Jump to content

Recommended Posts

I can see that a number of people have mentioned GDPR (and its equivalents). 

 

This is something that Brother Tyler and I are well aware of (my real-life job requires me to have a reasonable understanding of GDPR, particularly around the collection and storage of sensitive personal data, so I hope that provides some reassurance).  We are keen to not store sensitive personal information if we can possibly avoid it. 

 

We are considering what options are available to us. I have noted with interest that any attempts to introduce age verification through facial identification appears easy to circumvent, particularly through the use of AI images. There was even a story about an Australian teen nabbing her parent's ID card and using that to retain access to a social media site she was already on. So if we implemented something, we might have to accept that it was imperfect. From the viewpoint of the Australian government it may be more important that a site tries.

 

 

Someone mentioned the algorithmic nature of some of the sites mentioned. The self-assessment tool is less interested in that than whether a site promotes sustained engagement. Some of the sites that have an engagement do use algorithms (YouTube most obviously). However, it seems that these sites are used as tools in other ways (Discord for gaming and it is worth noting that gaming is currently exempt, although it is being actively debated by Australian MPs, apparently). YouTube will be used for some of the educational content and it might take time to separate this out. Personally, I think that we pose very little threat to teens in terms of content because we have consciously aimed to maintain a family-friendly atmosphere. If we had not, we might have had to implement age-verification in response to the UK Online Safety Act (and I note that the UK regulator, OfCom has recently fined a large forum for not implementing such restrictions and then for not responding to them).

 

Whilst it is highly unlikely that we pose a threat to Australian teenagers or would be a principle target of the legislation, we do need to consider our response to it.

As an initial adjustment, we've updated our Terms of Use to include a provision that all [prospective] members must be at least sixteen (16) years of age in order to register and maintain an account within the community. This is for everyone, not just our members from Australia. Members registering new accounts will have to enter their birthdate to verify their age. We all know how easy it is to lie when entering information on the Internet, however*, so that is just a minimum effort stop-gap until we figure out our long-term solution. Existing members will have to re-sign the Terms of Use (you've probably already done that if you're reading this while logged in), but that won't force them to enter their birthdate if they haven't already done so.

 

Is this legislation intended to reduce online participation? Not in theory, except that it is meant to "delay" (the wording of the legislation) participation by minors. By extension, it is intended to reduce illegitimate participation (i.e., that which is harmful to minors). Since the legislation demands some form of identity verification, however, an obvious unintended consequence is that many existing/potential legitimate users will choose not to participate over concerns about privacy. I doubt that anyone here wants to submit their identity for verification (I know that I don't, and I own the site).

 

Is this legislative overreach? I have an opinion on that, but I'm not a lawyer, so I'll refrain from voicing that opinion. What really matters is whether or not the legislation can be enforced. In the absence of any expert input on that, and in the absence of any [known] precedent, we're going to assume that the legislation can be enforced. If we simply assume that it can't, but it turns out that it can, fines would kill the site. So our plan of action will be based on preserving the site and its ability to serve the community. If it turns out that this legislation has no teeth, we'll still make every reasonable (and affordable) effort to fulfill its requirements (after all, the safety of all our users is vitally important), but we're not going to over-extend ourselves beyond reason.

 

I can't envision any solution where we would require members to submit their identity information to us. If we implement some form of identity verification, it will be some external process that simply provides us with a greenlight that a [prospective] member meets the requirements; and ideally it will be some solution that doesn't retain any records on file, protecting your PII. At this point we don't know exactly what we're going to do, however. Suffice to say that protecting your PII is just as important to us as protecting our own PII.

 

We don't yet know what other major social media platforms are doing to fulfill this requirement. We are monitoring them, however, and will likely mirror the minimum measures that are taken by those other platforms (i.e., the lowest common denominator) if they are legally sufficient.

 

For what it's worth, if your account is more than sixteen years old, you're safe.

 

 

 

* How many times have you actually read the complete Terms of Use/End User License Agreement when creating an online account?

If possible, could the chosen method of age verification be announced ahead of it's implementation?

It'd give people time to go apply for a Credit Card if that's the chosen verification method (since not everyone has one/has access to one even if they're legally old enough).

