When the history of the first quarter of the 21st
century comes to be written, it will record a period when we took the greatest
communications medium in the history of humanity – the internet – and turned it
into an invasive, toxic, mass surveillance machine, beyond even George Orwell’s
imagination.
For generations, the four horsemen of the infocalypse –
terrorists, drug dealers, child abusers and organised crime – have been the
staple justifications of choice for a smorgasbord of laws intended to tackle
these evils. The Labour government between 1997 and 2010 introduced more than
forty major serious crime and counter-terrorism laws.
During the same period, unfettered, private
sector mass surveillance & profiling, of a scale
unthinkable before the turn of the century, plus addictive, attention-
grabbing apps and social media algorithms, became established as the core
business model of the internet.
The most profitable firms in the world either monetise or
otherwise exploit
data through stalker
advertising and profiling and/or provide software and hardware services and
infrastructure to the economic & state actors who do.
The technology systems built and rolled out by those
companies are used, extensively, by states which, like commerce, have a
voracious appetite for personal data, in the whole gamut of government services
from law enforcement, health and social welfare to border control, military,
security and intelligence.
In the wake of the 11th
September, 2001 attacks, counter terrorism became the primary excuse for western
governments’ expansion of mass surveillance. By the mid-2010s, it remained a
core theme for government but the terrorism mantra was wearing thin and the prominent
pretext for surveillance moved to immigration and border control.
In parallel, child protection and “online safety” became
high profile vehicles for a collection of demands that something must be
done about the negativities of the internet and the unethical behaviour of the
big technology corporations. By 2023 that led to the introduction by the UK of
the Online Safety Act,
a complex piece of legislation with the “general purpose of making the use of
internet services… safer for individuals in the United Kingdom” through
imposing a duty
of care on online services providers.
One of the primary effects of the Act seems to have been a
boon in the market for age
verification services. And, indeed, VPN services, which the government are
also now considering
restricting. Section 12(4) of the Act mandates the use of age verification
or age estimation to prevent children from accessing harmful content. Section
12(6) says this age verification should be “highly effective”. In short, dear
reader, age verification is
not marginally, let alone highly effective and declaring a mandate for
highly effective technology in a statute does
not, magically, bring it into existence.
Ahead of the Makerfield byelection and his likely
replacement by Andy Burnham, the UK Prime Minister, Keir Starmer, with his teen
social media ban proposal, announced plans to polish a capstone on his
legacy,
such
as
it
is, by forcing
everyone to wade through some form of identity and/or age verification service
before using the internet. The Open
Systems Interconnection (OSI) model - seven layer model of the internet –
is about to get an eighth layer in the UK, the insecure layer, if the October
2025 Discord data breach compromising 70,000 users, including their
government issued ID images, is anything to go by. Mr Starmer’s insecure layer,
retrofitted to a toxic mass surveillance machine, will compromise the privacy
and security of every internet user, including
children, whilst failing to improve child safety.
Last week the Science,
Innovation and Technology Committee of Parliament, following an inquiry
on the digital centre of government, published a report Rewiring the
state: Delivering digital government.
The report is scathing on government information & data
security (highlighting Biobank
breaches), unsubstantiated hype about a claimed £45 billion per year
savings from digital services, government
plans for digital ID (noting operational and security problems relating to
the eVisa
system and One
Login’s temporary loss of certification against the government’s own digital
identity framework). On digital sovereignty the report expresses concerns
that "The UK’s reliance on a small number of US-based providers for
digital infrastructure and public service delivery is a strategic and economic
vulnerability."
Most notably, in the context of the proposed teen social
media ban, however, it declares government ignorance of technology, “enthusiasm
from non-experts at the top” combined with “insufficient skills at the coalface”
to be a “dangerous” combination. Dangerous is the word for it, particularly for
those teens who rely on internet access for social, educational and mental
health support, often exclusively because they cannot find that support
elsewhere.
The petition
to parliament not to go ahead with this ban has already, at the time of
writing, passed 200,000 signatures.
A prime minister serious about child protection would firstly
insist on enforcing existing regulatory measures, such as the UK GDPR
articles 8 and 9, against social media companies and secondly, pursue orders of
magnitude greater investment in social and sports facilities and
infrastructure, children’s services, parental support, social welfare,
education, health, mental health services and, where necessary, policing; with
properly coordinated, local interdisciplinary teams across all these services
working in tandem, the whole being greater than the sum of the parts.
Also, as
Cory Doctorow says, we need to protect kids from online surveillance, the
precise opposite of what the UK government is proposing: “Your kids can't be
targeted by algorithms without the surveillance data that's being used to
target them. They can't be funneled into pro-anorexia content or extreme
misogyny forums without that funnel being primed by commercial spying.”
The Brazilian government, unlike the UK, Australia and many others proposing similar bans, has taken a different approach to provide for the protection of children in digital environments, Decree No. 12,880, of March 18, 2026. According to Victor Oliveira Fernandes, Brazil's National Secretary for Digital Rights, the decree tackles the problem at source by banning dark patterns and addictive design targetted at children, including infinite scroll, autoplay, time-based rewards, excessive notifications, obstruction of privacy controls and exploitative cognitive vulnerabilities. Maximum penalities can be 10% of a company's revenue in Brazil. It will be interesting to see how that plays out in practice. As Prof Fernandes admits, passing the law is only the start, it's efficacy will depend on how and how well it is enforced, what economic actors it covers and to what degree it causes a change in their unethical business practices.
Notably, the early evidence on the effects of an under 16s social media ban in Australia shows that it has led to little substantive reduction in reported social media use by adolescents under 16. It doesn't work.
Peddling a headline
grabbing social media ban is just another ineffective but also corrosive and
dangerous attempt at a quick
fix to a challenging and complex sociotechnological problem. If, however, after
two and a half decades of digital technology enabled mass surveillance and failed
government technical quick fixes in relation to all four infocalyptic horsemen,
you still believe the PM’s claim that a social media ban decimating everyone’s
privacy is the solution to the complex issue of children’s safety, I wonder if I
could interest you in the purchase of a couple of bridges, one in London, one
in Brooklyn?