The UK 'porn block' was due to come into effect on July 15 2019. However, on June 20 it was revealed that the initiative had been kicked into the long grass and delayed by a minimum of six months.
The concept behind the porn block is that UK-based internet users would have to confirm that they are 18 years or older if they wanted to access adult entertainment sites.
Given that Pornhub.com alone received 33.5 billion visits in 2018, with the UK providing the second-most users after the United States, the coming age-verification filter would likely affect a huge number of people in the UK.
While it's often called the ‘UK porn block’ that name is not entirely accurate. The age verification law is, in reality, part of section 25 of the Digital Economy Act, which has a number of sections relating to online legislation.
The process works like this: once July 15 2019 arrives, adult websites will need to show a splash screen to UK users when they arrive on the site. This interstitial screen must contain no adult material at all and should inform visitors that they must prove they are over 18 years old in order to continue.
If a user is able to use an approved age verification system then they'll enter these details, which will likely be a non-identifying username and password. If they don't have these details then the site might explain how to get them, but you won't be able to access the site without providing them...or that's the idea.
All adult sites, whether hosted or based in the UK or not, will need to support this. Sites which don't support it may face a fine or be blocked in the UK entirely (or both). Eventually, when the scheme has been running for a couple of months, users will be able to report non-compliant sites.
The British Board of Film Classification has been chosen to administer the scheme. It won't provide age ID checks itself but it will approve providers who do. It will be responsible for fining non-compliant sites and, if needed, requesting ISPs block those which don't verify age adequately.
The stated goal of the UK 'porn block' is to protect children. The UK government says that young people are too easily able to see hardcore adult video and there is a need to protect them from stumbling across it by accident. You won't find many people who disagree with that sentiment.
However, the result will be that all consenting adults will need to jump through hoops to prove that they are old enough to access things they're legally entitled to.
As with most things like this there's a very good chance a lot of people won't know how this will affect them, so expect to see some confused and frustrated people wandering the streets on July 15.
When is the UK 'porn block' coming, and how will it work?
We know that from July 15 anyone using a website featuring content unsuitable for minors in the UK will be asked to verify their age.
To do so users over 18 will need to provide proof that they are old enough to access age restricted sites. The verification can be done online or in a shop where a pass can be purchased that confirms the holder is aged 18 or over.
The burden of proof in a shop is likely to be somewhat lighter than online. While you may be asked for photo ID, say a passport or driving licence, many shopkeepers will simply apply the common sense rules they currently rely on. If someone looks over 18 they probably won't be challenged to produce ID.
From this perspective the shop-based approach might seem more of a privacy concern. People seeking adult content could pop into a shop anywhere in the UK and buy their pass, creating the potential embarrassment of someone they know spotting them.
Online it's arguable that the process is more anonymous, but you will need to prove your age by uploading some form of identification. The main provider of age checking for this new legislation, AgeID claims that it won't retain any personal information, with the site claiming that it sends your data to a third party which it then queries to verify age... and you'll be able to choose your provider.
Once your ID and password are provided you'll be free to log in to any age restricted site and personal information should never be exchanged. The question still remains, however, about how secure uploading an image of your passport or driving licence actually is.
We may see different forms of age verification appear too. One natural way to do this would be for mobile networks to issue IDs to users. These companies already know and have verified your age in many cases, so issuing identification should be simple.
What are the ways someone can verify their age?
This is where things take a turn for the downright shady. Firstly, at the time of this article's first publication in May 2019, the BBFC is listing exactly zero approved age verification systems.
However we know there are a couple of different options that will likely be part of the approved list and this is where it starts to get a bit concerning from a privacy perspective.
The main verification technology is called AgeID and is run by a company called Mindgeek. Looking at Mindgeek's website you could be forgiven for assuming that this is some sort of internet security firm. It's not. At all.
It's the umbrella brand behind some of the biggest adult websites in the world. Mindgeek runs PornHub, RedTube and YouPorn. It also owns content creators and provides payment and monetisation services to other producers of erotic content.
AgeID will be an online system and visitors to adult websites will need to verify their age by uploading proof that they are old enough.
The alternative, the PortesCard, will be purchased in shops where the vendor will confirm your age. The card contains a code which is valid for 24 hours after it is purchased. A companion app for mobile will enable you to turn that code into an AgeID and to log in.
