. When I drop my kids off at school, when I drop them off at sport, when I let them wander off on their bike down the road, do I trust that they'll be okay? And if the answer to that in the online environment, whatever platform or service they're accessing is yes, then to Tony's point, that trust has been earned with me as a parent.

01:54 Dave: Yeah, so just maybe on that thing, I'm a parent myself and like you say, kind of verifying under 16s is really important. So maybe just expand a bit on that. Why is age verification important, especially in the online context?

02:10 Kieran: Yeah, absolutely. I mean, we kind of look at it in reverse, which is ultimately what is the platform designed to do? What is the experience designed to be for the particular user? And then working backwards to how do you adjust that experience in a way that makes sense for someone who's 11 versus someone who's 15 versus someone who might be 25 or 40? 

02:32 And so what age verification does is it helps you know with confidence how old that user is coming in so that you can then adjust the experience accordingly. Most of what we do or everything we do is around inclusivity. How do we make the experience inclusive for kids? How do we make it an empowered experience for kids?

02:52 So to me, verification is very much about how does it enable and unlock that empowerment? Versus, you know, other use cases which might be about how do we make sure that things are perhaps inaccessible? Or protective of kids or teens in a different way. 

03:10 Dave: Yeah, what about you, Tony? What's your thoughts?

03:13 Tony: Yeah, age verification is, you have to say, it's nothing new. I mean, we've had age restrictions on alcohol and tobacco for over 100 years. And even when you come to the online world, we've had age restrictions on online gambling and purchasing weapons for since the internet came around. I think what's become quite new is the role of age assurance, age verification. 

03:36 I think even only about, not more than about 10 years ago, age verification was still largely done by taking a picture of your driving license, your passport and emailing it off somewhere. And someone was looking at it and going, yeah, that looks like a driving license or a passport. No idea whether it was yours, no idea what it relates to.

03:54 That was how age verification was done. In the last 10 years or so, we have seen a boom in highly privacy-preserving, so you're not risking your data as much and much more technologically advanced approaches to age assurance that don't necessarily mean you to go and dig out your passport from the cupboard under the stairs.

04:17 Dave: So, a question for you, Tony. In a world first, the Australian government is looking to ban social media for children under the age of 16. So, can you explain what's happening today with the initiative?

04:29 Tony: So, we're responsible for the age assurance technology trial, which has been commissioned by the Australian government to explore whether or not there are technologies out there that will work. The age assurance trial is not just about age verification. It's about the three types of age assurance, which are age verification, where you go and find someone's date of birth, wherever that might be held. And from that, you can calculate how old they are. Age estimation, where you look at features of humans that vary with age. So, face, voice, hand geometry, size of ears. 

05:00 There's all sorts of things that vary with age. And then the third one is age inference, which is where you establish any other fact, which isn't a date of birth. But from that, it's reasonable to infer something about their age. So, they're in year nine at school, or they've got a mortgage, or they have a credit card, or whatever that fact may well be. And we also look at the combinations of those, something called successive validation. 

05:26 0But we've also been asked to look at something which Karen was talking about, which is the concept of parental control and parental consent. And parental control is where you effectively set some things in advance, some signals to be picked up by the gaming platform or the social media platform. And parental consent is how you might deal with an age assurance result, which indicates that the person is actually under the age limit, whatever that age limit is. And then you effectively might seek the consent of a parent or guardian for them to be able to continue. So, that whole range of stuff are part of the trial.

06:00 Dave: Yeah, I mean, you talked about looking at technology as part of this for age verification. What role could digital identity play in that kind of verification and that technology?

06:08 Tony: Well, there's a couple of things I would say, first of all. So one thing to bear in mind is that identity assurance is very different to age assurance. They are two different things. They start from different places. Identity assurance is, I am Tony, and here's my evidence. Age assurance is, I'm over 21. or I'm over 13, or I'm under 65, or whatever the age gets.

06:33 And for that, you don't need to know who I am. And what we're seeing emerging, whether it's through the mobile driving licenses, or if it's through the further development of government IDs, digital IDs and digital wallets, is the concept of verified credentials, of being able to selectively share just a verified credential. At the moment, mobile driving licenses, it shares the whole lot about your driving record, your name, your address, what types of vehicle you're allowed to drive, the whole lot. 

07:04 The new part seven, when it lands, enables you to be able to do selective sharing, and it also enables you to be able to do derived credentials and that is where you've got your date of birth on your driving license, and you could derive a credential to say that I am over 18. And then you're just sharing a limited piece of information. So actually, the role of digital identity is about anchoring the proof of those verified credentials. It's not necessarily about sharing your identity or what you're doing, and that can be really, really important.

