Social media upstart Bluesky has turned on age verification. I took a walk through it to see how the process works.
When I logged into Bluesky today, there was a message informing me that I need to prove I’m an adult. I dutifully tapped and was asked to ‘Verify now’.
It’s worth noting that Bluesky is not (yet?) named as one of the services that must enable age verification.
Bluesky is using a third party called Kids Web Services (KWS). A quick check via Whois reveals that KWS was first resisted in 2016. At least that tells us that it’s not a company that recently popped up to profiteer from the new ban. KWS claims it is the most widely deployed parent‑verification solution on the market.
To verify my age, I have three options: Face Scan, Credit Card or ID Scan. KWS says:
KWS will use the verification details you provide only to verify your age. Once successfully verified, KWS remembers your verified status. This means you won’t need to verify again when using this email for other games or services powered by KWS technology.
Looking a little further, the only information KWS says it holds is:
- your verified status
- hashed email address
If you use an Apple’s Hide My Email, this may be a problem. Hide My Email enables you to create unique email addresses for each service you use. This is good practice for minimising the impact should a site or service you use suffer a data breach. But it means each email address will need to be separately verified.
KWS outsources the verification process
I chose the Face Scan as I am extremely reticent to provide any documents to a third party that I don’t know. KWS says it encrypts your photo securely, preventing anyone from seeing, storing, or sharing it. The company’s privacy policy does not specify what kind of encryption that might be.
KWS has outsourced Bluesky’s age verification to another service called Yoti.
Age verification data retention
Yoti says:
For most age-checking methods, the data is deleted as soon as the check is complete. In some cases, the Yoti Client will configure a manual review of an ID document age check in which case Yoti will process your data for 28 days.
Importantly, Yoti will only hold records relating to its clients, including KWS, for six months. Once Yoti deletes its records, it will be up to KWS to retain the age verification information. KWS’ privacy policy says
…we retain personal information for as long as necessary to fulfil the purposes we collected it for…
If you thought the social media age ban was a little messy, a dive into the rabbit hole of how just one service does this will do little to instil confidence.
Verifying with a Face Scan
As you’d expect, there are a couple of checkboxes about consenting to the use of your computer’s camera, privacy policies and use of an image to estimate age.
The process does say that the image remains private and is not saved.
After getting really close to my camera, I was able to take a picture and successfully pass the age verification process. This only took a few seconds.
This part was easy. I returned to Bluesky after hitting the OK button. No doubt I will need to repeat this process for my other accounts with that service.
Anthony is the founder of Australian Apple News. He is a long-time Apple user and former editor of Australian Macworld. He has contributed to many technology magazines and newspapers as well as appearing regularly on radio and occasionally on TV.