Fact Check: Age Verification for App Stores and Privacy
Would the App Store Accountability Act make you share more personal data with Apple and Google? The answer is yes, despite claims to the contrary.
Under the App Store Accountability Act (an age verification bill), users will need to provide more personal data to Apple and Google before they can access their app stores. Claims to the contrary are false—and are based on a major technical error.
Age verification bills often raise privacy concerns, but does age verification for app stores offer a novel approach that avoids these concerns? In written testimony to Texas’s legislature, Joel Thayer, who “developed the legal and policy framework” for this approach, claimed that the answer is yes:
The Act even avoids the obvious privacy objection that Big Tech organizations like to lodge against age verification measures at the website tier. App stores already have all of this age information. This means that the user would not need to proffer more data to these platforms — a distinct characteristic from website-level age verification requirements.
After the federal version of this bill was introduced, many prominent supporters also made similar claims. It’s a rather remarkable claim about privacy—one that could easily persuade many people to support this act. It’s also a false claim; users would have to “proffer more data to these platforms.”
“App stores already have all of this age information.” Thayer’s mistake here is subtle but important: an inability to distinguish between an attested age and a verified age.
App stores do already have age information, but what they have is an attested age.
Let’s use Google as an example. Google’s app store knows who you are—or perhaps more accurately, who you claim to be—based on your Google Account. And you did tell Google your age when you created that Google account.
But did Google make any attempt to verify that age? No. You can lie about your age here, just like you can lie when a website asks you to enter your age. What Google has collected is merely an attested age, not a verified age. (It’s the same for Apple.)
The App Store Accountability Act, however, requires a verified age. And to verify that age, you will need to provide more personal data to Apple or Google.
To make matters worse, the App Store Accountability Act age-gates every app, not just apps that may be inappropriate for children. If you want to download a Bible app, you will need to verify your age with Apple or Google first.
While I’m here, I want to briefly make another key point: when evaluating the privacy concerns of age verification, the specific requirements of an age verification bill matter just as much, if not more, than the current state of age verification technology.
From a privacy perspective, these are two dramatically different bills:
I just need to verify if a person is 18 or older.
I need to verify if a person is 12-, 13-15, 16-17, or 18+. For users under 18, I also need to verify parental consent—which requires verifying a parental relationship. Also, I will force app stores to share age data with millions of app developers.
For example, while facial age estimation is a newer and more privacy-conscious method of age verification, it doesn’t work if you need granular age categories, such as 13-15 or 16-17. And that’s just scratching the surface…