The US Federal Trade Commission has rejected a proposal to include facial age estimation technology as a valid method for obtaining parental consent when gathering children's information under the Children's Online Privacy Protection Act (COPPA).
COPPA requires websites to collect data from children under 13 to obtain parental consent. Approved methods include credit card verification, signed consent forms via mail/fax, or video calls with trained personnel. The hope had been that facial recognition tech could successfully ascertain a child's age and provide the necessary reassurances rather than rely on more complex (and secure) old-style methods.
Now, GamesIndustry.biz have reported that a joint application from the Entertainment Software Rating Board, SuperAwesome (which runs the free parental consent management platform Kids Web Services), and Yoti, a developer of the tech has failed.
The FTC has received more than 350 comments on the issue with many raising privacy concerns and the use and creation of deepfakes while some questioned the basic effectiveness of the technology. While the tech has its fans - with some consulted parties arguing that it is similar to current methods for verifying parental consent and that the proposed technology included enough privacy measures to be valid - the FTC's ruling mean that - for now at least - the old rules remain in place and the new tech goes back to the drawing board.
In the end, the commissioners voted 4-0 unanimously to reject the application but refrained from making a final decision on the proposal's merits, leaving the possibility open for it to be resubmitted in the future.
Not quite there yet
The hopes were high that the technology would advance rapidly enough to empower app makers to pursue their creative endeavours while ensuring robust security measures to screen users effectively. However, the FTC's cautious approach indicates a continued emphasis on holding platform holders and developers accountable, prioritizing user safety above all else.
The ESRB asked the FTC to wait 90 days for NIST's assessment, but the FTC declined due to uncertainty about completing and considering the assessment within that timeframe. As for the possibility of the ESRB re-filing its application in the future, the group stated, "We have not reached a decision at this point."
Perhaps in the future, technology will evolve to a point where it can be fully trusted but for now, the reliance on human oversight and the enforcement of laws remains crucial to ensure that malicious actors are identified and held accountable.
