FTC Seeks Comments on Proposed Facial Age Mechanism under COPPA

The Children’s Online Privacy Protection Act Rule (COPPA Rule) requires that online sites and services directed to children under 13 obtain parental consent before collecting or using children’s personal information and lists existing methods for such consent. Now the Federal Trade Commission (FTC) is seeking comments on whether it should expand its parental consent methods to include a potential new mechanism. On July 20, 2023, the FTC published a notice in the Federal Register seeking comments on an application from the Entertainment Software Rating Board (ESRB) and tech companies Yoti and Super Awesome that proposes using facial age estimation technology that analyzes the geometry of the face to confirm a person is an adult. 

The process for estimating facial age is, according to the applicants, significantly different from facial recognition technology, and avoids complications associated with facial recognition:

Facial age estimation uses computer vision and machine learning technology to estimate a person's age based on analysis of patterns in an image of their face. The system takes a facial image, converts it into numbers, and compares those numbers to patterns in its training dataset that are associated with known ages. By contrast, facial recognition technology, which seeks to identify a specific person based on a photo, looks for unique geometric measures of the face, such as the distance and relationship among facial features, and tries to match these to an existing unique set of measurements already recorded in a database along with unique identifying information.

Comments are welcome on any aspect of the proposal, but the FTC is particularly interested in feedback on the following questions:

1. Is the proposed method already covered by existing methods in the COPPA Rule?

2. Does the proposed method meet the requirements for parental consent set forth in the COPPA Rule? Specifically, is it reasonably calculated, considering available technology, to ensure that the person providing consent is the child's parent?

3. Does the proposed method pose a risk to consumers' personal information, including consumers' biometric information? If so, is that risk outweighed by the benefit to consumers and businesses?

4. Does the proposed method pose a risk of disproportionate error rates or other outcomes for particular demographic groups? If so, is that risk outweighed by the benefit to consumers and businesses?

The deadline for comments is August 21, 2023.