Identity Verification on Social Media Platforms

(1)

Master Thesis

Identity Verification on Social Media Platforms

To What Extent is an Identity Verification on Social Media Platforms Implementable on European Law Level?

by

Esin Küçük Student Nr. 13406256

Supervisor Dr. Candida Leone

Amsterdam, 08.07.2022

(2)

II

A BSTRACT

As social media platforms have an increasing power and offer their user a variety of possibilities to use them and integrate social media in many areas of life, the platforms also enable the user to create an online existence which does not have to be the same as the one in the offline world. Consequently, the user has the possibility to act anonymously online. While this can be beneficial for the individual and the society as a whole, it also bears the risk of online misbehaviour and crime which is due to the anonymity not traceable and therefore difficult to investigate. Due to the fast and ongoing development of technology and the infinite possibilities social media platforms offer, it seems necessary to pursue a way of dealing with these challenges. By introducing an identity verification on social media platforms the issue of online anonymity may be solved. Many social media platforms have already introduced their own verification policies. These verification policies differ not only in the verification process depending on the platform’s purpose and the user’s interest, but also target different kind of users. Since there is still no universal verification policy for social media platforms, many countries discuss to introduce an identity verification by law. As the European Union aims to ensure equal rights and protection for their citizen, regulating an identity verification on social media platforms on European law level seems pursuant to the European values. However, the user’s privacy rights are in this context of high importance as the protection of the user’s information and data and the right to privacy concerning the right to informational self-determination may be interfered. Within this research, three approaches regarding a regulation to implement an identity verification are evolved. The first approach, focuses on a possible regulation of an universal mandatory identity verification with a government-issued document in order to have access to the social media platform. The second one suggests to regulate an identification based on the platform’s purpose but is mandatory for the user in order to be active on the social media platform. Lastly, the third approach refers to the implementation of an obligation for each social media platform to provide an identity verification method depending on the platform’s purpose which is available for every user.

This thesis assesses if each of these approaches are lawful regarding the protection of the user’s data and right to privacy, by addressing the user’s interests and rights on the one side and the public’s interests on the other.

Keywords: social media platforms, anonymity, identification, identity verification, right to privacy, right to informational self-determination, data protection

(3)

III

T ^{ABLE OF} C ^ONTENT

Abstract………..II

Table of Content………III

Abbreviation List………..IV

I. Introduction………..………1

II. The Online Identity Verification……….……….3

1. The Online Identity Verification and Social Media Platforms………...4

a. Verification Policies Introduced by Social Media Platforms……….5

aa. Content Sharing Platforms………..6

bb. Blogging Platform………...9

cc. Dating Platform……….10

dd. The User’s Interests in Verification Policies Introduced by the Social Media Platform and the Effects on the User’s Behaviour……….…..11

b. Identity Verification by National Law……….……….14

c. Potentials and Risks……….……….17

III. Identity Verification on Social Media Platforms Regulated by European Law…20 1. Challenges of the Protection of Personal Data and Right to Privacy regarding the Identity Verification on Social Media Platforms………..……21

2. Approaches to Regulate the Implementation oft he Identity Verifiction on Social Media Platforms……….24

a. The Universal Identity Verification which is Mandatory to Access the Social Media Platform……….……24

b. The Identity Verification which is Mandatory tob e Active on the Social Media Platform……….26

c. Voluntary Identit Verification Available for Every User………..27

IV. Conclusion………...………….28

(4)

IV

A BBREVIATION L IST

Art. Article

CFR Charter of Fundamental Rights

e.g. exempli gratia

ECHR European Convention of Human Right

EU European Union

GDPR General Data Protection Regulation

ID Identification Document

(5)

1 I. Introduction

“I share, therefore I am.“¹

Social media platforms have an increasing power on every day’s life. Facebook, Instagram, and Bumble might be a few of the most popular ones in Europe. Almost everybody here uses at least one of these social networks. Social media platforms are not only connecting people with their families, friends, and persons they don’t even personally know, but also making the users take part of each other’s life by liking, commenting, or sharing parts of their life that they want to be seen by the others. While social media platforms seem to connect people more closely, they also simplify the communication and interaction. Face-to-face communication is more and more replaced by online communication possibilities. The gained benefits of posting any content or in general being active on social media can be categorised into three fields: the psychological gain (e.g. attention from peers), political gain (e.g. propaganda), and financial gain (e.g. monetary profits from click traffic and ads).² The user has the power to build her online existence according to her own imagination, hence, to create a new online personality, a new online version of herself. Thus, the user has the ability to create herself in a new light or even as a completely new person. This possibility gives the user even the chance to act anonymously. The right to use digital services anonymously is supported by 64 % of EU citizens, as a representative survey has found.³ Generally, anonymity is given when the acting person is unidentifiable. There are two types of online anonymity. First, there is the anonymity to the other users and the second one is the anonymity to the authorities. While anonymity can on the one side benefit the individual and the society as a whole, since it provides a protection in order to spread uncensored political and societal news and happenings or share experiences regarding personal or sexual developments, it can also bear the risk on the other side, such as spreading fake news, cyber bullying, and cyber criminality.

As it is already challenging to investigate these kinds of crimes in the offline world, the online world provides the user a special security shield in form of a higher level of untraceability and anonymity. Due to the fast and ongoing development of technology and the infinite possibilities to use social media platforms, it seems necessary to pursue a way of dealing with

1 An adaptation of the French philosopher René Descartes‘ quote “I think, therefore I am.”, used by Dr. Sherry Turkle in her TED Talk in 2012.

2 Shuting Wang, Min-Seok Pang, Paul A. Pavlou, ‘Cure or Poison? Identity Verification and the Posting of Fake News on Social Media‘ in Journal of Management Information Systems, 2021.

