Update, 5:00pm PT: New Line Cinema's response, privacy analysis from an attorney with the EFF, and news that the age-verification system is easily spoofed follow.

- - - - - - -

1:50pm PT: Yesterday, movie biz website Ain't It Cool News broke the story that New Line Cinema had launched an X-rated promotional web game for the movie Running Scared -- in the "mature" version of the game, players perform oral sex on the wife of the film's protagonist. If the game player "wins" in that effort, here's the screen they'll see (cropped above, JPEG link to full-screen). Classy, huh? Defamer has a post with more about the game, which many will find offensive, tasteless -- and a lame play, to boot.

But here's what's really outrageous: From the disclaimer on the age-verification page:

To ensure verification, please provide information as it is listed on your current Drivers License or State issued ID. By clicking on the "submit" button, I agree that I am at least 17 years of age, I authorize you to confirm my age by checking the accuracy of the information I have submitted against the government-issued identification, and I agree to the Terms of Use governing this website.

Now, they're not asking for your drivers license/State ID number, but for the name, address, and zipcode as they appear on that government-issued ID. If you value your privacy, and worry about website records being subpoenaed by The Man one day ("Are you now, or have you ever been, a consumer of pixel poon?"), and you enter phony info, here's what you'll see:

SORRY | We are unable to process your information at this time. | Please double check to make sure your name and zip code are entered exactly as they appear on your current Driver's License or state-issued ID."

Update, 415pm PT: New Line Cinema confirms that they are cross-referencing the name, address, and zipcode against a database of government-issued ID records to verify that the user is an adult. New Line says it worked with the MPAA and a third-party provider that works with the US Bureau of Alcohol, Tobacco, and Firearms, and wanted to implement a system that does not require credit card info to lock minors out.

But it appears that the system isn't child-proof: a number of fake entries I entered got me in (George Bush's name, birthdate and the White House ZIP code works totally fine, thanks Sam!). You can also bypass the system by going directly to adult content filenames viewable in the site's source code.

The age-check database includes info from multiple government sources, New Line told Boing Boing, though not all states consider drivers license info public information.

In the "reader comments" thread of this Boing Boing post (after the jump), one reader pointed out that YesMail is involved in this verification transaction, and described YesMail as "spammers." New Line confirms their email database is outsourced to YesMail, but maintains that neither it or YesMail are spammers. New Line says their promotional emails are opt-in, and they do not sell/rent email lists to third parties. But YesMail has received similar accusations many times in the past: they have been "blackholed" as spammers, and they responded to the Mail Abuse Prevention System with a lawsuit (Link to Wired News story).

This age-check system will no doubt outrage privacy advocates -- and according to news reports, New Line isn't the only studio using it. Last month, 20th Century Fox implemented a similar (perhaps identical) system for the movie Grandma's Boy, more on that after the jump.

Bottom line for New Line: Caveat hump-tor. Disclosing all that personal data seems a big price to pay just to have fake oral sex with some pixels in a crappy game.

Response from Jason Schultz, EFF:

While they say they won't spam you, they don't say how much of the information they collect, who has access to it, or how long they keep it. Given the recent DOJ subpoena to Google for porn-surfing stats, a website like this could be a tempting data-vacuum for the DOJ, especially if they are working in conjunction with ATF.

The website says it's covered by the New Line Privacy policy, which states:

"We may disclose personally identifiable information in response to legal process, for example, in response to a court order or a subpoena. We also may disclose such information in response to a law enforcement agency's request."

In other words, they may just turn your info over voluntarily, without even requiring a subpoena or a warrant. And there's nothing that says they will even notify you if said data is requested or if they comply.

New Line maintains their system is just the online equivalent of a movie theater checking ID at the door of an R movie. But movie theaters don't photocopy your info and reserve the right to hang on to it, and share it with the government.

Why isn't more MSM entertainment news covering this? One entertainment reporter at a major news venue, speaking on condition of anonymity, told Boing Boing that his supervisor explicitly forbade him from pursuing the story today for fear it would jeapordize the company's corporate relationship with New Line.

Response to Boing Boing from New Line Cinema:

In an effort to market our R-rated movie RUNNING SCARED both aggressively and responsibly, we developed an online game intended for consumers 17+, and placed it in an access-controlled environment. Players face scenarios from the film as Paul Walker's character and each level of gameplay is preceded by a movie clip to set up the action.We are also offering an exclusive debut of the first six minutes of the movie and other content related to the film in the access-controlled area.Our age-verification system meets the restrictions set by the MPAA to ensure that site visitors who access mature materials are of an appropriate age and it permits us to legitimately show truly edgy R-rated materials online in a controlled environment.As is clearly stated on the registration form, the system requires the user to input his name and address as they appear on a drivers license or similar government-issued ID. It then performs a real-time verification check against public records and issues a "match code" confirming the age of the website user. To protect users¹ privacy, verification information is not retained or used for any other purposes.

