ADventures in Law

Home | ADventures in Law

The Federal Trade Commission (FTC or Commission) announced on March 29that it was <a href="https://www.ftc.gov/news-events/news/press-releases/2024/03/ftc-denies-application-new-parental-consent-mechanism-under-coppa?utm_source=govdelivery" target="_blank" rel="noreferrer noopener">denying</a> the application for a new mechanism for obtaining verifiable Parental Consent under the Children’s Online Privacy Protection Act (COPPA) Rule. The Entertainment Software Rating Board (ESRB), Yoti and SuperAwesome submitted an application <a href="https://www.ftc.gov/news-events/news/press-releases/2023/07/ftc-seeks-comment-new-parental-consent-mechanism-under-coppa" target="_blank" rel="noreferrer noopener">in July 2023</a> to the FTC, and we had discussed it previously. As a reminder, COPPA requires websites to obtain Verifiable Parental Consent before <a href="https://www.adventures-in-law.com/blogs/an-interesting-new-proposal-on-obtaining-coppa-verified-parental-consent/" target="_blank" rel="noreferrer noopener">collecting</a> personal information online from children under 13 years old. The Rule contains a non-exhaustive list of methods approved to collect Verifiable Parental Consent; these methods include printing and faxing in a consent form, completing a transaction via a credit or debit card, and requiring parents to answer a series of knowledge-based questions.

core/paragraph

ESRB’s <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/Application-for-a-new-VPC-method-ESRB-SuperAwesome-Yoti-06-02-2023.pdf" target="_blank" rel="noreferrer noopener">application</a> sought to create a new method for websites to obtain Verifiable Parental Consent, this time through the use of facial age estimation technology. The application explains, “Facial age estimation uses computer vision and machine learning technology to estimate a person’s age based on analysis of patterns in an image of their face.” The system would convert an image of the parent’s face to numbers and then compare those numbers to patterns in a dataset that are associated with known ages.

In <a href="https://www.ftc.gov/system/files/ftc_gov/pdf/ESRB%20group%20decision%20letter%203.28.24_0.pdf" target="_blank" rel="noreferrer noopener">rejecting</a> this application, the FTC highlighted concerns that were raised during the public comment portion of the process. Commenters that were concerned over privacy protections, accuracy and the use of deepfakes were able to convince the Commission to vote 4-0 to deny the application. The Commission, however, denied the application without prejudice, and the press release noted that in the future, “additional information will be available to assist the Commission and the public in better understanding age verification technologies and the application.” Of course, the use of facial recognition can result in real harm to consumers. As previously discussed in our <a href="https://www.bakerlaw.com/insights/in-case-you-were-focused-on-the-holidays-and-not-the-ftc-its-coppa-and-facial-recognition-time/" target="_blank" rel="noreferrer noopener">blog</a>, the FTC alleged that Rite Aid’s use of facial recognition software designed to reduce theft was biased such that it was racially profiling consumers.

It is worth noting that this Commission action included the vote of newly confirmed Commissioner Melissa Holyoak.

Time will tell if the FTC was right to reject this application and if the application will be refiled once there is further data available to support the use of this technology for COPPA compliance. With the rise of cosmetic procedures having parents looking younger and younger these days, maybe we will be forced to answer knowledge-based questions to prove our age forever. Time to brush up on our ’90s trivia.

It’s Time to Face the Music: FTC Says ‘No’ to Facial Recognition-Based Consent Under COPPA