Yes, we will notify the community of the options we are looking at and the identification methods used by each. Hopefully, members won't have to go out and acquire any new form of identification/age verification method, however.

57 minutes ago, Teetengee said:

do the Australian goverment even have the ability to levy any sort of punishment against the owners of the site?

 

The answer to that is 'maybe'. Law involving internet jurisdictions is still evolving and is, to put it mildly, complicated. Some jurisdictions consider that you operate within them if you have a significant number of users/customers from that jurisdiction. By that definition we might be considered to operate in Australia, depending on how a jurisdiction chooses to define 'significant.'

 

The internet forum I mentioned in my earlier post has decided that it's servers are not in the UK and therefore it does not need to comply with the Online Safety Act despite the fact that it has a number of UK users and is available from the UK. It will be interesting to see how that works as a test case, although it is unlikely to be directly transferable to the Australian context.

 

Often these things come down to who can afford the best lawyers.

 

26 minutes ago, Gillyfish said:

 

The answer to that is 'maybe'. Law involving internet jurisdictions is still evolving and is, to put it mildly, complicated. Some jurisdictions consider that you operate within them if you have a significant number of users/customers from that jurisdiction. By that definition we might be considered to operate in Australia, depending on how a jurisdiction chooses to define 'significant.'

 

The internet forum I mentioned in my earlier post has decided that it's servers are not in the UK and therefore it does not need to comply with the Online Safety Act despite the fact that it has a number of UK users and is available from the UK. It will be interesting to see how that works as a test case, although it is unlikely to be directly transferable to the Australian context.

 

Often these things come down to who can afford the best lawyers.

 

 

I would like to note that if the internet forum you mentioned is the one I am thinking it is (the one with "4" in the name), OfCom is going to have a really hard time actually getting anyone to pay that fine even if it sticks, since I don't think any of the listed owners actually interact with that forum anymore.

Edited by Indy Techwisp
ETA clarity
2 hours ago, Indy Techwisp said:

I would like to note that if the internet forum you mentioned is the one I am thinking it is (the one with "4" in the name), OfCom is going to have a really hard time actually getting anyone to pay that fine even if it sticks, since I don't think any of the listed owners actually interact with that forum anymore.

 

Couldn't possibly comment... :happy: 

 

The question of whether it sticks is of particular interest with the question of who it sticks to being only secondary at present. If, indeed, it was them we were talking about. :whistling:

Is Australia banning Discord?

 

Australia social media ban set to take effect, sparking a global crackdown

 

Edited by Brother Tyler
Adding more articles as they enter my news feed.

I just went through the member database and all accounts with birthdays that were less than 16 years old have been deactivated (but not deleted). If nothing else changes (as far as our process goes), each of these accounts will be reactivated when they reach the sixteen-year mark.

 

There are over 25,000 accounts that are 16 years or more old, so those are obviously of age.

 

I am skeptical of many of the birthdays entered, however. For example, there are over forty whose birth years are 1910 or earlier, including one that is listed as 1874. And those are just the most obvious of the entries that are questionable. A more convincing lie would be to simply make oneself 21 years or more old. There is also someone claiming to have been born on February 31.

 

And then there are the 22,577 accounts that are less than 16 years old and for which no birthday information is listed. In addition, there doesn't appear to be a way to make birthdays mandatory - all we can do is select between three options for who birthdays appear to (right now the system is set so that the only people who can see a member's birthday are the admins and the member themself, though you'll see a block wishing members a happy birthday on their birthday).

 

As you can see from the articles I listed above and by evaluating some of the information I've provided in this post, self-reported birthdays are insufficient to meet the intent of the Australian regulation. Also, this isn't likely to stop with Australia, so you can expect us to implement some solution that applies across the board. And since it looks like this is something that will likely extend beyond Australia in the future, it's possible that Invision will incorporate something to help clients out.

 

We're still exploring our options, but we're doing our best to implement reasonable measures in the interim.

1 hour ago, Doghouse said:

So a genuine question, what are the credible chances of the B&C actually being picked up on this and what are the consequences?

 

At this stage, slim, from my reading of the information so far, and up to a 50M AUD Fine.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.