ANDREW LIMBONG, HOST:
Just a heads up. This conversation might not be appropriate for younger listeners, who can come back to us in about seven minutes or so, because we'll be talking about a new law in Louisiana that's meant to stop kids from accessing porn online. It's known as Act 440. And how it works is like this. If you are in Louisiana and you go to a popular porn website, say Pornhub, you'll be prompted to hand over information from your driver's license or other government ID to a third-party website to make sure you are of age. The law went into effect this year, possibly opening up some privacy issues. Jason Kelley is associate director of digital strategy at the Electronic Frontier Foundation - that's a nonprofit dedicated to defending digital privacy and free speech - and he's co-host of their podcast, "How To Fix The Internet." And he joins us now. Jason Kelley, welcome to the program.
JASON KELLEY: Thanks so much for having me.
LIMBONG: All right, so what was your initial reaction to this law? Louisiana, you know, is the first state to implement this specific piece of legislation. But is there, like, similar laws out there?
KELLEY: There aren't. It was somewhat surprising to everyone who works in this space because I think the law went somewhat under the radar and suddenly it was being reported on. And we thought, oh, wow, this is something we hadn't heard of before. But it isn't new. There were previous laws - in specific, a federal law called COPA, the Child Online Protection Act, which is about 20 years old now and is no longer in effect because it was deemed unconstitutional. So it's not a total shock that this exists, but it was a little surprising to those of us who had been following these sorts of things.
LIMBONG: Now, what concerns should people have about this requirement to submit sensitive data to enter these sites? I mean, you're getting kicked to a third-party site. How reassured should one feel that their information isn't being collected or retained?
KELLEY: It's reasonable for people to be concerned that their data is going to go somewhere that they don't expect. People have been surprised that information that they've shared with websites has gone places that they didn't expect it to in the past, you know, many times, whether that's because of a data breach or because of third-party data brokers. In this case, the laws explicitly asks that companies who do collect this information to verify age don't retain it and don't share it. But it's difficult for people to confirm that that's happening. And also, if you want to push back and say a company has done something with my data that they weren't supposed to, you have to show damages. So it's a little bit difficult to take a company to court and push back if they do collect that information.
And there's bigger problems, really, with the fact that people are going to be sharing their information with sites that they've never heard of, whether it's the site itself or the third party. You know, you might trust that a large site, like a Pornhub or something like that, has a comprehensive solution with a third party verifier that has its entire business based around age verification or identity verification. But when you go to a smaller site that maybe most people haven't heard of or you've never even seen before...
LIMBONG: Is niche, yeah.
KELLEY: Exactly, a niche site - and there are plenty of them. There are plenty of niche pornography sites online. You're not going to know, really, how to trust that verifier or that site. And this is a particularly scary area for people because pornography is already used to collect private data about people to kind of trick them into downloading malware. And now these sites have a legal basis for asking a person who's visiting a niche porn site to upload their identity information. And so you can imagine what happens if a site collects that information and could potentially share it.
Of course, you would be able to sue the company, but it's not always going to be easy, especially if that company is perhaps based outside of the U.S. and is using that information for blackmail or identity theft or anything else, you name it. The concerns are real. And so when you do drive people from a popular site to further and further kind of niche sites, that could mean that those sites are sharing, potentially, child sexual exploitation material or other material that's made nonconsensually because there are just sort of fewer rules the further away you get from those platforms.
LIMBONG: The backers of the law say that it'll prevent children from watching porn, right? I think the obvious question is, does it?
KELLEY: I don't think anything prevents children from watching porn. I think it's going to be impossible to prevent anyone from doing something online that they really, really want to. Where there's a will, there's a way, and there's a lot of will for young people to look at sexually explicit material.
LIMBONG: Yeah. Are there, like, good-effort brainstorming ideas being thrown around about preventing children from accessing porn websites?
KELLEY: There are all sorts of parental supervision apps that you can add to your phone. These aren't perfect, but they aren't as bad as wholesale blocking of content and forcing, you know, millions of people to share their private data. Because at least in this way, you can decide for your own household what your child can and can't see. And you can also look at the history of what they've seen.
LIMBONG: Yeah, I mean, the difference there - right? - is that that's a consumer end solution to the problem - right? - versus a - yeah - at the distributor side.
KELLEY: If you're thinking about ways that the internet itself, sort of within its infrastructure, can be better about allowing young people to access or not access certain types of content, it's not clear that there is a better solution. Age verification is something that's been thrown around for a long time, and it doesn't really pass muster for a lot of privacy advocates. And it's not the case that there is an alternative. It's really up to the parent to have conversations with their kid and to really make sure that they know what's happening on the devices that their teenager is using. So it is kind of up to the consumer at this point, and I don't know that that's the worst thing in the world.
LIMBONG: Jason Kelley is an associate director of digital strategy at the Electronic Frontier Foundation. That's an international digital civil liberties nonprofit based in San Francisco. And he's co-host of their podcast, "How To Fix The Internet." Jason Kelley, thank you again for joining us.
KELLEY: Thank you. Transcript provided by NPR, Copyright NPR.