3 Survey done by opinion research institute YouGov in 2021, https://www.patrick-breyer.de/wp- content/uploads/2022/01/20220111_Presentation_YouGov_DSA_Poll.pdf.

(6)

2 these challenges. By introducing the requirement of an identity verification in order to create a social media account, the appeal of anonymity is limited. Not only can the identified user be held accountable for her online actions, the general certainty amongst the users and also between the user and the social media platform seems to be ensured. As some social media platforms have already introduced their own verification policies, which are not mandatory but provide the verified user mostly the advantage of a verified badge, it is questionable if such an identity verification shall rather be mandatory and regulated on a European level to ensure a unified solution within the European Union. In Germany, for instance, the Minister of Interior suggested within the draft of the amendment proposal of the German Telecommunications Act to introduce an ID-verification requirement for the users to open a social media account. Furthermore, in the United Kingdom and in France petitions regarding this idea were started. Since initial ideas and discussions regarding the mentioned approach are rising, the relation between an identity verification and the user’s right of protection of her privacy and data is of high importance. From a legal point of view, it is important to specify to what extent such a requirement of an identity verification is possible and compliant with the user’s privacy rights from a European perspective. Moreover, it is questionable which legal hurdles does this approach entail and what legal requirements must it comply with.

Here, the GDPR and the ECHR regarding the privacy rights shall constitute the base for the research concerning the legal challenges the identity verification on social media platforms is facing.

The first chapter of this thesis explains the online identity verification, followed by the relation of the online identity verification and social media platforms. Here, is firstly clarified what type of social media platforms are in the focus of this research. Then, the verification policies introduced by the social media platforms themselves are examined. Starting with the explanation of the need of these policies and the identity verification methods, this part also refers to the verification policies that are already introduced by the different social media platforms. Furthermore, also the user’s interest in these verification policies and their effects on the user’s behaviour is presented. In the next step, cases of discussions or even implementation of an identity verification by national law are shown. Lastly, the first chapter closes with the examination of the potentials and risk of an identity verification for social media platforms, where the interests of the involved parties are pointed out. The second chapter is assessing a possible regulation on European level of the identity verification on social media platforms. Here, the challenges of the protection of personal data and the right to

(7)

3 privacy in regard to the identity verification are shown. The legal basis in the GDPR of such a regulation and the effected fundamental right to privacy of the user is explained here. As this research aims to establish an approach in order to introduce an identity verification on social media platforms that covers both side’s interest, the thesis is then assessing three possible approaches that are developed on the basis of the previous chapters. This assessment focuses on the Art. 6 GDPR and the user’s right to privacy regarding the right to informational self- determination. Lastly, the research closes with the conclusion that presents an approach concerning the implementation of an identity verification on social media platforms regulated on European level.

II. The Online Identity Verification

In a traditional private in-person interaction, an individual introduces herself so that the other person knows her name and can see her appearance. Is this interaction not private, but rather with a company, institution, or organisation, the individual has to provide one or more identity documents while the other party can verify that the photograph and information on the identity document corresponds with the person and thus verify that the person is who she claims to be. The digital identity verification has the same goal and brings the concept of the traditional identity verification to today’s online world. It is considered as an important tool to ensure that the person’s identity matches the one, she claims to be online. There are many different types of digital online verification, which work by comparing the presented data with a verified data set.⁴ Examples for commonly used digital identity verification methods are the Knowledge-based Authentication, Two-Factor Authentication, or the Online Identity Verification.⁵ The latter one is especially used for opening a bank account, onboarding, or (financial) agreements, but can also apply for the identity verification of social media accounts. By using advanced algorithms and artificial intelligence online identity verification solutions determine if a government-issued document is authentic and belongs to the user.

Here, the verification is often performed by a validity check via a (real-time) selfie to ensure that the person holding the government-issued document is the same person shown in the document’s photo. Instead of a verification based on a photo, it can also be done within a streaming-video using the camera and microphone from a device (e.g. laptop or mobile phone). The online identity verification is considered as a convincing identification method as

4 https://www.onespan.com/topics/identity-verification.

5 https://www.jumio.com/compare-identity-verification-methods/.

(8)

4 it relies on valid government-issued documents and a selfie or video, provides a definitive yes or no result within minutes and a high verification assurance.⁶ Nevertheless, this kind of verification asks the user to allow to capture a photo of her government-issued document and to take a photo or video of herself. Thus, the user is required to share personal information and data which can possibly be considered as a disproportionate interference in the privacy depending on the used verification method and the balance of the interests. Therefore, it is important to examine how online identity verification solutions might be implemented on social media platforms and what goals and interests are being pursued with them.

1. The Online Identity Verification and Social Media Platforms

Social media platforms can be defined as interactive digital spaces that facilitate creating and sharing ideas, thoughts, information, any kind of expression, and content in general through the building of virtual networks and communities.⁷ Since their introduction into society, social media platforms evolved rapidly and have gained more and more popularity. Due to the huge success of platforms such as Facebook or Twitter, the number and type of social media platforms has also increased. As in the past the platforms were launched with mainly only one function, today one social media platform may provide its user several services. For instance, Instagram started as an application for photo-sharing but now allows its user to not only share photos and videos, but also to like, comment, and repost other user’s content , and to communicate amongst each other via messaging, calling or even video-calling. However, social media platforms can be classified into different categories according to their main purposes, such as content sharing, dating, or blogging. Within the scope of this thesis, only those social media platforms are considered that offer the user the possibility to reach a wide range of other users without necessarily having any personal information of them. This includes for instance Instagram, Twitter, or Bumble, but not WhatsApp because here the user must have the phone number of the other user in order to communicate with her and thus already has a validated information that can be related to the identity. Since social media platforms enable their user to engage in extensive activities in the online world, they have been also facing various criticism regarding the possibilities they are offering their user and the risks this empowering is bearing. Especially the ability of acting anonymously and thus being more or less untraceable is perceived as a hazard that can be avoided through an identity verification.

