Anticipating the rise of the metaverse, lawmakers in Asia Pacific are making age verification mandatory to address online safety and fight misinformation. But is that a good thing?

Governments in the Asia Pacific region are stepping up measures to enhance online safety, especially for vulnerable users targeted by bad actors.

Singapore recently announced new Codes of Practice for social media services, on the back of a recent slew of new regulations across countries — with Australia introducing a new age assurance step on Google Play and YouTube in March 2022, and the Philippines making it law for new social media users to register their legal identities and phone numbers.  

Although these verification checks are meant to increase online safety, such protocols are laborious and restrictive. What’s more, they create a treasure trove of data waiting to be exploited. 

In the end, is it worth all the stress and fuss for these added layers of age verification? CybersecAsia checks it out with Frederic Ho, Vice President, Asia Pacific, Jumio Corporation.

Given Jumio’s expertise in bank-grade identity verification, what are some recent regulatory developments in Asia Pacific jurisdictions that businesses leveraging social media and mobile apps should be aware of?

Ho: For the past few months, we have seen several countries in Asia Pacific introducing new regulations to improve online safety for everyone – especially young users. Singapore recently developed two new Codes of Practice, one of which will give Infocomm Media Development Authority (IMDA) power to direct social media platforms to disable access to harmful online content. With such regulations in place, Singapore is working toward closing the online safety gap and ensuring that young users are not exposed to age-gated content.

In compliance with the Australian Online Safety (Restricted Access Systems) Declaration 2022, Google introduced a new age assurance step in March, where users of Google Play and YouTube in Australia had to verify their ages in order to access age-restricted content. Users may be asked to provide additional proof of age, such as a valid ID or credit card, when attempting to access content that is potentially inappropriate for viewers under 18. This will ensure that no matter where a video is discovered on YouTube, it will only be viewable by the appropriate audience.

The Philippines, too, has stepped up measures to ensure the safety of its youth. Recently, lawmakers approved legislation requiring social media users to register their legal identities and phone numbers when creating new accounts, in order to fight online abuse and misinformation.

How important is age verification for online safety?

Ho: While the internet has provided us with many benefits, it also contains unwanted elements such as harmful online content. A pop-up screen that asks if a website visitor is over 18 does not qualify as age verification and is no longer enough to prove due diligence. With just one click, minors can gain access to age-restricted content and services — such as online gambling, dating or adult websites, or dangerous and age-inappropriate social media challenges — that may be harmful to them.

Fortunately, advanced technology such as age verification can help to keep products and services

intended for adults out of the reach of underage children. With Instagram’s recent announcement on adding new age verification features, it seems that a global trend has started to take shape which aims to enforce age verification checks that will segregate content on social media on the basis of what it contains. Such technology helps to ensure that only those above a certain age are able to view mature content while the children are kept out of it.

What are some implications of overly complex age checks on privacy and security? And how can businesses simplify age checks, while ensuring privacy and security?

Ho: Whether it is to register for an online service or to help businesses provide more accurate and personalized services, consumers have become more willing to share their personal information with organisations. And, it is the same when it comes to submitting an official ID document to verify that someone is of legal age — whether it be to purchase alcohol online, gamble, or simply to access age-restricted content.

However, this creates a potential privacy risk as much of this information collected is a treasure trove of data waiting to be exploited. Each time users upload identification documents to a site requesting proof of identity, the chances of the information being leaked increases. Should the site’s security be breached, the exact information used to prove the user’s identity could be used to impersonate them elsewhere.

To counter this, businesses have a responsibility to protect any Personal Identifiable Information (PII) against breaches and manage them appropriately. This can be done by engaging with identity verification providers that adhere to the relevant security standards — such as the Payment Card Industry Data Security Standard (PCI-DSS) and the General Data Protection Regulation (GDPR).

More businesses are leveraging biometric technology such as selfie identity verification to enhance security and the customer experience. Users are required to submit a photo of their ID document and a live selfie during account sign up. They can authenticate their identity at login by taking a new selfie. Because biometric data is difficult to forge, this authentication method provides an extra layer of security while allowing a seamless verification process.

How can real-time identity and age verification be applied in other sectors such as retail, banking and travel?

Ho: The regulations surrounding age-restricted commerce — especially in online environments — are complex and continually changing.

For instance, age verification checks are being considered in Singapore for any online purchases of weapons, or everyday items that can be used as such. In countries such as the UK, China and Australia, these regulations are evolving to include age verification for alcohol and tobacco products, as well as to protect minors from accessing online gaming services.

With the rise of the metaverse, age verification checks could become a central necessity to ensure that young users are only exposed to age-appropriate content or are restricted from making large purchases such as its land or expensive NFTs.

Beyond age verification, real-time identity verification has the power to simplify the travel industry by creating more efficient check-in and booking processes for travellers at airports, ferry terminals, and hotels. Furthermore, these authentication technologies can even apply to vacation rental and ride-sharing services to establish trust between users in the sharing economy.

Jumio’s solution, for instance, requires a valid government-issued ID and a live selfie. This pairing serves as a powerful age-verification and fraud-prevention tool, especially as many minors and cybercriminals would not be able to use their own likeness in a real-time selfie, if they’re using another person’s ID.

Banks are already implementing these modern features that enable them to determine the user’s physical presence behind an app, on top of ID checks, to ensure the highest levels of verification accuracy, thwart impostors, reduce fraudulent transactions and prevent account takeovers. These very same features can be used in a slew of other industries, including online gaming, to prevent takeovers of e-wallets that store virtual currency or in-game credits.

Ultimately, with real-time identity and age verification coming to the forefront for many industries, it falls upon organisations to provide more secure authentication mechanisms for their customers without sacrificing convenience. Only then can our online spaces be safe — not only for youths, but all users worldwide.