Today, TechFreedom filed comments in response to the Federal Trade Commission’s (FTC) request for public comment on an application to recognize “Privacy-Protective Facial Age Estimation” as a method for website operators to obtain the verifiable parental consent required by the Children’s Online Privacy Protection Act (COPPA). 

“Facial Age Estimation offers age assurance, not age verification,” said Berin Szóka, President of TechFreedom. “If the Commission approves this application, it should issue an accompanying statement explaining what Privacy-Protective Facial Age Estimation (FAE) does and does not do. While FAE may be adequate to provide the age assurance contemplated by the Children’s Online Privacy Protection Act (COPPA), it falls very far from providing the certainty necessary for age verification of older teens, as would be necessary under legislation that has been proposed to expand or build upon COPPA.” 

“Facial Age Estimation cannot do what many lawmakers expect,” Szóka continued. “For example, the Kids Online Safety Act (KOSA) requires an online operator to apply special protections for those users who are likely minors. KOSA purports not to require age verification, but the bill is so vague that sites will have no choice but to implement some kind of age verification technology. FAE simply would not suffice under such legislation. Indeed, FAE does not even attempt to do the hard work of drawing a line between minors and adults. Instead, users whom FAE concludes are likely under 25 must fall back on the very same age verification mechanisms rejected as inadequate in litigation over the Communications Decency Act of 1996 and the Child Online Protection Act of 1998.” 

“Facial Age Estimation appears to be no less ‘reasonable’ a Verifiable Parental Consent method than others already approved by the Commission,” Szóka concluded. “While the existing COPPA rule gives the Commission discretion to recognize new Verifiable Parental Consent (VPC) methods, some users may not trust the privacy protections built into FAE. After all, in analyzing faces, FAE does create new, potentially identifying information about users. Many may reasonably worry: Will such information be used only for the purpose of VPC? Will it be deleted immediately after that use? Or can it be used to identify their faces in other contexts? Such concerns may lead some parents to refuse to use FAE. This, in turn, could limit their children’s enjoyment of digital services. To avoid such consequences, parents should be given the option of using VPC methods that do not involve face scanning.”

###

Find these comments on our website, and share them on Twitter, Bluesky, Mastodon, Facebook, and LinkedIn. We can be reached for comment at media@techfreedom.org. Read our related work, including:

About TechFreedom: TechFreedom is a nonprofit, non-partisan technology policy think tank. We work to chart a path forward for policymakers towards a bright future where technology enhances freedom, and freedom enhances technology.

</>