How it works and why it matters
by Larry Magid
Listen to “Instagram experiments with age verification technology” on Spreaker.
Larry Magid speaks to Yoti executive Julie Dawson about how age estimation technology works
In 2008, I served on the Internet Safety Technical Task Force, run out of Harvard Law School’s Berkman Center at the behest of 49 US state attorneys general and MySpace to, among other things, determine whether there was a practical and acceptable way for social media companies to determine the age of its users. There wasn’t.
Fast forward to 2022. While the technology is still evolving, there are now ways to accomplish what we couldn’t do more than a decade ago and, in the US, Meta has started to test new ways to verify age, including Face-Based-Age-Prediction (FBAP) technology that can anonymously determine a person’s approximate age, based on a video selfie, along with “social vouching.”
Like most social media services, Instagram requires users to be 13 or older and offers some features and content that are available only for those who are over 18 along with default settings that vary by user’s age.
Why knowing age is important
In addition to knowing whether a user is 13 or older and therefore eligible to have an Instagram account, the company needs to know if a user is under 18 or between 13 and 16 so that they can take advantage of age-appropriate privacy and safety settings and be shielded from content and features that may be inappropriate for younger users.
For example, if the service knows a teen is under 16, they will be defaulted into a private account. Users under 18 are protected from unwanted contact by making it harder for potentially suspicious accounts to find young people.
By knowing the age of the user, Instagram is able to provide other protections including:
- Preventing adults not followed by the teen from sending them direct messages
- Notifying teens when an adult who has been exhibiting potentially suspicious behavior is interacting with them in direct messaging
- Not allowing people teens don’t follow to tag or mention them, or include their content in Reels, Remixes or Guides
- Preventing adults who have engaged in suspicious behavior from finding and following teens
- Being sent “take a break” notices
- “Topic nudge” that encourages teens to a different topic if they’re repeatedly looking at the same type of content, regardless of what it is
- The option to turn on (or off) parental supervision tools to enable their parents to help support them in their use of social media.
- Prohibiting advertisers to target ads to people under 18 based on interest and activity on other apps and websites, though it does allow ads to be targeted based on age, gender and location
- Blocking age-gated branded content that is not appropriate for teens, including content about alcohol, subscription services, financial insurance products and services, cosmetic procedures and weight loss
New age verification options
The safety and privacy features specifically for teens are only available if the service knows their age but, until now, the primary way to determine a user’s age was to ask them to enter in their date of birth on sign-up. Instagram has long investigated reports of people being under age but there are plenty of children who put in the wrong birthday, claiming to be 13 or older to gain access to the service or claiming to be over 18 to gain access to adult-only features. Meta will investigate reports of people being under age and also uses artificial intelligence to detect if a user is under or over the age of 18. This AI looks at things like birthday greetings and other user-generated content to see if a user is under or over the age of 18 and tries to determine if the person has told the truth about their age.
Until now, if someone tries to edit their age from under 18 to 18 or above they would be required to upload an ID such as a driver’s license, or passport or, for youth who may not have those documents, two items from a list of options that includes school ID, library card and social security card, among other options.
Face-based age prediction and social vouching
The new menu of options will still include ID verification but not everyone has access to an ID and some may prefer not to share it with Meta so the company has just announced that it’s adding two new options to determine a person’s approximate age — Face Based Age Prediction (FBAP) and social vouching.
Faced Based Age Prediction is a technology developed and operated by Yoti, a UK company that offers age verification technology to companies around the world, including those that offer adult products or services such as alcohol, online gambling or adult-only content.
Social Vouching is where one or more individuals (who must be adults themselves) will vouch for someone’s age. When someone selects the social vouching option, they will be given the option to verify their age by asking people they are mutually connected with to vouch for their age, requiring them to select 3 vouchers from a list of 6 provided by Instagram. A Meta spokesperson said “we ensure the trustworthiness of vouchers by using integrity signals, for example excluding accounts that have been registered very recently, accounts that are suspected to be fake, and limiting to users with an age of 18 or over. The user’s age is considered verified if all three responses match and the answer is in the exact age band that the user is attempting to change their date of birth to.”