07:39 Dave: Yeah. I mean, you touched a bit on government, and government has its own form of digital ID, but there are other forms of digital ID, such as Australian Payments Plus, ConnectID, which is also available. Why is it also important to have not just government, but private sector ID solutions in market as well?

08:01 Tony: I think it's important to have choice available so people can select where they want to go to. And some people are more trusting of their bank than they are of their government, and some people are more trusting of Google or Apple in the wallets that you use every day for payments and that sort of thing. And some people want to do this in an entirely different way, and so providing that trust and choice is quite important.

08:27 Dave: Kieran, anything from your perspective?

08:28 Kieran :Yeah, I mean, I would add that what we see a lot of is the fact that we often deal with users who don't have any proof of identity, don't have something that enables them to sort of share that. And so in those circumstances, technologies that allow you to share that age signal or a what segment of the population you fall into, maybe you're a digital youth or a digital minor. That's the only piece of information that the platform needs to know about you. 

08:57 It doesn't need to know that you're 11. It doesn't need to know that you're 15. It just needs to know that you're, for example, above the age of digital consent. That's a lot of what we come into contact with. And I'd say an extension of that is there are a whole variety of use cases that you come across with online platforms where there's a balancing exercise. So one example is chargebacks. 

09:17 Dave: Yeah. 

09:17 Kieran: So, classic example is kid runs up a ton of credit card charges. Parent says, I had no idea about this. And then they ask for the thousand pounds, a thousand dollars back from the particular platform. And the platform goes back and looks at it, and so actually the parent consented to this. They attach their credit card. They did all these sorts of things. 

09:37 And so there's inevitably a balancing exercise that you want to do in terms of how do I know who the child is? How do I know who the parent is? And how do I know that the decisions that are being made on the platform, because I don't know necessarily whether it's the child or the parent, how do I know that those decisions are actually coming from someone who's authorized to make them, whether it be payments, whether it be opening up certain features, accessing chat, being able to add friends, all those sorts of things are things where you want, where you typically want to know that a parent's involved in those decisions. 

10:11 Dave: So Tony, I'm interested, we talked a lot about Australia, but maybe you're obviously from the UK. What's some of the things that are happening around digital ID in the UK and in Europe? Maybe just talk to a few things.

10:23 Tony: Yeah, there's lots going on with digital ID all over the world, isn't there? And there's various different approaches to it. So you have a few countries that are operating, like Australia, like the UK, like New Zealand, that kind of trust framework concept whereby the government is setting like kind of the basic guide rails for stuff. And then and then leaving it to the marketplace. 

10:50 And then you've got others like the European Union, which is going down quite a centralized directive-based approach with personal IDs and basically government issued. I think the really interesting bit of debate there is going on with Digital ID at the moment is the extent to which Digital ID is a utility that ought to be state-sponsored or ought to be taxpayer funded.

11:15 Dave: And Kieran, you obviously have a business in ID and I'd be interested in your views in kind of how you think about innovation versus government and maybe just expand a bit about what's happening through Asia.

11:29 Kieran: Yeah, absolutely. I mean, Singapore is a great use case. We have a great test case because it was one of the earliest countries to push for digital identity. SingPass has existed in some form or another in its modern sort of iteration for about six years. It has 97% penetration. And as a user of it, I can tell you it's the easiest thing in the world to use. Within three seconds, I can share exactly the specific item of information that I need to share with a particular platform.

11:57 So, you know, having experienced the state-sponsored model executed right, it can be from a user experience perspective incredibly advantageous. What I would say is that you know, we're also a business who integrates with digital identity. So, we integrate with SingPass, we integrate with other providers. I think there are advantages to both approaches and I think choice is exactly where it makes sense because we certainly see the opportunity to innovate and innovate quickly with a lot of the private identity providers that we work with. 

12:33 What I will say is that what we're seeing in places like India and Indonesia is really interesting because that's where you see governments working toward the outcome, which is what does an age-appropriate experience look like and then reverse engineering what a verification scheme could look like. And in some cases we saw that in Greece. We're seeing it in India. They're trending toward the government's going to mandate a particular sort of like family tooling infrastructure layer that needs to be used as part of go to market. 

