This week Facebook bought the Boston-based Confirm.io for an undisclosed amount. Confirm.io runs ID authentication checks on any government issued ID. They do it on the spot and without retaining any personal information.
It surprised me how shallow most reporting around this was. The fact that Facebook is buying a company that works on Proof of Identity is very telling. Not only telling but it could have massive consequences for other businesses.
Fake News and content manipulation have been the trojan horse of Facebook this past year. We've gone from a timid social media platform for teenagers to a world-dominating platform that can influence presidential elections. All this in less than 12 months.
Facebook has demonstrated they're extraordinary at scaling. The drawback is that they're awful at knowing who their users are. Yes, they can segment and micro-target like anyone. But they still can't differentiate a persona from who that person is. Facebook isn't alone on this. Any scalable platform is wrestling with the same issues. From Twitter to YouTube to Instagram.
For years, the goal has been to grow. To scale at any rate. To swell no matter what. Trust has been one of these values that we've thrown out of the window. Trusted news? Nah, I get them on my social network. Trusted opinions? Nah, I get them from my Internet friends. Trusted recommendations? Nah, I can ask for the wisdom of the crowds.
Only now we're realizing what the lack of trust can bring upon us. Lack of confidence is manipulating opinion, polarizing countries. It's pushing them towards civil conflict, or worse.
So governments are taking things into their own hands and demanding accountability. Part of that liability is being able to know who the user is. This is, by no means, unique to Facebook. Banks and other industries are required by law to identify their customers. So is Facebook really that different from Paypal?
It's not surprising though, that Facebook is buying a company that can bridge the final gap, tying a user with a physical identity. This way they appease Congress' wrath and try to sidestep any potential regulation.
"Our simple API lets you integrate minutes, and confirm a person’s identity for any transaction that requires or benefits from proof of identity."
Confirm.io
Proof of Identity
So what transactions benefit from Proof of Identity? There are a couple of obvious candidates. One, which most journalists are pointing out, is proof of ownership. You can link my Facebook account to your government ID card. You can then prove ownership of it by producing your document and comparing both. This scenario though isn't the most critical for the company's interests. The scale of ownership requests pales compared to other situations.
The most critical transaction for them involves an exchange of goods. In this case, advertising inventory. Right now, anyone can buy advertising on the platform, without verifying who they are. As long as you have a valid account the company can charge, the rest is mute. The company does this at scale through automation. This means they process thousands of ads per day. It would be impossible for them to confirm each advertiser by hand. This wasn't a problem until Congress starting demanding liability. They needed a scalable solution for this, and fast. This is where Confirm.io came in handy. The amount of advertising transactions per day is orders of magnitude bigger than any ownership claim. Hence the strategic acquisition.
Adding an ID verification step will impact their growth metrics. They know it. But having Congress take matters into their own hands would be worse. Also, they already command, with Google, the majority of the online advertising market share. While they'll feel the hit, they're still an aggregator, and they'll retain most legit users. This is due to the simple fact that they own the user's relationship like no one else does.
The moment Facebook rolls out the change, it will set a new precedent. One that will have broad ramifications. Governments might pass regulations that enforce such verifications. They can even extend it to another type of transactions like posting news.
It's easy to see how the platform can start enforcing identity verification to allow posting. This potential use would cut down on Fake News, but it would also open the door to censorship. Trump's Whitehouse already asked Facebook for the identity of those that spearheaded protests during the President's Inauguration speech. It's hard to believe this could be an isolated incident. Now think of other countries like Russia, Iran, Turkey or China.
The potential for abuse doesn't stop there. Confirm.io ensured they didn't retain any personal information. We don't know what will happen in the case of Facebook. Once again, we have to trust Facebook, something that's becoming harder and harder. No wonder decentralized platforms powered by Blockchain technology are gaining adepts.
Another ID company called SheerID raised 18 million dollars this same week. The Portland organization focuses on verifying specific sectors of society like students, teachers or the military. Their goal is to enable their customers to check their users and decrease coupon or discount redemption fraud.
While a lofty goal, companies can also use their verification process to segment and discriminate their users. It's one thing to use your internal data to infer, with a specific probability, what segment a user is in. It's a very different thing to know it as a fact.
The verification conundrum
The verified vs. anonymous dilemma isn't easy. Where do you set the line? Operating anonymously is one of the critical allures of the Internet. One that has brought much-needed change to decadent power structures. Under the cloak of darkness, lies the possibility of abuse and impunity. The unchecked, uncontrolled freedom of anonymity, paired with our current autonomous systems, can tear the seams of society too.
Verification should be an option for most, a necessity for others. The question remains, what kind of superpowers we ascribe to verified users? Should the platforms treat them with deference? There is no easy answer to this question. It's not black or white. The use cases aren't deterministic and will need to evolve and change as society itself changes.
Dangerous precedents
There are significant ramifications here. Will other platforms adopt similar verification policies? Will Google? Will YouTube? Will Medium? If you're an advertiser on these platforms, how will you handle this? Who will be responsible for your company?
Will other governments start enforcing verification through regulation? The EU Commission comes to mind. Will we see age restrictions implemented on the Internet through ID verification? Any rule to such effect will always hurt the smaller players. Big agents already have the scale and virtuous cycles. These dynamics enable them to keep adding users, despite the increased friction. That's not the case for startups.
Last but not least, I wonder if the enforcement of identity verification can open the door to other incumbents. It's easy to imagine a new player offering unrestricted ads, bot-friendly uploads, anonymous posting, etc. While some countries stifle growth with regulation, other locations might take advantage and create regulatory safe havens.
I'm all for the return of trust, but anonymity is a precious gift too. It's important to balance both if we don't want to live under authoritarian regimes. It's time for the pendulum to swing towards more controls and verifications. Let's hope it will turn back to a more balanced view soon enough.
If you like this article, please share it, and invite others to follow the newsletter, it really helps us grow!