The Yoti face estimation technology is particularly interesting in terms of its technology, effectiveness and simplicity. As Yoti explains on its website, “Users simply look at the camera on a device and have their photo taken. Our algorithm instantly estimates their age based on their face.”
Yoti age estimation has been certified for use by government agencies in the United Kingdom and Germany for purposes including access to adult content, gambling and alcohol.
Accuracy and inclusiveness
As the chart below indicates. there are slight accuracy variations by gender. Currently, they only report female and male genders. They say they are working on ways to improve age estimation for transgender individuals and skin tones but, overall, according to a May, 2022 Yoti white paper, the system will determine age within:
- 1.36 years for children between 6 and 13
- 1.56 years for teens 13-17
- 2.22 years for young adults between 18 and 24
- The system is less precise (3.47%) at estimating the age of adults over 26, but Meta and most other companies don’t need to know the precise age of anyone who is clearly an adult.
Yoti further states that gender and skin tone bias is minimized and that the true Positive Rate (TPR) for 13-17 year olds that are correctly estimated as under 23 is 99.65% while 6-11 year olds correctly estimated as under 13 is 98.91%.
Privacy
Yoti only estimates age — not identity. Meta says that it only shares the user’s selfie with Yoti and that both Yoti and Instagram delete the image once the age estimation is complete. Yoti says that it will only share age with Meta or any other client company and that “The photograph is not viewed by any Yoti staff.” The company only determines estimated age and says that the image is not used to identify the person. The Future of Privacy Forum has published an infographic along with a blog post that outlines a set of principles regarding the use of facial detection.
In an interview, Yoti’s Chief Policy & Regulatory Officer, Julie Dawson said that it “can’t recognize anyone and we have it audited annually” and said that their auditor certifies that they “do delete the image each time.”
Historical context
Age verification has been on the drawing board for many years but it’s only now starting to become practical. As I mentioned, I served on the Internet Safety Technical Task Force in 2008 which spent several months analyzing data about age verification and other means of protecting children on behalf of 49 state attorneys general in the United States along with MySpace which, was then a popular site for teens. At the time, we expressed concern over the available methods of determining a person’s age because of a variety of obstacles, including privacy laws in some countries (including the United States) that prohibited commercial access to documents such as school and Social Security Administration data. As our final report stated, “almost all technologies submitted present privacy and security issues” and the available technology solutions were far less accurate than they are today.
There has been considerable technical and legislative progress since the Task Force did its work, especially in the field of artificial intelligence and computer vision. In addition to the ensuing progress in AI, the Task Force’s report was written before there was widespread access to phones with cameras which are an important component of face-based age-prediction. Also, in the ensuing years, there has been a great deal of progress made in terms of data collection and retention policies along with the passage of the European Union’s (and Great Brittan’s) General Data Protection Regulation (GDPR) along with various US state laws (and proposed federal legislation) which puts limits on data collection and retention. These laws set ground rules that enable companies to take reasonable and necessary steps to determine user ages while preventing the commercial exploitation of age information.
Age verification is not a magic bullet
Age verification is one of many tools available to tech companies, parents and young people themselves to help protect the safety, privacy and security of children and teens but it’s still important for parents to help their teens make decisions regarding what is appropriate for them which varies on many factors, including maturity, well-being and the individual family’s values. Having conversations with your children and teens (not lectures or inquisitions) can go a long way towards helping parents understand what services their kids are using and how they are protecting themselves and help everyone in the family learn the skills to thrive in today’s connected world.
Disclosure: Larry Magid is CEO of ConnectSafely, a non-profit internet safety organization that receives financial support from Meta (Instagram’s parent company) and other technology companies.