Two kinds of PortesCard are for sale, one for a single device and another for multiple devices. There is, of course, some concern that kids will share AgeID accounts with each other, meaning that if one gets hold of a PortesCard then they will give access to others. Some security will be implemented to prevent this but it's unlikely it will be entirely effective.
The hassles and worries of both of these systems is just one of the reasons we expect many people to turn to VPN services instead.
So, can you use a VPN to sidestep the porn block?
Yes, it's a cast iron certainty that search terms such as 'best VPN for porn' will skyrocket in the UK the day the block comes into effect. Being able to skirt around geolocation restrictions, content blocks and web filters using a VPN is one of the primary uses of these services as well as providing privacy on the web.
Commercial VPN services allow users on almost any electronic device to select a country from which they wish to appear to be located. Commonly this has been used by people to enjoy the US Netflix library from the UK as one example.
The UK legislation that requires age verification is put in place when a user appears to be visiting from a UK IP address. If an adult site can't determine that from the provided location data then it will allow UK users to see the same content as if accessing from outside the country's borders.
Internet service providers (ISPs) are powerless to prevent people avoiding the restrictions in this way because VPN traffic is encrypted and thus completely opaque to them - the ISPs have no way to see what their VPN-using customers are looking at when they're connected to one.
It is possible that the government might try to place the same age restrictions on VPN providers. Namely, that they must verify customers are 18 or older. But this would need a separate law to enact and would almost certainly be wildly unpopular. It seems implausible, given that VPNs are already being used by terrorists and paedophiles and yet aren't being targeted, that the porn block will be any different.
While the main reason for the block is to stop under-age children accessing inappropriate content, many will have concerns around the privacy of uploading their details to new services, or that they will be placed on some kind of database of pornography watchers, which is there the privacy of a VPN can provide some solace.
The downside for those users is that VPNs cost money (albeit just a few dollars per month in most cases) and will add up to more than the cost of simply getting one of the porn passes from a registered provider. There are some free VPN services, most notably Hotspot Shield which offers a 500MB daily data allowance.
Other free VPN apps tend to offer reasonably small data allowances or use your broadband connection to provide a reciprocal service to other users. This is less than desirable for most people and could have privacy implications of its own, so using a more reputable provider is key. TechRadar has tested every major VPN service out there and we rate ExpressVPN as the very best.
Will all adult sites comply with the UK block?
It's highly unlikely that all sites offering adult content will comply with the so-called UK porn block. There are a number of reasons for that. They range from the cost simply being too high, right through to confusion about what's required. Bear in mind that most pornography sites aren't hosted in the UK nor are many of them based here from a business perspective.
While larger firms will be aware this legislation is coming it's entirely possible that smaller ones won't have a clue or simply won't care enough about the UK to bother with it. While the UK government is promising fines for non-compliant companies, it doesn't have much jurisdiction in any other part of the world. It could, perhaps, put pressure on EU firms, but the UK decided to cut ourselves off from that source of support.
What happens if sites don't comply?
Fines of up to £250,000 can be applied to any company which doesn't comply with the UK's new porn block regulations. They can also be blocked by all UK-based ISPs if they refuse to implement the checks. These blocks will likely be of the same kind that the high court uses to prevent people accessing football streaming services, and torrent sites such as The Pirate Bay.
ISPs have no choice about implementing these blocks and the public almost certainly won't be told anything at all about which sites and services have been blacklisted. For many users, websites they currently use will simply vanish and be replaced by an explanation from the user's ISP.
How long will it take to apply the block?
A very significant percentage of the internet is made up of pornographic content. Some estimates suggest that 4% of the top million websites provide pornography. That's around 42,000 distinct websites that host adult content.
This is going to present the BBFC with a significant challenge, especially if these sites refuse to take action. To process each non-compliant site would be a lengthy process and will require the regulator be told about those not verifying a user's age or it discovering them for itself.
The cost and time this will take could be considerable and we won't know about the challenges it creates until the legislation takes effect and we can see the impact from July 15 onwards.
How will the UK porn block help under-18s?
While it is a part of life, there are plenty of legitimate concerns about online pornography. Its failure to present a realistic view of sex, the treatment of women and the increasingly extreme nature of video content are all problematic.
Some studies have shown that pornography has a detrimental effect on the sex lives of some people with some reports claiming that using it can lead to erectile dysfunction and changes to your brain.
