Age Verification for Online Platforms in Canada: Policy Considerations from the Adult Content Sector

Résumé analytique

Online age verification is technically achievable, already in use, and will need to form part of any serious Canadian legislative response to online harms affecting children, whether that is a ban on social media or the enforcement of age-appropriate design. This research note examines the current state of age verification technology and practice, drawing on the experience of adult content platforms operating under the United Kingdom's Online Safety Act 2023, and outlines policy implications for Canadian policymakers.

Seven distinct methods of age assurance have been recognized as compliant under the UK framework: facial age estimation, photo ID matching, digital identity services, credit card and open banking checks, mobile network operator verification, and email-based estimation. No method is perfect, and policymakers should not expect one to be. Methods relying on an existing financial or contractual relationship are generally simpler to implement but are unsuitable where the threshold falls below contracting age, as it would under proposed under-16 social media restrictions. Facial age estimation is currently the most inclusive option for all age groups, but its accuracy is best evaluated through independent testing rather than vendor claims, and it depends on a robust data-protection regime.

The note identifies genuine trade-offs. Privacy and anonymity concerns are real, particularly for photo ID and biometric methods. Evidence that verification drives users to less safe services is mixed: adult VPN use has been significant in some jurisdictions, but there is no corresponding evidence of increased VPN use among children. The UK's enforcement record and Australia's early experience suggest compliance is achievable but depends heavily on platform cooperation and regulatory capacity. For Canada, age verification requires a broader legislative architecture than is currently in operation, including a privacy regime, an independent regulator, and a Child Rights Impact Assessment, not a standalone technical fix.