Online privacy concerns as under-16 social media ban comes into effect

The tech company that popular messaging app Snapchat is using for age verification for the looming under 16s social media ban says its methods are safe, but cybersecurity experts are not entirely convinced.

The federal government's restrictions banning children under 16 from social media come into effect tomorrow.

Snapchat is relying on Singapore-based company k-ID to verify ages, giving users three methods to prove they are older than 16:

• A yes/no message is sent from a bank using ConnectID, facilitated by business to business communication with k-ID  
• A user can scan government-issued identification card (passport, driver's licence or any other state-issued ID) and k-ID will scan and validate the ID document and age
• Users can take a selfie and k-ID will estimate an age range.

'No storage, no worries,' says company

K-ID claimed that "there is no data stored", so people do not need to be concerned about hackers. 

"A person's ID is scanned, and there is a selfie check to make sure it is the real person, and then those images are immediately deleted," a k-ID spokesperson said.

"This is the only purpose of the system.

"Users are then offered the opportunity to store their age-signal [the company's verification of the user's age] as an AgeKey. This allows the user to prove their age without having to re-verify."

Cybersecurity expert Rumpa Dasgupta said for the facial age-estimation option (selfie check), if the model truly operated entirely on-device and the app did not upload images, then no images ever reached a server. 

"This eliminates server-side breach risks for that specific method," Dr Dasgupta said.

"However, users must still trust the app's implementation and the device platform. 

"A malicious, compromised or poorly implemented app could transmit images despite the stated policy."

Still risks even with no long-term storage

For the ID scan plus selfie face-match option, k-ID said that images were deleted immediately after verification and only the pass/fail result was retained. 

But Dr Dasgupta said this method usually required transmitting the images to a verifier, unless the provider used purely on-device verification or strong client-side encryption. 

"If images are sent to a remote system, they are exposed in transit and during processing, even if not stored long-term," she said.

One of the other issues with facial-age estimation is accuracy, according to cybersecurity expert Paul Haskell-Dowland.

"They may well be more accurate in how they do it, but I would suggest that simply relying on visual appearance, if that was the case, we wouldn't need government-issued ID," Professor Haskell-Dowland said.

"If it was actually a reliable method then we wouldn't need to prove our age to buy alcohol or cigarettes or any other commodity that has an age restriction — you would just have a camera in the store and cut out all of the hassle of dealing with IDs. 

"We don't do those things because actually you do need a more reliable approach, but maybe they've invested in it and they've got some fantastic technology and if they have, they should be patenting it and getting it out to every other organisation."

K-ID said it did not own any age-estimation technology itself but orchestrated a "number of providers so that people can have a choice about how they want to do an age assurance check".

The bank account method used by ConnectID has a lower privacy risk because no images are involved, with only a 'yes/no' age verification sent.

ConnectID and the bank will see anonymised data indicating that a user requested an age verification for a service.

Dr Dasgupta said k-ID's claim that there is "no data stored to be hacked" was accurate "only under the assumption that all providers follow correct implementation practices, delete data as promised, and do not retain any identifiable information". 

"The actual privacy risk depends heavily on the technical implementation and the behaviour of each provider," she said.