Many videos appear to coerce women into sex with money or harassment, giving a distorted view of consent and while almost certainly fictional acts they can give young people an inappropriate view of how sex should work in a normal relationship.
Reducing the number of kids seeing these distortions could be seen as a very good thing. Although to buy in to that you'd first have to accept that the porn block will work, which is clearly not certain at all.
Will this help parents?
There are some advantages to the legislation that will help parents. If we assume it's a total success and all porn providers place a UK age gateway on their sites then perhaps young children will stumble across adult material less.
In reality there is also a lot of porn on other services like Twitter, Reddit and image sharing sites. Because these companies aren't porn providers they also aren't required to construct an age-based gateway on their content.
As always it's preferable for parents to educated and monitor their child's online habits. After all, seeing pornography is just one of the many dangers of unrestricted internet access. While a lofty goal, internet use in the under-16s should be carefully managed by parents but even the best intentions can't protect against inquisitive and resourceful young brains.
What's more, whether we like it or not, many kids under 18 are already using VPNs and will simply continue to do so.
What does the UK government say?
The government says that keeping children safe online is a priority. Research by the NSPCC suggested that 28% of 11 to 12-year-olds had been exposed to pornographic content which jumps to 65% of 15 to 16-year-olds.
David Cameron first started to talk about restrictions on porn in 2013. Initially these plans were that ISPs would offer age restrictions to customers that wanted them. Later ISPs started to apply content filters to new subscriptions with customers required to opt-out. This varies from provider to provider but Virgin Media made the filter its default in 2018. The EFF has a detailed list of major ISPs content restrictions.
Mobile networks also offer content filtering which is switched on by default and can be deactivated by either calling your provider or using your online account settings to deactivate it.
In July 2016 the Digital Economy Bill got its first parliamentary reading and included a section related directly to internet pornography. Made up of 17 sections it covers all of the legislation that was voted into law on April 27 2017. Originally it was supposed to be enforced from April 2018 but that was delayed until "Easter 2019". It was then delayed again, and is now supposed to be enforced from July 15 2019.
Other than with VPN services, how else might people circumvent the block?
The UK porn block relies heavily on a couple of things. Firstly a site must determine where a user is located in order to serve them an age restricted landing page. And secondly, when a site is blocked for failing to comply with age restrictions your ISP needs to know you're accessing it in order to prevent the requests being fulfilled.
As highlighted, a VPN will stop you seeing the messages from the UK’s porn block because the traffic between you and the wider internet is encrypted. It also essentially cuts out your ISP from the equation - you're using their bandwidth but they can't see what you're actually viewing.
But if you're worried about your children viewing inappropriate content, then it's worth noting there are other ways around it too.
The service TOR uses a customised version of Firefox and routes traffic around the network using encryption in the same way a VPN does. The users of TOR all agree for a small portion of their internet bandwidth to be used by others on the network and this means that you appear to websites in a way that makes it very hard for them to understand where you are.
TOR is a totally free way to somewhat hide who you are and is also unlikely to fall foul of the UK's porn block.
There's also another technology that is being heavily pushed by Google and Mozilla to help secure the web. It's called DNS over HTTPS (DoH) and it adds an important layer of security to web traffic. In the same way that traffic between TechRadar and your browser is encrypted (look for the padlock in your address bar) it's possible to do the same with the initial lookup of a domain name.
Usually, when you type in a website, your browser uses an unencrypted DNS server to turn techradar.com into a usable, numeric, IP address (185.113.25.56). Using DoH would prevent your ISP from knowing which site you were accessing and therefore any block simply wouldn't work.
DoH is currently a little bit too complex to implement for most users. You need support within your router - we tested tools that encrypted DNS traffic but we still got Virgin Media's warning page for The Pirate Bay (a handy test site, as it's blocked under the same system non-compliant porn sites will be).
What about other ways to share adult content?
This is perhaps the area in which the government has shown its absolute ignorance of the internet most obviously.
Blocking adult entertainment sites might stop someone typing "porn" into Google and getting easy access to streaming video. What it does not help with, in the slightest, is the myriad other ways to share sex videos.
Up and down the UK people are sending each other porn, either professional or homemade, via WhatsApp. If kids have access to a smartphone then they probably have either WhatsApp, Snapchat, Signal or Telegram. All allow the easy circulation of pretty much any type of video you like. And these videos aren't controlled by the strict rules that porn hosts place on their videos.