6 https://www.jumio.com/compare-identity-verification-methods/-

7 https://en.wikipedia.org/wiki/Social_media.

(9)

5 a. Verification Policies Introduced by Social Media Platforms

Concerned that these criticisms and the consequences may threaten their long-term viability, many social media platforms have introduced their own identity verification policies. The main idea is that the user would lose her anonymity to the platform and become more accountable for her online behaviour after she disclosed her personal information such as her phone number or government-issued photo identification (ID).⁸ However, identity verification policies were also confronted with much criticism and resistance, which led to the point that rather than establishing an universal compulsory requirement, many social media platforms decided to introduce different types of verification policies which aim to comply with the platform’s purpose and user’s interest in the verification. These policies may differ in the chosen verification method and thus the information required of the user (e.g. government issued document or just a real-time selfie), but also in the decision who is performing the verification meaning if the social media platform itself verifies the user or if the platform cooperates with a third-party service provider. This point is important in order to determine by whom the user’s information and data is collected and processed and hence who has access to these. Mainly, the social media platform itself does the verification by assigning an in-house team to develop and/or perform their own verification process. In this case, the user’s information and data stays between the user and the social media platform. Is the social media platform outsourcing the verification process to a third-party service provider it is depending on the individual verification policy if the social media platform still has access to the information and data or if it is excluded of the whole process. Generally, if the third-party service provider is running the verification process by its own meaning that it is collecting and processing the information and data itself, the social media platform is redirecting the user for the verification to the service provider and is just informed about the result if the user is verified or not. In this case, the social media platform has no access to the user’s collected information and data. However, if the social media platform is despite the involvement of the service provider still part of the verification process (e.g. not the user shares the required information but the platform is redirecting them to the service provider) then the platform consequently has access not only to the result of the verification but also to the information and data. In any case, the identity verification is only performed between the user and the social media platform and/or the third-party service provider. Consequently, the user’s highly

(10)

6 sensible information and data concerning her identity is in no case disclosed to other users.

Therefore, the identity verification does not equate to the user’s identity being known by the other users or everyone who has access to the platform. However, in order to be able to show the verified status of the user, most of the social media platforms reward the user after her verification with a verified badge. This is mainly done in form of a blue badge which is placed next to the user’s account name. In this way, the other users know that this account is verified without having access to the information and data in particular. In the following, the verification policies of the most popular social media platforms used in Europe that are already implemented are presented.

aa. Content Sharing Platforms

As two of the most successful content sharing social media platforms, Instagram and Facebook introduced their own verification processes years ago. It is important to note that even though both social media platforms are part of the Meta Platforms, Inc. and give the user the possibility to connect her Instagram and Facebook account, each verification is independent which means that the user has to verify her account on each platform separately.

Both verification processes provide the verified person a verified badge, which is a blue tick that appears next to the account’s name and is supposed to be a tool that helps other users to find the real account of public figures and brands.¹² In order to request a verified badge, the user must be a public figure, celebrity or brand and has to meet certain requirements, such as that the account has to be authentic, unique, complete and notable. First, the user has to enter her full name and provide the required form of identification, e.g. government-issued photo ID or the official business documents. After the authenticity is verified, the user has to verify the notability and has the option to add links which proof the public interest in the account.

Once the account is verified, the user cannot change the username on her account anymore and the verification is also not transferable to a different account. However, the verification process is not mandatory. Since it is feasible only for users who are public figures the verified badge is also not available for everyone. On the other hand, the user is obligated to provide her date of birth and thus age information when registering. As the platform requires people to be at least 13 years old to create an account, Instagram started in 2019 to ask people to provide their ages when signing up. Instagram announced that with the beginning of the 23^rd

12 See the whole verification process of Instagram and Facebook, https://help.instagram.com/854227311295302, https://www.facebook.com/help/contact/295038365360854, https://www.facebook.com/business/learn/lessons/verify- facebook-instagram-account.

(11)

7 of June 2022 it is introducing new ways to verify the age on Instagram.¹³ In order to provide age-appropriate experiences, Instagram is testing now new options for people based in the United States to verify their age. According to the announcement, the user can verify her age in addition to uploading the ID either through a video selfie or social vouching. In this context, Instagram is partnering with Yoti, a London based company that offers privacy- preserving ways to perform a verification.¹⁴ If the user chooses to verify herself with a video selfie, the image will be shared with Yoti. Yoti’s technology is able to estimate the age based on facial features. After, Meta and Yoti delete the image. However, Instagram highlights that the technology cannot recognize the user’s identity. Regardless which verification method the user is choosing, if it’s the video selfie or ID upload, since the goal is only to verify the age, the identity still remains unknown according to Instagram, and therefore not verified. As the present verification policies introduced by Instagram and Facebook refer only to a certain type of user and is not mandatory, it cannot ensure a complete transparency amongst the users.

Yet, as the main purpose of both platforms is to share content, the verification aims to verify the authenticity and credibility of the content and helps the other users to identify if the profile truly belongs to the certain person and thus if the content is trustworthy.

As a reaction to an article published in December 2020 in the New York Times alleging hosting sexual abuse and exploitation material on its website, Pornhub introduced a mandatory identity verification policy as well.¹⁵ Pornhub, the leading online adult entertainment platform, was facing serious allegations especially regarding child pornography, revenge pornography, and videos of women being sexually assaulted and uploaded without their knowledge or consent.¹⁶ The allegations focused on Pornhub’s role in these crimes as Pornhub was in the past not able or willing to trace the original user who uploaded and disclosed the content and hence not capable of holding this user accountable for his actions. Pornhub’s incompetence and unwillingness to help the victims may be seen as a support of criminal behaviour which caused a stir in the press and then led to the consequence that the major payment processors MasterCard and Visa suspended their services on the site.¹⁷ Within days, Pornhub then banned all non-verified users from up- and downloading content and deleted all the content that was uploaded from unverified sources – which amounted to 80

13 https://about.instagram.com/blog/announcements/new-ways-to-verify-age-on-instagram.

