Children can bypass age verification procedures in the most popular social media apps by lying about their age

Children of all ages can completely bypass age verification measures to sign-up to the world’s most popular social media apps including Snapchat, Instagram, TikTok, Facebook, WhatsApp, Messenger, Skype, and Discord by simply lying about their age, a study by researchers at Lero, the Science Foundation Ireland Research Centre for Software has found.

And even potential age verification solutions identified by the research team can be easily sidestepped by children, according to the team’s most recent study: Digital Age of Consent and Age Verification: Can They Protect Children?

Lead researcher Lero’s Dr Liliana Pasquale, assistant professor at University College Dublin’s School of Computer Science, said children could easily bypass the mechanisms adopted by apps to verify their age.

“This results in children being exposed to privacy and safety threats such as cyberbullying, online grooming, or exposure to content that may be inappropriate for their age,” she added.

The study which examined Snapchat, Instagram, TikTok, HouseParty, Facebook, WhatsApp, Viber, Messenger, Skype, Discord apps scrutinised age verification procedures in April 2019 and repeated it in April 2020 ­– it found all ten apps permitted users, regardless of age, to set up accounts if they first gave their age as 16.

Dr Pasquale said the widespread use of age of 13 as the minimum age for accessing social media services derives from the Children’s Online Privacy Protection Act (COPPA), effective in the USA since 2000. Europe’s General Data Protection Regulation (GDPR) requires children below the age of digital consent (13-16) to have verifiable parental consent for the processing of their data.

EU member states are also free to set a different digital age of consent, between 13 and 16 years, leading to a range of age limits across Europe. For example, Ireland, France, Germany, and The Netherlands have opted for 16, while Italy and Spain have set the age at 14; while the UK, Denmark, and Sweden have set the age at 13.

“Our study found that while some apps disabled registration if users input ages below 13, but if the age 16 is provided as input initially then none of the apps require a proof of age. Providing mechanisms that deter a user from installing an app on a device on which they have previously declared themselves to be underage is currently one of the most sensible solutions not to incentivise users to lie about their age,” Dr Pasquale said.

The team looked at existing age recognition techniques using biometrics such as speech recognition and fingerprint characteristics as possible solutions to implement more robust age verification mechanisms. However, these were also found to have limitations with speech recognition, for example, easily bypassed by playing voice recordings.

Dr Pasquale said their study found existing data protection regulations to be ineffective.

“In reality, the application of substantial financial penalties was the main trigger for app providers to implement more effective age verification mechanisms. Based on our study and on our survey of biometrics-based age recognition techniques, we propose a number of recommendations to app providers and developers,” she said.

Recommendations:
Clarify the minimum age and treatment of data:

Existing apps should ensure that a clear, concise, and age-appropriate summary of the relevant parts of the app’s ToU (terms of use) is displayed to users who sign-up and declare their age to be under 18.

Enable the most restrictive privacy settings:

Apps should apply the most restrictive privacy settings by default for any user that declares themselves to be under the age of 18. For example, photos, posts, and messages should only be shared with “friends”, location data should not be collected at all. It should also not be possible to override privacy settings without explicit parental consent.

Encourage users not to lie about their age:

Despite the presence of a minimum age requirement, many underage users continue to use social and communication apps. Users must be incentivised to be honest about their age, with minimal data collected. Providing mechanisms that deter a user from installing an app on a device on which they have previously declared themselves to be underage is currently the most sensible solution and the hardest to circumvent.

Implement Robust Age Verification Mechanisms:
Where a minimum age requirement is in place, it should be backed up by appropriate age verification mechanisms. Using age recognition techniques based on biometrics factors, such as facial features, may not be sufficient considering that these can be circumvented. Age verification should be an ongoing process that does not terminate after sign-up, to assess whether a user lied about his/her age at the moment of sign-up, to counteract evasion measures.

More about Irish Tech News and Business Showcase here.

FYI the ROI for you is => Irish Tech News now gets over 1.5 million monthly views, and up to 900k monthly unique visitors, from over 160 countries.

We have over 860,000 relevant followers on Twitter on our various accounts & were recently described as Ireland’s leading online tech news site and Ireland’s answer to TechCrunch, so we can offer you a good audience!

Since introducing desktop notifications a short time ago, which notify readers directly in their browser of new articles being published, over 50,000 people have now signed up to receive them ensuring they are instantly kept up to date on all our latest content.

Desktop notifications offer a unique method of serving content directly to verified readers and bypass the issue of content getting lost in people’s crowded news feeds.

Drop us a line if you want to be featured, guest post, suggest a possible interview or just let us know what you would like to see more of in our future articles. We’re always open to new and interesting suggestions for informative and different articles.

If you would like to be featured in our podcast series drop us a line & don’t forget to sign up for notifications for our latest episodes and follow us on Twitter, Linkedin, SoundCloud, iTunes or your own favourite podcast platform.

Contact us, by email, twitter or whatever social media works for you and hopefully, we can share your story too and reach our global audience. We are agile, responsive, quick and talented, we look forward to working with you!

If you would like to have your company featured in the Irish Tech News Business Showcase, get in contact with us at [email protected] or on Twitter: @SimonCocking