There is a very real chance that kids will be exposed to far more worrying videos via WhatsApp than they would on PornHub. So-called revenge porn, where someone's intimate moments are shared without their permission, could spread far more widely. This is a very troubling situation and forcing sexuality underground is never a good idea.
Then there is the considerable problem of BitTorrent and newsgroups. These services are commonly used to spread pretty much every type of video from every type of porn site. Kids who want to find porn will easily be able to, and nothing protects children accidentally downloading a video thinking it's one thing, and getting porn by mistake.
The government has been trying for a really long time to stop torrents and other methods of illegally sharing video, and so far hasn't been successful.
What are the adverse consequences of the block?
Perversely there is an argument that the UK porn block will inadvertently make children less safe. One reason for this is that people are much more likely to use a VPN which then opens up different parts of the internet that may, for good reason, be blocked.
Pornographic content, for example, isn't illegal but abuse images are, as is terrorism of course. So using a VPN may well allow young people to stumble across these types of material by accident. Certainly the government's key argument here is about protecting children from accidentally seeing things that could damage them.
So what happens when someone is told at school to search for "beheading videos" and does so on a connection with no restrictions on accessing terrorist material online.
This might sound like a leap, but VPNs and TOR may well give children access to the bits of the internet we really want them to stay away from. TOR, for all its legal uses also facilitates accessing dark web sites where drugs can be bought, and worse. Pushing vulnerable young people to use these technologies is a definite risk.
There are also concerns that it could prevent young people from accessing vital information about their own sexuality that could cause them problems. This might have a profound impact on young people growing up in families where they don't feel able to ask adults around them about their feelings and want to turn to the web to understand.
There is also the very real problem that the government is exerting control over the public internet. Nation states acting as the arbiter of what people can see without special permission is a worrying trend that we've seen in other parts of the world and would, likely, prefer not to see in the UK.
Is this a privacy disaster in the making?
There is, of course, enormous potential for this block to backfire massively. One of the biggest problems is that Mindgeek provides a very significant proportion of the adult material online. It's also heavily involved in AgeID and, by extension, the PortesCard.
While the company claims it's not retaining information used in the age verification process we don't know what potential there is to link the two.
If records are somehow kept of the real name used in the age verification system then they could, conceivably be paired with someone's browsing history on PornHub. It's doesn't take a spectacular leap of imagination to see people being outed for their perfectly legal sexual preferences.
The consequences of such information being uncovered by hackers or leaked through incompetence could range from mild bullying right through to people losing their jobs. The ultimate consequence is that it could cost lives if it drives people to take their own lives.
Providers of age verification systems will, of course, have to abide by GDPR rules but mistakes are made and no amount of fining can prevent accidents or poor security from being a problem.
What are the costs of compliance for adult sites?
The porn block will have financial implications for everyone, in some cases those costs will be considerable. At the most basic level it will cost the taxpayer money because the government will invest time and money into policing it. There will also be potential lawsuits to defend, especially if the BBFC asks ISPs to block sites that the challenge that decision in court.
The costs of implementing age checking will also have to be borne by someone. Porn sites will need to add the functionality to their sites. For large companies like Mindgeek that will be trivial, for smaller providers it might be too much to bear. For those who don't want to comply, blocking UK traffic is the simplest way to avoid large costs.
To verify ages porn companies will need to pick one, or perhaps several, of the BBFC's approved identification providers. These companies obviously need to fund those ID checks and there are a couple of ways they'll do this.
Mindgeek, which runs AgeID, will not charge consumers directly to verify their age. Instead it will charge porn companies for each customer they need to verify. Again, this is absolutely fine for big sites - although it's money they would presumably prefer not to spend. But smaller, bespoke providers will find it harder to find this money - it may well be cheaper for them to block UK customers entirely.
The other option puts the cost of running the service on customers directly. It will be possible to pop to your local newsagent and buy a Portes Card which will cost either £4.99 for a single device or £8.99 for multiple phones, tablets or computers. You'll be able to buy one of these cards at any PayPoint retailer and most people live within a mile of one of those.
It is, presumably, possible for paywall protected sites to use a customer's credit card to verify that they are over 18. However it may be that the BBFC doesn't deem this suitable protection, as minors may "borrow" credit cards in order to circumvent the block.