14 See further information to Yoti here https://www.yoti.com/.

15 https://www.nytimes.com/2020/12/04/opinion/sunday/pornhub-rape-trafficking.html.

16 https://www.newyorker.com/magazine/2022/06/20/the-fight-to-hold-pornhub-accountable.

17 https://arstechnica.com/tech-policy/2021/02/amid-scandal-pornhub-hires-biometric-technology-firm-for-user- verification/#:~:text=You%20provide%20it%20with%20a,who%20you%20say%20you%20are.

(12)

8 percent of all the videos on the platform.¹⁸ In order to avoid further business losses, Pornhub launched its verification policy which provides a mandatory verification process for every user who wants to upload content. The current verification policy, which was updated in June 2021, awards three types of stamps: the verified uploader, the content partners, and models who joined the Model Partner Program.¹⁹ While the Content Partner Program refers to affiliate programs or companies which can join the program via an application form, the rules applicable to the verified uploader and model are the same.²⁰ According to these rules, the user first has to provide a valid email address for verification purposes. In order to be able to upload content on the website, the user then has to verify her identity. Here, the user needs to submit high-res images or scans of a minimum of one to two information documents which contain the date of birth, the expiration date of the ID, a photo, the full legal name and address. If all the required information is set out on a government-issued photo ID, a second document is not needed. Nevertheless, Pornhub may require to provide multiple forms of identification to proof the adulthood and identity. The facial verification and assessment of the authenticity of the aforementioned documents is included in the verification process. In this context, the identity verification is performed by Yoti, a third-party service provider.²¹ Here, the user is for the verification process redirected to Yoti. The verification requires to show or upload the government issued document, followed by a live face scan.²² Once Yoti verifies the information, the data is encrypted and Pornhub itself cannot see it.²³ Pornhub’s identity verification aims to make it harder for content platforms and abusers to profit from exploitative, illegal, or unethical content. Here, it is not only the user’s or viewer’s protection that led to the verification policy, but rather the protection of the person taking place in the uploaded content since these may contain child abuse, rape, or other kind of sexual crimes. As the alleged crimes are of high seriousness, the rights and interests of the possible victims need to be protected on a high level as well. Therefore, it should be considered as an important approach in order to improve the investigations of sexual crimes in the online world and help the victims.

18 https://www.vice.com/en/article/m7a4eq/pornhub-new-verification-policy-biometric-id.

19 https://de.pornhub.com/blog/351.

20 See the application form for the Content Partner Program here: https://www.pornhub.com/partners/cpp, see the terms and conditions fort he verification process here: https://de.pornhub.com/information/terms.

21 https://de.pornhub.com/information/privacy, https://www.dailydot.com/nsfw/reviews/pornhub-verified/.

22 https://mashable.com/article/how-to-get-verified-pornhub#:~:text=You%20only%20need%20an%20email,you're%20 good%20to%20go.

23 https://www.dailydot.com/nsfw/reviews/pornhub-verified/.

(13)

9 bb. Blogging Platform

Twitter, a communication platform which provides a microblogging and social networking service, offers the blue verified badge to its users with an account of public interest.²⁵ Even though the platform is not the biggest social media platform, is has an outsized role in shaping narratives around the world and is used not only by normal users, companies, and celebrities but also by politicians.²⁶ The user’s interest in the verification of Twitter accounts is comparable to the ones of content sharing platforms such as Instagram and Facebook, and is based on the authenticity and credibility of the shared tweet and its account. To receive the blue badge, the account must be authentic, notable, and active. In order to encourage and maintain the trust between the users, the user first needs to confirm her identity with Twitter.

Here, Twitter differentiates between account categories and makes the user - depending on the category - choose one of three methods to verify the identity. First, the user can provide the link to an official website that references the user (or her organization) and her Twitter account. The second method is the ID verification. The user provides a photo of a valid official government issued identification document, such as the driver’s license or passport.

This requirement only applies to individuals, not to companies, brands, and organization.

Lastly, the user can provide an official email address with a domain relevant to the notability category the user chose. After verifying the authenticity, it must be proven that the account is notable which means that the account must represent or be associated with a prominently recognized individual or brand, in line with the notability criteria described on the website in detail. Furthermore, the account must be active with a record of adherence to the Twitter rules, which means in particular, that the account has to be complete including a profile name, and a profile image, has to be actively used, follows the Twitter rules and covers the security requirement which means that the account must have a confirmed email address or phone number. As Twitter’s verification process seems more extensive, it is seen as a desirable feature for the users. The importance and high level of interest in the authenticity of twitter accounts can be seen in the present developments regarding the acquisition of Twitter by Elon Musk. In April 2022 Musk made his interest in taking over Twitter public but highlighted the importance of the verification and his intention to expand the verification policy to more users.²⁷ However, Musk paused the deal in May 2022 and is waiting for information from

25 See the whole verification process on Twitter’s official website, https://help.twitter.com/en/managing-your-account/about- twitter-verified-accounts.

26 https://www.nytimes.com/live/2022/04/25/business/elon-musk-twitter.

27 https://screenrant.com/elon-musk-twitter-verified-check/.

