Online Pornography: Age Verification

With permission, Mr Speaker, I would like to make a statement. As the House knows, the Government announced that age verification for online pornography, under the Digital Economy Act 2017, would come into force on 15 July 2019. It has come to my attention in recent days that an important notification process was not undertaken for an element of this policy, and I regret to say that that will delay the commencement date. I wanted to take the opportunity to come to the House as soon as possible to apologise for the mistake that has been made and to explain its implications.

In autumn last year, we laid three instruments before the House for approval. One of them—the guidance on age verification arrangements—sets out standards that companies need to comply with. That should have been notified to the European Commission, in line with the technical standards and regulations directive, and it was not. Upon learning of that administrative oversight, I instructed my Department to notify this guidance to the EU and re-lay the guidance in Parliament as soon as possible. However, I expect that that will result in a delay in the region of six months.

As the House would expect, I want to understand how this occurred. I have therefore instructed my Department’s permanent secretary to conduct a thorough investigation. That investigation will have external elements to ensure that all necessary lessons are learned. Mechanisms will also be put in place to ensure that this cannot happen again. In the meantime, there is nothing to stop responsible providers of online pornography implementing age verification mechanisms on a voluntary basis, and I hope and expect that many will do so.

The House will also know that there are a number of other ways in which the Government are pursuing our objective of keeping young people safer online. The online harms White Paper sets out our plans for world-leading legislation to make the UK the safest place in the world to be online. Alongside the White Paper, we published the social media code of practice under the Digital Economy Act 2017, which gives guidance to providers of social media platforms on appropriate actions that they should take to prevent bullying, insulting, intimidating and humiliating behaviours on their sites. We will also publish interim codes of practice detailing the steps that we expect companies to take to tackle terrorist content, and online child sexual abuse and exploitation. These will pave the way for the new regulatory requirements.

We set out in the White Paper our expectation that companies should protect children from inappropriate content, and we will produce a draft code of practice on child online safety to set clear standards for companies to keep children safe online, ahead of the new regulatory framework. During the consultation on the White Paper, technical challenges associated with identifying the specific ages of users were raised, so I have commissioned new guidance, to be published in the autumn, about the use of technology to ensure that children are protected from inappropriate content online.

The new regulatory framework for online harms that was announced in the White Paper will be introduced as soon as possible, because it will make a significant difference to the action taken by companies to keep children safe online. I intend to publish the Government response to the consultation by the end of the year, and to introduce legislation as soon as parliamentary time allows after that.

I recognise that many Members of the House and many people beyond it have campaigned passionately for age verification to come into force as soon as possible to ensure that children are protected from pornographic material they should not see. I apologise to them all for the fact that a mistake has been made that means these measures will not be brought into force as soon as they and I would like. However, there are also those who do not want these measures to be brought in at all, so let me make it clear that my statement is an apology for delay, not a change of policy or a lessening of this Government’s determination to bring these changes about. Age verification for online pornography needs to happen. I believe that it is the clear will of the House and those we represent that it should happen, and that it is in the clear interests of our children that it must.

I thank the Secretary of State for advance sight of his statement and the sincerity with which he has made this apology today. However, the statement is proof that a serious and important policy has descended into an utter shambles under this Government. I would like to ask the Secretary of State one question that he did not answer in his statement: when did he find out about this? He says that it was in the last few days, but could he be a bit clearer about that?

Age verification was supposed to be introduced last April; it was delayed. Then it was going to be introduced next month, and today we hear it is going to be delayed again. The Secretary of State says he regrets this. We do too, very much, because it is not good enough—it is not acceptable and it is letting children down. Recent reports showed that 70% of eight to 17-year-olds have seen images and videos that are not suitable for their age in the past year. Given the rise in the use of mobile devices and tablets in the past decade, the case for appropriate online pornography enforcement has increased.

The Secretary of State says that an administrative error caused the failure to notify the European Commission of key details, but are there more fundamental problems with this policy? Can the Secretary of State give us a commitment about exactly when it will be introduced? Indeed, is he confident that it will ever be introduced? When the legislation was going through this place, Labour raised serious concerns about whether the verification process was viable, and whether the process could work if very personal data was given over to commercial pornography sites. This delay shows we were right to be concerned. Is he confident that such extremely sensitive personal data will be safe from leaks or hacks?

Media reports from earlier this year showed serious flaws in the system, with journalists able to create fake profiles that circumvented age checks in minutes. Is the Secretary of State sure that when—if—the policy is finally introduced, it will actually work? The ultimate sanction under the age verification regime was the power to block rogue sites, with internet service providers compelled to comply, but new encrypted browser software is about to undermine this system fundamentally. The encryption will mean that ISPs are blind to the sites that users visit on the internet, and they will be unable to block rogue sites that compromise the safety of children. That system—DNS over HTTPS—undermines not only the age verification system, but the entire foundations of the regulation laid out by the Government in the online harms White Paper. Does the Secretary of State agree that online companies are outsmarting the Government, and that we urgently need to know how the Government plan to catch up?

I thank the hon. Lady for her remarks. As she knows, I have spoken to the shadow Secretary of State about this issue—I accept that he cannot be here today and I am grateful to her for stepping in.

The hon. Lady raised a number of issues, starting with when I discovered the error. The answer to that is Friday last week, and my hon. Friend the Minister for Digital and the Creative Industries found out a couple of days before that. As the House would expect, we have spent the intervening time seeking to confirm that there is no alternative way of doing what I have described. We do not believe there is, hence the course of actions that I have set out to the House.

The hon. Lady rightly asked about personal data and privacy, which is an area of concern. As she knows, it was discussed during the passage of the Digital Economy Act 2017 and subsequently. I do not believe that it is impossible to reconcile the important requirement that people’s data and privacy are protected with the equally important requirement that children are protected from material they should not see. It is perfectly feasible to do those two things in parallel, which is what we seek through our approach. As she knows, the British Board of Film Classification, which will be the regulator for this, has taken steps to ensure that beyond the requirement on all relevant companies under the general data protection regulation parameters, an additional scheme will be available to those who wish to take advantage of it. That scheme will set out a higher gold standard for privacy, which we believe should be publicised to those who may wish to use these services.

The hon. Lady mentioned sanctions, but she will recognise that the issue under discussion is not sanctions for a breach of the requirements, but notification of them to the European Union. It is important to understand changes in technology and the additional challenges they throw up, and she is right to say that the so-called “D over H” changes will present additional challenges. We are working through those now and speaking to the browsers, which is where we must focus our attention. As the hon. Lady rightly says, the use of these protocols will make it more difficult, if not impossible, for ISPs to do what we ask, but it is possible for browsers to do that. We are therefore talking to browsers about how that might practically be done, and the Minister and I will continue those conversations to ensure that these provisions can continue to be effective.