In this blog series, our CEO Robin Tombs will be sharing his experience, whilst focusing on major themes, news and issues in the world of identity verification and age assurance. This month, Robin chats about why facial age estimation is not easy to spoof, the recently passed age verification law in Texas, and the importance of human fallback for identity verification.
Texas age verification law
The US state of Texas can continue with their new law requiring platforms with adult content to verify the age of all users. The government said this is part of their legitimate interest in restricting children from accessing pornography.
It’s a significant milestone and demonstrates the important role lawmakers and regulators want age verification to play in keeping children safe online.
There was a lot to digest from the court decision, but here’s some key takeaways:
- The judges do not believe age verification online imposes any sort of categorically different burden as to check the ages required of shoppers buying age restricted porn magazines (by estimating age and only where doubt remains, by reviewing ID).
- The judges emphasised that prior court decisions were based on the technology available at the time. “27 years ago there was an absence of viable age verification, but technology has dramatically developed.”
- The court said there are at least three effective ways to check age – government ID, facial age estimation, or some other information to infer the user’s age.
- The government says companies can use techniques such as ‘selfie matching’ or age estimation.’ A federal US court saying facial age estimation is an effective way to check age is a strong indicator of the growing confidence regulators have in this technology.
- Regulated companies can choose their preferred age verification method and outsource this to third parties. Whoever performs the age checks may not retain any of the user’s identifying information. This is paramount to protect the privacy of individuals. The law will punish businesses $10,000 for each instance where any identifying information has been retained.
- There’s big fines for platforms who don’t comply – $10,000 for each day a company lacks age verification and up to $250,000 for every young person who accesses sexual material which is harmful to minors.
Why facial age estimation is not easy to spoof
Some privacy groups are making false claims that facial age estimation is easily circumventable and that AI deepfakes render the technology obsolete. It is disappointing to keep reading these misunderstandings, especially when companies in the identity field – not just Yoti – have made great strides on developing injection attack detection.
Since January 2022, we have included our patented SICAP (Secure Image Capture) service into our liveness technology as standard, at no extra cost. SICAP can identify and prevent more sophisticated injection attacks, ensuring that the images captured during a verification process are genuine and remain untampered with.
This gives businesses using facial age estimation additional protection against injection attacks. This makes it very hard for most children or adults to circumvent the camera and trick the technology into estimating the age of a deepfake image or video instead of the real face of the person looking into the camera.
Whilst no company claims 100% perfection against all current and future spoofing attacks, it’s easy to get a lot of comfort that these solutions work. For years, Facetec has offered a large bounty to any attacker who successfully beats its liveness detection service. They have made no payouts to date. Recently, Yoti has also been running a bounty scheme inviting hackers to try and beat SICAP. We’ve also made no payouts to date.
You can read about our approach to detecting and protecting against spoofing attacks in our white paper.
The importance of a human security team
One of the reasons several governments, as well as many of the world’s leading background screening companies, use our identity verification service is because we invest in our world class Security Centre team.
Yoti uses a mix of world-class, automated third party and proprietary AI fraud detection tools. These are supported by the highly skilled abilities of our Security Centre team, who can sometimes provide clarity where the technology may struggle.
We have tested, under NDAs, several leading suppliers who claim their automated identity verification services are so good there is no value in falling back to an expert human check.
We buy in and create a lot of low, medium, high and very high quality fake ID documents to test our own AI systems, some supplier systems and our Security Centre team. All of the tested AI systems missed some of the medium and many of the higher quality fakes. This is why there is great value in having a team of verification experts.
Automation plus humans gives businesses extra confidence and peace of mind that the verification process is robust, effective and accurate. You can read more on this in our identity fraud report.
To the many team members in the Yoti Security Centre team, I salute you 👏🏻.