(14)

10 Twitter that support the calculation that spam/fake accounts do indeed represent less than 5 % of Twitter users.²⁸ It remains to be seen, how this deal influences Twitter’s verification policy and if it leads to a simplified and for everyone accessible identification.

cc. Dating Platforms

As many other parts of the daily (social) life has shifted from the offline to the online world, the way of getting to know new people has also experienced some changes. While dating platforms used to have a more negative reputation in the past, today it is considered as a common way to find a partner or even just something casual via a dating platform. However, even if the way of dating has changed, the interest of the person not to be tricked by the other person has remained the same. Considering how easy it is to use another person’s pictures and impersonate that person online, the user of an online dating platform can quickly become a victim of catfishing. Even though a person’s name, age, and other personal information as education or the job may be considered as important as well, when it comes to online dating the person’s physical appearance and attractiveness is in the focus. Furthermore, as each user’s expectation and aim on the dating platform (e.g. relationship, something casual) is different, the willingness to share the identity as it self and thus make the use of the dating platform official might be not given always. Therefore, the user may be more interested in the verification of the other user’s appearance, thus the verification that the person is the person that she claims to be on the pictures. This purpose can also be seen in the verification method that is used by Bumble and Tinder, two of the most popular dating apps in Europe.

Bumble is an online dating application, where the user can match with other users by swiping the other’s profile to the right. In order to keep fake accounts at bay, Bumble introduced the feature of verifying the profile.²⁹ Every user has the possibility of photo verification. After giving the user a random photo pose that she has to imitate while taking a selfie, a real person Bumble team is reviewing the picture and comparing it to the other pictures on the user’s profile. In case of a confirmed verification the user gets a verified badge next to her profile name. This verification can also be done on request of a match. However, Bumble’s photo verification policy is not mandatory. It is up to the user to make use of this tool.

28 https://www.bbc.com/news/business-61433724.

29 See the whole verification process in detail on Bumble’s official website, https://bumble.com/de/the-buzz/request- verification.

(15)

11 Tinder, which faces more criticism regarding fake-accounts and online sexual harassment tan for instance Bumble does, also introduced the photo verification option to its users.³⁰ Here, the advanced photo verification has two steps. First, there is the pose verification and then the face verification, which the user has to pass in order to get her verified badge. The pose verification extracts pose geometries from the user’s selfie photo using a computer vision technology and determine whether the pose geometry matches with the one Tinder requested.

The face verification detects the user’s face in the selfie and profile pictures and extracts facial geometries using facial recognition technology to generate a unique template. If the selfie template matches the template from the profile pictures, the system acknowledges the user as the same person as on the profile pictures. Tinder’s verification process seems more technical supported than the one Bumble is offering. Nevertheless, also this verification is optional to every user. Even though the ‘simple’ photo verification is already introduced to every user, according to the website the advanced verification process is not yet available in every country.

dd. The User’s Interests in Verification Policies Introduced by the Social Media Platform and the Effects on the User’s Behaviour

Instagram Facebook Pornhub Twitter Bumble Tinder

Verification- Method

identity verification

with an ID

photo verification

Mandatory no no yes no no no

Accessible for Everyone

no no yes no yes yes

Verified

Badge yes yes yes yes yes yes

Pursued Interest

authenticity and credibility of

content and user

traceability of content to the uploader

content and user

authenticity of user’s appearance

30 See the whole verification process in detail on Tinder’s official website, https://www.help.tinder.com/hc/en- us/articles/360033058071-How-does-Photo-Verification-work-.

(16)

12 Listing the different verification policies of each social media platform, it is recognisable that the chosen identity verification method is mainly based on the platform’s purpose and the user’s interest in the platform. Consequently, it is comprehensible that a dating platform whose user is interested more in the appearance of the other user, prefers to offer rather a photo verification than an identity verification with an ID. On the other side, it is reasonable that social media platforms whose main purpose is content sharing focuses on the verification of the user of public interest that shares her content so that other users can be certain about this user’s and her content’s authenticity and credibility. In case of Pornhub, which in this research is considered as a content sharing platform, the user’s interest is different than the ones of other content sharing platforms as well as the content is different. Generally, the user is not interested in the authenticity or credibility of the content. Since Pornhub is a platform that hosts content concerning adult entertainment, precautions are of high importance as the possible hazard here is the commitment of serious crimes. Here, the verification policy does not aim to verify the authenticity of the content. The verification policy’s goal is rather to ensure a better traceability of the content and its uploader, so that the possibly committed crime is better to investigate. Therefore, Pornhub introduced the identity verification which is only mandatory for the user who wants to upload content on the website, but not for the viewer.

However, despite the differences of the verification processes all of them have the awarding of a verified badge in common. From the user’s perspective a verified account on a content sharing social media platform with a verified badge may give the user more certainty about the authenticity of the account she wants to follow or connect with. The verification badge suggests the increasement of the perceived credibility of the content to the audience and facilitates the engagement with the posts.³⁹ Especially since there are plenty of fan or fake accounts of persons of public interest, the verified badge makes it easier for the individual user to find the real account and the original content of the user. Additionally, content which is posted directly from the users account makes the user’s authorship of the post lend to her reputation and credibility and implies responsibility for its accuracy.⁴⁰ Following from this, posting for instance fake news could result in damage to the user’s reputation or account restrictions imposed by the social media platform which may lead to a loss of followers.

Hence, as the verification makes the verified user, and thus the user of public interest, more

40 J. Albright, ‘Welcome to the era of fake news.’ Communication, 5, 2, 87–89, 2017.

(17)

13 accountable for the shared content, the other users benefit of more certainty in the user-user relation.

