The National Assembly has just adopted a bill aimed at setting at 15 the minimum age for registering alone on a social network, without the authorization of the parents. A laudable intention, but a difficult device to put in place…
For several years, European legislation, via Article 8 of the General Data Protection Regulation (GDPR), has required social networks such as Instagram, Facebook, TikTok and Snapchat to set a “digital majority” between 13 and 16 years old. – each country is free to decide for itself on this threshold, as long as it is within the range. This numerical majority corresponds to the age from which it is considered that a user controls his image and his personal data, and that he is able to give his consent for this information to be used by online services, without having need parental permission.
Obviously, this threshold is absolutely not respected in practice. According to the National Commission for Computing and Liberties (CNIL), the first registration on social networks occurs “on average around 8 and a half years old, and more than half of 10-14 year olds are present there”, even if many platforms like Facebook, Instagram and TikTok are simply prohibited for people under 13 – but no serious checks are in place. It’s quite simple, according toDigital Generation survey “the digital practices of young people aged 11 to 18” published by the CNIL in March 2021, 44% of 11-18 year olds have lied about their age on social media.
Until now, the numerical majority was not subject to a legal definition in French law. The minimum age to access online platforms was freely defined by the platforms themselves. Faced with this problem, the deputy for Horizon Laurent Marcangeli presented on Thursday March 2 a law project aimed at fixing the numerical majority at 15 years, as reported The world. A text that was adopted by the National Assembly almost unanimously, with 82 votes to 2. Its objective is to“establish a numerical majority” and of “Combating Online Hate”. Parents will therefore have to give – or not – their consent so that their child under 15 can register on social networks. In addition, the platforms will be forced to verify the age of any new registrant. However, the implementation of the system remains unclear – and that is the problem. The text of the law has yet to be submitted to the Senate.
Social networks: a digital majority at 15
Pornography, cyberbullying, inappropriate content, misinformation, unattainable beauty standards, addiction to screens… The dangers faced by the youngest – and not only – on the Internet are numerous, especially since at this age, Internet users are more vulnerable to comments and content posted by others, but are also less aware of the issues and possible repercussions of content they post themselves, such as personal information and photos. Moreover, by leaving their profile open to the public – this is generally the case by default for “adult” profiles – minors can be exposed to people with malicious intentions, who can contact them.
Since its adoption on May 25, 2018, the GDPR reinforces consent and transparency regarding the use of data. With article 8.1, the personal data of minors are now treated differently depending on their age. Thus, parental consent is required for minors to collect sensitive or photographic data, use data for commercial prospecting or sell it to third parties. By adopting this law, the platforms will be obliged to put in place a system to ensure that users under the age of 15 have obtained this agreement. In the event of non-compliance, they are liable to a fine of up to 1% of the company’s worldwide turnover. An amendment also added a constraint by providing that parents could not give their consent for children under 13, except for labeled platforms.
“It’s about everyone – parents, companies, young people – taking responsibility” faced with the amplification of children’s digital practices, explains Laurent Marcangeli. Rejecting everything “moralizing discourse“, the deputy defended “essential safeguards” to put in front of “the increasing precocity of digital puberty and the power of the tools made available to our young people”. The primary objective is to “to reduce cyberbullying among young people”of which social networks and instant messaging are one of the main vectors – they give rise to harassment, which follows the victim absolutely everywhere and all the time.
Social networks: a difficult age verification device to set up
To enforce this age limit, the bill must make it possible to establish the obligation for social networks “to set up a technical solution for verifying the age of end users and the consent of holders of parental authority” for children under 15. Note that some social networks are already trying it, like Instagram, which has set up a video selfie system, which is analyzed and validated by artificial intelligence (see our article). If the Senate passes the law, the terms of the system will be discussed and defined by the competent authorities – Arcom will have to certify the solutions after consulting the CNIL – then adopted by the Council of State. The system put in place will have the difficult task of reconciling efficiency and the protection of privacy and personal data, as the CNI remindedL in July 2022. Indeed, some age verification devices are based on a massive collection of personal data and therefore appear to be difficult to comply with data protection principles – such as facial recognition. Others, less intrusive, are ineffective because too easily circumvented by minors, who are not lacking in imagination when it comes to breaking the rules.
Currently, all proposed solutions can easily be circumvented. Indeed, the use of a simple VPN locating the Internet user in a country which does not require an age verification of this order can allow a minor to circumvent an age verification device applied in France, or circumvent the blocking of a website that does not comply with its legal obligations. Similarly, it is difficult to certify that the person using proof of age is the one who obtained it. The solutions envisaged could well be the same as those that will be put in place to enforce the age limit for access to pornographic sites, which the Government is in the process of putting in place (see our article).
The first option would be to carry out a check by verification of the bank card with a zero euro transaction. A solution that leaves you somewhat skeptical, given that it opens the way to online scams – in particular with the creation of mirror sites – and that it is quite easy to circumvent, since it is enough for a minor to borrow the his parents’ card or to use his own withdrawal card. The other solution would be to set up a system of double anonymity, ie when the company certifying the age of the Internet user does not know for which type of site authentication is necessary. But there again, it would suffice to install a VPN, a server which allows the Internet user to virtually relocate from France, that is to say to make the ISP believe that he is in a foreign country where the regulations do not require verification…