Federal Trade Commission Seeks Input on New Age Verification Method for Children Online
The Federal Trade Commission (FTC) is seeking public comment on an application from the Entertainment Software Rating Board (ESRB), Yoti, and SuperAwesome for a novel approach to obtaining parental consent under the Children’s Online Privacy Protection Act (COPPA) Rule. The COPPA Rule mandates that online platforms targeting children under 13 must obtain parental consent before collecting any personal information from children. The Rule outlines several acceptable methods for obtaining consent, but it also allows interested parties to propose new verifiable methods for approval by the Commission.
ESRB, the self-regulatory body for the U.S. video game industry, has sought approval for a new technology called Privacy-Protective Facial Age Estimation, which utilizes facial recognition technology to verify the age of a user. This technology assesses the geometric features of a person’s face to determine whether they are an adult.
Facial age estimation relies on computer vision and machine learning algorithms to analyze patterns in facial images and estimate a person’s age. Unlike facial recognition, which aims to identify specific individuals using unique facial measures matched against a database, facial age estimation focuses on age-related patterns in a person’s face. To develop its neural network model, Yoti, a digital identity company, trained its system using millions of images of diverse human faces with associated birth dates.
When using this technology, users capture a selfie in real-time, ensuring that the image depicts a live human face. Yoti’s proprietary anti-spoofing technology minimizes the risk of children bypassing the system by using images of adults or unaware individuals. The captured image is encrypted and transmitted securely to Yoti’s server for age estimation processing, a process that takes less than a second on average. The website or app operator receives a simple yes/no result indicating whether the individual meets the designated age threshold of 25 years.
According to the application, the facial age estimation system correctly identifies adults with 99.97% accuracy. The FTC is now seeking public comment on several aspects of the application, including whether the proposed method falls within the scope of existing approved methods, whether it adequately ensures parental consent, and its potential privacy risks, particularly in relation to the collection of biometric information.
The introduction of new, effective methods for obtaining parental consent is crucial for online platforms targeting children under 13. These methods not only help platform operators ensure compliance with COPPA but also assist parents in granting consent for their children’s online activities.
Currently, there are a few approved methods for obtaining verifiable parental consent, such as providing a government-issued identification, credit card authorization, or using video conferencing. If approved, the proposed facial age estimation method would expand the list of acceptable methods under COPPA.
The application submitted by ESRB, Yoti, and SuperAwesome is backed by substantial data and has already been implemented for legally required parental consent outside the United States. Since 2022, the method has generated over 4.8 million age estimates.
The FTC’s call for public comment presents an opportunity for stakeholders to provide feedback on the proposed technology. The agency is particularly interested in understanding if the facial age estimation method meets the requirements of the COPPA Rule and whether it poses any privacy risks. The deadline to submit comments is August 21, 2023.
The utilization of privacy-protective facial age estimation technology could provide an efficient and reliable means to verify the age of children online, promoting a safer digital environment for young users. Nonetheless, it is essential for stakeholders to carefully evaluate the proposed method to ensure its compliance with regulatory standards and protection of users’ privacy.