The effects of an implementation of verification policies on social media platforms in regards of an improvement of the user’s online behaviour is evaluated differently. Studies have proven that online anonymity is a key enabler of for instance the enormous spread of fake news in the online world due to its lower risk of punishment for misbehaviour.⁴¹ Even though there have been attempts on the side of Facebook for instance to enforce a real-name requirement for its user, the German Federal Court of Justice ruled in January 2022 that Facebook must allow the use of pseudonyms on its platform.⁴² Since there is no real-name requirement the user is allowed to use pseudonyms. Especially among young people, secondary accounts on social media platforms like Instagram are very popular and are often created to switch between their ‘official’ account with images suitable for a wider audience and their second account for sharing more personal content, follow other users their wouldn’t follow publicly, or write comments or messages their wouldn’t send from their official account. According to some reports, people who make up their online profiles without having to prove their true identity can more readily engage in bullying and abusive behaviour.⁴³ As an Australian study has found, that children and young people who are victims of cyberbullying report significantly more social difficulties, higher anxiety levels and depression than those subject to traditional bullying, cyberbullying and its consequences should be taken seriously.⁴⁴ Studies have examined how the identity verification affects user’s online behaviour on social media platforms by removing the user’s online anonymity.⁴⁵ Based on data from South Korea and China, identity verification reduces online misbehaviour of users in form of disciplining the online communication and lessening offensive speeches and

41 H. Rainie, J. Anderson, J. and Albright, ‘The future of free speech, trolls, anonymity and fake news online.’ Pew Research Center Washington 2017.

42 BGH Urt. v. 27.01.2022, Az. III ZR 3/21 u. III ZR 4/21, the ruling only has precedential value for cases before 2018 since the judges’ reasoning based on the period before the GDPR was in force.

43 A. Srivastava, R. Gamble and J. Boey, ‘Cyberbullying in Australia: Clarifying the Problem, Considering the Solutions’, International Journal of Children's Rights, vol. 21, pp. 25-45, 2013; CP Bartlett, ‘Anonymously Hurting Others Online: The Effect of Anonymity on Cyberbullying Frequency’, Psychology of Popular Media Culture, vol. 4, no. 2, pp. 70-79, 2015; MJ Moore, T. Nakano, A. Enomoto and T. Suda, ‘Anonymity and Roles Associated with Aggressive Posts in an Online Forum’, Computers in Human Behavior, vol. 28, no. 3, pp. 861-867, 2012.

44 Marilyn Campbell, Barbara Spears, Philipp Slee, Des Butler and Sally Kift, Victims' perceptions of traditional and cyberbullying, and the psychosocial correlates of their victimisation. Emotional and Behavioural Difficulties, 17(3-4), pp.

389-401, 2012.

45 S. Chen, and P. Pol’y, ‘What’s in a Name: Facebook’s Real Name Policy and User Privacy.’ Kan. JL & Pub. Pol’y 28, 146, 2018.

(18)

14 discussions of sensitive subjects.⁴⁶ Another research argues that the identity disclosure policies on Facebook supports to deter undesirable communication behaviours of the user by making it easier to the platform to go after the offender.⁴⁷ Consequently, based on the assumption that the user’s misbehaviour such as cyberbullying or other type of abusive behaviour is related to her anonymity, it may be inferred that the identity barrier constitutes some kind of stoppage for the user which ideally prevents online misbehaviour and additionally simplifies the traceability. However, this opinion is refuted by other researches which show that people still engage in bullying, harassment, and abuse on social media even when they have to sign up using their full names.⁴⁸ Another study shows, that online anonymity does not necessarily hold back user of writing hate comments.⁴⁹ Results of this study show that in the context of online firestorms for instance, non-anonymous individuals are more aggressive compared to anonymous individuals. Furthermore, non-anonymous accounts seem more believable when it comes to spreading fake news or conspiracy theories.

According to this, anonymity should not be considered as the door-opener for online misbehaviour. It is comparable to in-person interactions, where for instance students bully their fellow student even though their identity is known. Hence, losing the anonymity does not prevent people from committing misdemeanours and crimes online. Overall, there is limited evidence that support the argument that online anonymity encourages online misbehaviour such as cyberbullying. Therefore, so far it cannot be explicitly said that an identity verification has the effect of an improvement of the user’s online behaviour and thus a clearly reduced the number of offenses and crimes committed online.

b. Identity Verification by National Law

Beside the individual verification policies introduced by the social media platforms themselves, the idea of regulating this issue on a national level has already arisen in several countries around the world or even been implemented.

As a prevention for the impact of unregulated online speeches which may would affect election outcomes, South Korea implemented in 2004 the so called ‘internet real-name

46 D. Cho and K. Kwon, ‘The impacts of identity verification and disclosure of social cues on flaming in online user comments.’ Computers in Human Behavior , 363–372, 2015.

47 L. Edwards, and D. McAuley, ‘What’s in a name? Real name policies and social networks.’ Proceedings of 1st International Workshop on Internet Science and Web Science Synergies (INETWEBSCI), Paris, France 2013.

48 L. Rösner and NC Krämer, 'Verbal Venting in the Social Web: Effects of Anonymity and Group Norms on Aggressive Language Use in Online Comments', Social Media + Society, vol. 2, July-September, pp. 1-13, 2016.

49 K. Rost, L. Stahel, BS Frey (2016) Digital Social Norm Enforcement: Online Firestorms in Social Media, 2016.

(19)

15 system’, so users were required to verify their identities by submitting their Resident Registration Numbers (RRNs) before contributing to election-related websites.⁵⁰ In 2007 regulators expanded the real-name system to apply to any website with more than 100,000 daily visitors. This expansion of the policy was introduced after investigators linked several suicides to cyberbullying and online slanders, which gave reason for greater restrictions on online anonymity.⁵¹ Consequently, major providers started asking users for their RRNs before they could sign up and post comments on their site while officials were hoping that the online service providers disclose the personal information of alleged online offenders in order to reduce harmful fake news and online misbehaviour. However, in August 2012 the Korean Constitutional Court stated that the real name policy violated user’s rights to freedom of speech, an individual’s right to determine her own personal identity, and the online service provider’s right to freedom of speech as well.⁵² According to the Korean Constitutional Court, to fully justify the restrictions officials must have demonstrated a clear public interest. The presented evidence was however insufficient to proof a decrease in hateful comments, defamation, and insults on the internet caused by the real-name policy.⁵³ Furthermore, online service providers pointed out having alternative methods of managing malicious post and the authorities’ ability to track web users through their IP addresses. Additionally, the policy gave a number of users reason to shift to foreign online service platforms where this rule didn’t apply.⁵⁴ At the end, the judges of the Korean Constitutional Court decided that the policy violated the Constitution, which led to the consequence that it is no longer in force.