Per our stated Privacy Policy, New Line will only record a consumer's name and email address if they opt-in to receive email from us about our movies.
This information is never sold or given to any other parties.

Running Scared's "exclusive for mature audience only" trailer is here (movie file link) and the x-rated game is here. which both are registration free! i have blogged about it here.

Privacy advocates are troubled by a 20th Century Fox Web site that requires visitors to provide personal information if they'd like to view a new flick's raunchy trailer.

The R-rated comedy, "Grandma's Boy," opened Friday. But since late November it has been hyped in a unique online marketing campaign that collects the personal data of anybody wanting a sneak peek of bare breasts or bong-smoking basement dwellers. The studio says it is not misusing the information, but some privacy experts are disturbed nevertheless, saying the case highlights a growing online danger. Visitors to the site must provide their real name, age and zip code to see the R-rated film trailer full of foul language, sex jokes, pot smoking, and a topless buxom blonde. The age-check policy is endorsed by the Motion Picture Association of America.

Visitors can't fudge their personal information because the Web page is linked to a commercial database of drivers-license records in all 50 states. Access is deferred to a tamer site if one enters a false ID.

Most porn sites use credit card verification processes like CCBill and AdultCheck (considered the "gold standard" in age verification in online porn), but there is no consensus on age check practices (Link).

The creepiest and most sketchy is age checks like Adam and Eve's where they require all kinds of personal info, but they're not using a standard practice and are primarily toy and porn mail order retailers. AdultCheck requires that people join the service for like 20 bucks a month, giving them access to a variety of sites and then tries to sell more packages -- like everything on the web that should just be functional, it's scammy and the money is made on the rebills. Most gay sites use UGAS. Here's a commentary on the Child Online Protection Act [Ed. Note: COPA is the court-challenged legislation that would impose stiffer criminal penalties for websites that fail to keep minors away from adult material. The fight to enact COPA was the reason the Justice Department recently subpoenaed search data from Google, Yahoo, Microsoft, and AOL).

Credit card verification is also standard for web tobacco and alcohol sales, same membership scams with the companies, though.

Reader Comment: Jay Schulman says

Interesting to note: ageverify.newline-movies.com is a server run by at-once.com. @ONCE is owned by YesMail.com. YesMail is a spammer.

Reader Comment: Mike Carlson says,

mathematically speaking, state issued IDs carry a "checksum" digit. (if you're a math or computer nerd, you probably are familiar with these already.) basically, an arithmetic algorithm is applied to the other digits to generate the checksum digit. a simple test would be to use fake info and an appropriate digit-count fake driver's licence number (TX has 8) and just change the last digit until it works. (there are only 10 possibilities) if successful, no gov't ID lookup, just trying to trick 90% of anonymity-loving users. (i'd do this test myself, but i'm at work and i don't think i'm leaving anytime soon :)

Reader Comment: Matt Grommes says,

I work for a company that deals with DMV records and there is no official government database of DMV records for every state. If they're searching motor vehicle records they'd have to be searching the database of a company like ChoicePoint that deals in state records. They're probably just searching "wallet" information (the basic data available on your license: name, date of birth, etc.) and I believe it would be illegal for them to pass along any of your information to a spammer. There are many laws about who can buy or disclose motor vehicle records to.

Reader Comment: Aimee says,

Regarding drivers licenses as age verification (for the porno game): This site explains what types of info you can you figure out about a person based on his/her driver's license number. Different states use different formulas, but it seems to be possible to figure out a person's birthdate based on the number. At the very least, you should be able to tell an obvious fake if a person's name/number don't match up or if a check digit doesn't match.

Reader Comment: Seth says,

1) I just filled out the form, and nowhere did it ask for my driver license number. It simply states that it is going to check your name and zip code against your driver's license info.

2) I used a friends info (yes I am a horrible, horrible friend) and got in no problem. Using "fake" info did not work. It does seem they are able to verify your driver's license info somehow.

Your post on New Line's govt id marketing reminded me of this page on the site for the Movie Hostel - which asks for a Passport/ID number At first I assumed it was some kind of alternate reality game nonsense, and I didn't have the patience to play along -- in retrospect it seems awfully odd for a movie studio to be asking for passport numbers.

Reader Comment: Chris says,

This isn't anything particularly new. Fox tried something similarly erie over at the site for grandmas boy (grandmasboymovie.com)....I didn't go to the site to learn about the movie..but I saw this posted link on Digg. The mainpage prompts you for your information, and if your DOB or zip code doesn't match your most recent drivers license information, it wont allow you in. We (everyone on the digg comment thread) were trying to figure what this was using..I noticed some people were able to get in with a different DOB but I think that's just subject to how common your name is..my last name is particularly uncommon, and like I said, my info had to be 100% correct to work.

(Thanks, G3K, who wrote about it here).

posted by Xeni Jardin at 05:02:31 PM permalink | Other blogs' comments