13:06 That includes verification. That includes assurance. And there's a scheme in some form or another that enables you to get approved. And so there's a pathway for private identity providers of digital ID to to operate in that space as opposed to the government necessarily just mandating it. They create a scheme through which private identity can become part of that trust framework. The two data points I would say that are forefront of our mind every time we deploy into a new country. 

13:34 One is typically we deal with parents. Parents will inevitably want to stop their kid nagging. And so if their kid is nagging to get access to something and they're not necessarily allowed to get onto a particular platform because they might be too young. The data tells us that somewhere between 70 to 80% of kids on platforms where there is a minimum age of 13 or 15 or 16 are on there with their parents' permission. 

13:59 Dave: Yeah. 

14:00 Kieran: What the data also tells us is that in countries that introduce hard verification requirements, the day that comes into force, the number of grandparents who are registered on that service will jump by an order of magnitude because nana or pop becomes the one that the grandkid goes to to help get access to. And so I think it's really, really important, whatever path you take, that you look toward the end-user experience and work backwards from that.

14:27 Dave: Yeah, so you could have the best ideas. We're trying to ban 16-year-olds from using it, but there is still ways that they're still gonna be interacting. I think that's gonna be a challenge as we go forward in Australia that needs to be navigated through. And just listening to you both, I think it kind of drew some parallels with what's happening in Australia. I think you do need the government playing a role around ID. 

14:49 And maybe it could be a framework or a more active role, but you also do need that innovation from other companies driving it and driving adoption. So look, Tony, you touched a little bit earlier on initiatives like gov.uk in the UK, where the UK is rolling out digital ID. What do you think is the path forward to the future around ID? And is there use cases outside of identity, maybe where identity and payments could come together?

15:15 Tony: We have a rather antiquated set of licensing laws in the UK that require if you appear to the person to be under what they call a challenge age, which is typically 25, then you have to produce ID. And the ID you produce has to contain a holographic mark or an ultraviolet feature. It basically rules out digital ID. And there's been an announcement by the government just before Christmas that they were going to change this to enable digital ID. 

15:39 And where you really see that emerging is in a tap and go environments. So when you go to the checkout in, we call them a supermarket, but a bottle shop in Australia or whatever you're at, and you're buying your goods and you're paying using Google Pay or Apple Pay or electronically, I think very shortly you'll be able to share your age attributes at the same time as you share your payment attributes.

16:08 And that means that the checkout and the till, because you're authenticated to that device, can then make some decisions about your age at the same time as whether or not to complete the transaction. There are a couple of big advantages to merchants there. 

16:23 One is that it's a smoother experience and therefore you can get more customers through the till. But here in the UK, the statistics are that there are more than 300,000 incidents every year of violence and abuse towards shop workers as a result of challenging for ID. And that's the ones that are reported, and fewer are actually reported. And that ranges from, literally, that has ranged from a bit of verbal abuse up to murder. 

16:50 There's been two or three murders over the course of the last 10 years of shop workers that were started by challenging for ID. If you can use technology to take that human out of that loop, you protect the human that's having to challenge and get that authorization, as well as protecting the community from underage drinking and the health consequences of children buying alcohol and tobacco and things like that. 

17:16 So you've got, there's a number of advantages to using technology more effectively, not just, you know, the economic advantages of being able to get more customers through the till.

17:24 Dave: Yeah. It's a big social impact as well. I think exactly from what you're saying. I guess lastly, Kieran, I'm just interested in anything you've seen around identity and payments coming together?

17:33 Kieran: So, I mean, we see it coming into effect when we talk about parents, I mean, most of the parents that we interview and a lot of the research we do tells us that, you know, and I'm a parent, you know, you're cool with your kid going onto certain platforms, as long as you have a degree of awareness of what's going on and you trust them. 

17:53 We're also actually seeing better willingness for parents to spend. And so this was an unexpected result of integrating our technology into certain platforms, which was when parents said, "Well, I'm actually more willing to spend on this platform now that I know what my kid's up to, who they're talking to, that they're okay, this is a trusted platform, this is a trusted space for them to be in..  And so I'm more willing to part with that."  And so I think that is inherently connected to that validation, that verification of identity, but also the trust that that earns with the parent.

18:30 Dave: Well, look, thank you. I just want to say thanks to both yourself, Tony, and you, Kieran. I think with the social media ban coming in later this year, there's going to be a lot of risk and opportunity to kind of work through as that kind of hits the market. 

But it sounds like we've confidently underlying technology that's in place or will be in place. So thank you very much for your time.

18:50 Tony: Thank you. 

18:50 Kieran: Yeah, great to be here.