In September 2019, a draft bill was introduced in Brazil which would require identity verification for users who create accounts on social media platforms. If passed, Brazilian users would have to verify their identity with a phone number - which itself requires government-issued ID in Brazil – and foreigners would have to provide a passport in order to use social media platforms. Besides societal concerns such as the exclusion of people coming from a household with just one shared phone who would not be able to create an email or social media account without a unique mobile phone number, also criticism regarding privacy

50 https://catalystsforcollaboration.org/case-study-internet-identity-verification-system/.

51 D. Cho, ‘Real Name Verification Law on the Internet: A Poison or Cure for Privacy?’, pp. 239-261 in B Schneier (ed), Economics of Information Security and Privacy III, Springer, New York, 2013; https://catalystsforcollaboration.org/case- study-internet-identity-verification-system/.

52 J. Leitner, ‘Identifying the Problem: Korea’s Initial Experience with Mandatory Real Name Verification on Internet Portals’, Journal of Korean Law, vol. 9, no. 1, pp. 83-108, 2009.

53 https://catalystsforcollaboration.org/case-study-internet-identity-verification-system/.

54 K. Kim, ‘Korean Internet and ‘Real Name’ Verification Requirement’, Korea University Law Review, vol. 20, pp. 87-104, 2016..

(20)

16 rights and freedom of expression is rising.⁵⁵ It remains to be seen, how the proposal will be decided.

In Europe, discussions of regulating the identity verification on social media platforms are gaining more attention as well. In order to combat issues with online abuse, a petition had been started in 2021 in the United Kingdom to make the identity verification a legal requirement when opening a new social media account.⁵⁶ The petition was arguing that to prevent anonymised harmful activity and provide traceability if an offence occurs, the person who wants to open a social media account has to provide a verified form of ID or if the person is under the age of 18 the verified ID of a parent or guardian. The parliament debated the petition’s topic in February 2022.⁵⁷ As a result, it was announced that in the ‘Online Safety Bill’ the additional duty of an optional user verification for companies which are high risk of online abuse and have a high reach will be added. The user verification duty will require these companies to provide their adult users with an option to verify their identity. The guidance of how companies can fulfil this new duty and the verification option companies could use will set out by Ofcom, the regulator and competition authority for the UK communications industries.

Meanwhile in Germany, amendments regarding identity verification for social media platform have been discussed as well. First attempts concerning the implementation of an identity verification on social media platforms in the law have already been made by the German government in the recent months by considering to introduce a mandatory identification requirement for messengers, but then explicitly rejected these intentions.⁵⁸ The idea originally came from the Conference of Interior Ministers and the Ministry of Economics which had considered implementing it in the new Telecommunications Telemedia Data Protection Act (TTDSG). In a written hearing of associations this idea was denied due to the reason that it is contrary to fundamental rights, too expensive, and impracticable. In the end the mandatory identity verification requirement within the TTDSG was rejected. The Minister of Interior passed the draft law for the TTDSG together with the Federal Cabinet in February 2021 without the verification requirement for social media platforms. Nevertheless, the supporters did not give up on this idea. Discussions in the Conference of Ministers of the Interior lead to

55 https://blog.mozilla.org/netpolicy/2020/06/29/brazils-fake-news-law-harms-privacy-security-and-free-expression/.

56 https://petition.parliament.uk/petitions/575833.

57 https://hansard.parliament.uk/commons/2022-02-25/debates/22022515000007/OnlineSafety.

58 https://netzpolitik.org/2021/tkg-novelle-seehofer-will-personalausweis-pflicht-fuer-e-mail-und-messenger- einfuehren/#2021-02-23_BMI_TKG-Novelle_Beratungsunterlage.

(21)

17 the initiative of the Federal Ministry of the Interior in the early beginning of 2021 to negotiate the amendment of the Telecommunications Act (TKG) by suggesting to add the identity verification for social media platforms.⁵⁹ It is alleged that the Minister of Interior is trying now a different approach to introduce the verification requirement by proposing it within the amendment of the TKG.⁶⁰ The amendment is concerning to introduce the duty for social media platforms which offer ‘number-independent interpersonal telecommunications services’ (e.g. messenger services such as Facebook Messenger, WhatsApp, Zoom or e-mail services) to verify their user’s personal data with the relevant service provider.⁶¹ Since many social media platforms offer messengers, this duty would also apply to the platforms whose provided services don’t focus only on messenger services. The Ministry wants the user to provide her name, address, and date of birth to the platforms. The platform will have to verify the information then with an ID document or an identification service. The reasoning behind this proposal is that the internet and especially social media platforms should not be a ‘lawless place’.⁶² Thus, in order to improve the traceability of criminals who act anonymously on the internet and use messenger services in particular for this purpose, the providers of number- independent interpersonal telecommunication services shall be required to collect and store so-called identifying characteristics from users when they register for their respective telecommunications service.⁶³ This means that anonymity can be revoked in individual cases in order to solve the crimes happening in the online world. Since the previous proposals were rejected, the implementation of an identity verification requirement in the TKG is considered as improbable. Still, it remains to be seen how the further discussions will evolve.

c. Potentials and Risks

Considering the identity verification policies that have been already introduced by the social media platforms themselves and the ongoing discussions in different countries regarding the implementation of an identity verification requirement by law, it can be noticed that all of the so far involved parties claim to pursue the same goal with an identity verification: ensuring more online safety and certainty on the social media platforms. Regardless of the discussion if an identity verification may have an effect on the user’s online behaviour or not, it can be considered that an identity verification can contribute to the improvement of the traceability

59 https://netzpolitik.org/2021/tkg-novelle-seehofer-will-personalausweis-pflicht-fuer-e-mail-und-messenger-einfuehren/.

