Age verification in Austria: yet another poorly thought-out, hasty measure

Also available in: Deutsch (German)

Anyone who thought Austrian lawmakers had exhausted themselves with the recent ministerial draft tightening age verification for pornographic content was mistaken. Barely has the first draft entered consultation when the next one follows: Officially, the aim is to protect under-14s from “addictive” features on video-sharing platforms such as YouTube and similar services. Yet a closer look quickly reveals that the same highly ambitious technical requirements for age verification also hit the adult industry – and that the project appears so half-baked in many places that one might suspect the authors have so far only observed the internet from a distance.

As we already reported at CASZIN, Austria is in any case planning a significant tightening of the AVS obligation for content that is “predominantly limited to the unreflective depiction of sexual acts.” The new draft amending the Audiovisual Media Services Act (AMD-G) and the KommAustria Act (132/ME) builds on this and massively expands the requirements. Officially, it concerns access blocks for minors under 14 to platforms with recommendation systems, infinite scrolling, automatic playback or push notifications. In parallel, the 18+ rules for pornographic offerings remain in place – only now with the same highly complex verification requirements.

The double-blind procedure: Sounds noble, remains vague

At the centre is the so-called double-blind model. The provider of the age-verification method is not supposed to know for which platform the proof is being provided. The platform, in turn, receives only an age attribute (“over 14” or “over 18”) – no further personal data. Registration and presentation components must be strictly separated; non-observability, data minimisation, exclusion of central usage logging and interoperability via open standards apply. The age determination itself is to meet a standard of care equivalent to identity checks in the financial sector (FM-GwG, Online-IDV).

That is the theory. In practice, it reads like a collection of pious wishes whose technical implementation remains largely open. Exactly how the cryptographic separation is supposed to work, which open standards are binding and who even certifies the “most data-sparing available methods” – all of this stays vague. The draft emphasises that it does not want to lock itself into a single solution, yet names ID Austria as an obvious option. ID Austria is the Austrian state’s electronic identity credential, the further development of the earlier mobile signature. Users can identify themselves online with it, typically via an app. In the double-blind model it (or a private provider) is supposed merely to confirm the age attribute.

Whether this construct is even technically realisable on a nationwide, data-protection-compliant basis in the form announced may safely be doubted. Much like their German colleagues, who have been wrestling for years with the Youth Media Protection Interstate Treaty and enforcement against international providers, the enthusiasm for regulation in Vienna also seems to outstrip expertise about the realities of the net.

What does this mean for tube sites such as YouPorn or XVideos?

For large international porn tube platforms the whole affair could in theory become dramatic – or remain largely inconsequential. The draft provides for procedures enabling KommAustria to take action even against providers established in other EU states or outside the EU, provided they target Austrian users. Service via the DSA contact point, possible coercive measures against debtors, and for very large online platforms even fines of up to 6 percent of worldwide annual turnover.

Whether this bites in practice is another question. Experience from Germany and France shows: blocking orders and fine threats alone rarely induce international players to implement expensive, complex and data-protection-sensitive systems solely for a comparatively small market such as Austria. Many remain reachable, users resort to VPNs, and the authorities get lost in lengthy proceedings. The new draft changes little in this regard – it merely makes the procedure more bureaucratic.

Cam sites, erotic video platforms and the special situation of OnlyFans

For cam platforms and specialised erotic video offerings the picture potentially looks more serious. Anyone who does not want to write off the Austrian market would have to integrate a compliant double-blind solution or connect to a recognised third-party provider. That means technical adjustments, ongoing costs and the risk that users find the hurdle too high and migrate elsewhere. Revenue losses are by no means ruled out – and that is precisely what hits the providers for whom CASZIN mainly writes.

Particularly delicate is the situation with platforms such as OnlyFans. Alongside clearly pornographic content there are also youth-free offerings on art, sport, fitness, music or other topics – content that could equally be found on YouTube. The draft barely distinguishes here: as soon as certain functions or content are present, the strict verification obligations apply. How a platform with mixed offerings is supposed to implement this technically and in a legally secure manner without either blocking everything or creating risky grey areas remains largely unanswered in the draft. This is typical of regulatory attempts in which the authors apparently have only a partial grasp of the actual diversity of digital offerings.

Tourists, foreigners and the chaotic side-effects

This is where it becomes truly absurd. Tourists from EU and non-EU countries temporarily staying in Austria and wanting to use familiar services face the problem that they generally have no access to ID Austria. Private verification providers would therefore have to offer alternatives – yet the draft makes hardly any concrete stipulations on this. The result threatens to be chaotic: either platforms block preventively on a broad scale, or they risk fines.

Even more unresolved is the situation for foreigners who work or live in Austria but have no entitlement to ID Austria. They would have to rely on private solutions whose availability and acceptance are unclear. The draft is largely silent on this. That such a regulation is supposed to be practically workable in a country with high tourism and foreign-resident numbers without massive friction losses and circumvention attempts borders on wishful thinking.

EU plans and possible conflicts

At European level, age-verification solutions are being developed in parallel – including an EU age-determination app and integration into the European Digital Identity Wallet. These approaches likewise rely on data minimisation and zero-knowledge principles. Austria’s plans go beyond them in parts and could collide with the intended uniform European standards. National go-it-alone approaches that are stricter than EU requirements risk legal disputes and complicate interoperability. Here too the draft gives the impression that European developments have been taken note of only half-heartedly.

Conclusion: Many inconsistencies and little realism

In summary, the ministerial draft presents itself as an ambitious but technically and practically half-baked project. The inconsistencies are obvious:

The technical requirements for the double-blind procedure are so high and at the same time so vaguely formulated that nationwide, data-protection-compliant and user-friendly implementation currently appears barely realistic.
The demarcation between youth-free and adult content on mixed platforms (keyword OnlyFans) remains unclear.
Tourists and foreigners without ID Austria largely fall through the cracks.
Enforcement against international providers remains difficult despite KommAustria’s expanded powers, as experience shows.
Possible conflicts with parallel EU initiatives on age verification have not been adequately considered.

For providers of erotic content this means: should the draft become law in this form and actually be enforced, technical effort, costs and possible revenue losses on the Austrian market loom. At the same time there is a realistic chance that the project – similar to comparable attempts in Germany – will fail on the technical and legal complexity of the internet or be massively watered down. Austrian politicians are trying to regulate an area that they themselves evidently only partially understand. That is neither new nor particularly surprising – and precisely for that reason it remains to be seen whether this draft will become more than another chapter in the long history of well-intentioned but impractical net regulation.

Further information: