The Tory culture and media secretary, Sajid Javid, has announced that a Tory government would force age verification controls upon hardcore pornography sites. While complicated, this is not impossible. The policy debate about whether and how to control sexual information and pornography is broad and diverse. While this policy is nested in those larger debates, it is also at its core an extension of existing, relatively uncontroversial policies on preventing children from seeing pornography in the pre-online world.

British regulators have previously called for age verification controls for adult content. The Authority for Television On Demand (ATVOD) in 2013 sought to cut off payments to sites who did not implement age restrictions. A 2014 House of Commons Culture, Media and Sport Committee report on online safety cited age verification as a method to prevent children from seeing pornography.

Setting aside the question of whether it is appropriate for government to restrict certain content to children, is the announced Tory policy feasible? Yes, it is. The technology and the data exist to furnish the UK public with online credentials that could reliably assert age. The policy hinges on there being a business model to sustain age verification services, how privacy will be handled, and whether there is the political appetite to enforce it through blacklisting.

Adult content businesses will not implement their own age verification controls – they will rely on third parties to make age assertions about their users. Pornography consumers will therefore have to be enrolled in a service that allows them to login in a verified way to adult sites. There are two main ways this could happen:

• A payment mechanism like a credit card can be used to assert that a person is over 18. As under 18s can get a credit card with an adult guarantor, the credit card companies would have to alter their operations somewhat for this to work. The benefit of this approach is that many adult sites accept credit card payments and so there is already a business and technical relationship in place to build upon.
• An ‘identity provider’ could issue credentials that assert the age or an ‘over 18 claim’ to an adult site. Such companies already exist and are the basis of the Gov.UK Verify initiative which seeks to provide credentials for people to access government websites.

A key issue is that using a third party for online access means that someone is always looking over your shoulder. Since the content in this case is porn, people are going to be very sensitive about revealing their online habits and preferences. Many people will not like Visa or Mastercard and all of the intervening banks knowing which adult sites they visit, and those companies are not currently set up to hide or delete that information from their transactions. Identity providers can do this more readily, but there is a cost to creating privacy-preserving systems, to say nothing of the trust that people would have to place in companies that they are living up to their privacy promises.

Technically, it is certainly possible to build age verification systems that obfuscate the identity of the user from both the porn site and the identity provider. Again, this is an issue of business: who will pay for it, and is the model sustainable? The gambling sector has had age verification controls in place for years but not the ability to hide identity. It’s a complicated design, but possible. An alternative method would be for identity providers to scramble the user’s identity internally where it connects to the list of sites visited, and prevent the ID from being unscrambled except in the case of a court order. This would require a good deal of policy development with ATVOD. In any model, though, payments further complicate the issue as they are inevitably tied to a specific person.

No age verification policy will succeed without the political will and policy appetite to blacklist sites that do not comply. For sites based in the UK, the government will have greater ability to threaten them with legal action or closure. But for adult sites outside the UK, sanctions become far more difficult. The most direct route would be blacklisting sites at ISPs the way that the UK government is dealing with torrent sites. This would result in the same problem as torrent blocking, though – mirror sites and other methods that easily evade the blacklists. However, large adult sites like PornHub could comply nonetheless because it might hurt them enough economically. The real question is what happens when the UK porn-consuming public wakes up to find their porn sites blocked and the need to register with a third party to see their favourite stimuli? Will politicians and regulators be able to stomach the inevitable backlash?

Since the policy goal of extending age controls for pornography into the online world is not new, it’s arguable that Sajid Javid’s announcement is an attempt to stir up the party’s voting base in a calculated “Won’t someone think of the children?!” play prior to the election. The political cost of making that promise is low – keeping it is another matter.

Dr Gilad Rosner is a visiting researcher at the Horizon Digital Economy Research Institute.