60 https://posteo.de/blog/tkg-novelle-bmi-will-identifizierungspflicht-f%C3%BCr-internetnutzer.

61 See the Formulation Guide of the Federal Ministry of Interior https://posteo.de/FormulierungshilfeBMI.pdf.

62 ‘Das Internet is kein rechtfreier Raum’, said by the Minister of Interior of Mecklenburg-Vorpommern Lorenz Caffier.

63 https://netzpolitik.org/2021/tkg-novelle-seehofer-will-personalausweis-pflicht-fuer-e-mail-und-messenger- einfuehren/#2021-02-23_BMI_TKG-Novelle_Forderung-02.

(22)

18 of content and users and hence to the conditions of investigations regarding misdemeanour and crimes committed online. As the internet never forgets, once something is put online it stays there, and in case of misbehaviour it may be used as a proof. Therefore, if the content or behaviour is linked to an user who is verified the social media platform has the possibility to determine who shared it and thus may lead to the offender. In this way not only cases regarding cyberbullying would be easier to investigate, also other kind of misbehaviour on social media platforms which is considered as not lawful in the offline world, would be traceable. This includes for instance fraud, defamation, and sexual harassment. Another point is the spread of fake news. Especially from a political perspective, social media platforms developed in the last decades as a big influence on people’s political opinion. The source of fake news has shifted from official media to a much broader and often anonymous, population – the social media users.⁶⁷ Whereas in the past, publishing news has been exclusively controlled by the official news media while unofficial news were often regarded as urban legends and rumours, today nameless social media users can post their content and share news with each other while some users intentionally post fake news with eye-catching headlines in order to gain attention for political and monetary gain.⁶⁸ For instance, during the U.S.

Presidential Election in 2016, many anonymous users posted fake news on Facebook and Twitter in order to attract millions of page views to their websites and thereby misleading millions of viewers while gaining substantial revenues from advertisements.⁶⁹ An identity verification would also simplify the traceability of the fake news, and may even prevent the spread of them since if the user who initiates the spread of fake news is once identified may be banned from further posting. Therefore, the identity verification on social media platforms may be considered as a tool for crime investigation and hence as a protection of the individual but also of the society which serves for the purposes of the public interest.

Beside the potentials of an identity verification on social media platforms, it should be noted that this kind of requirement bears also risks. Online anonymity is used for a variety of non-

67 Shuting Wang, Min-Seok Pang, Paul A. Pavlou, ‘Cure or Poison? Identity Verification and the Posting of Fake News on Social Media‘ in Journal of Management Information Systems, 2021; Tandoc, E., Lim, Z., and Ling, R. Defining “fake news” A typology of scholarly definitions. National Public Radio, 6, 2, 137–153, 2018.

68 Shuting Wang, Min-Seok Pang, Paul A. Pavlou, ‘Cure or Poison? Identity Verification and the Posting of Fake News on Social Media‘ in Journal of Management Information Systems, 2021; D. Lazer,, M. Baum,Y. Benkler, A. Berinsky, K.

Greenhill, F. Menczer,M. Metzger, B. Nyhan, G. Pennycook, and D. Rothschild, ‚The science of fake news.‘ Science, 359, 6380, 1094–1096, 2018.

(23)

19 harmful purposes, such as avoiding discrimination or embracing creativity.⁷⁰ Having the protective shield of being able to act online anonymously encourages many users to express themselves freely. Many users rely on their invisibility, such as whistle blowers, journalists or also private persons who try to reach a bigger audience to make attention on political issues in their home countries for instance. Noting that in some countries the freedom of press and media and concomitantly the individual’s freedom of expression is seriously restricted, the possible anonymity of social media platforms presents a safe space to share the current situation and get the world’s attention. The requirement of an identity verification would risk silencing the critical voices that help to expose the truth. However, anonymity should not only be seen useful from a societal point of view. Concerning the personal development of the individual and the role of social media platforms within the self-discoverage phase every person is going through during her life, being anonymous while sharing experiences, asking questions, and searching for answers that are difficult to ask in person is of high importance.

This point is again significant especially in countries where several freedoms and rights of the individual are restricted. Exposing the user by revoking his anonymity may be considered as an interference in the private life and thus in her privacy. Particularly when talking about an ID verification, another challenge of this requirement is the question how the situation of people who don’t even have access to an ID shall be handled. Considering, that these people are already facing exclusion in society, denying them also the usage of social media access would worsen their situation. Beside the societal and personal concerns, an online identity verification also affects the social media companies themselves. Introducing a verification process will cost the social media platforms more in time and effort to ensure that the accounts are identity verified which increases their costs.⁷¹ Since most of the social media companies are usable without paying any fee, the platform’s main source of profit is the user’s data and information. Consequently, it is questionable how the social media platforms will make use of the gained social media identity data. This data would have been supplied by the user herself specifically for the identity verification. However, the risk that the data may be used for another purpose inappropriately, for example, to improve the social media platform’s ability to personalise targeting of advertisements and marketing, is given.⁷²

70 B. Hogan, ‘Pseudonyms and the Rise of the Real-Name Web’, pp. 290-307 in A Companion to New Media Dynamics, J Hartley, J Burgess, A Bruns (eds), Wiley-Blackwell, Chichester, 2013.

71 NP Suzor, ‘Lawless: The Secret Rules that Govern Our Digital Lives’, Cambridge University Press, Cambridge, p. 60, 2019.

72 Queensland Government, ‘Social Media and Identity Verification – Queensland Department of the Premier and Cabinet Research Paper’, 2020.

Identity Verification on Social Media Platforms