Whether your focus is privacy, advertising or both, there is a good chance that you have bumped into some thorny issues involving the Children’s Online Privacy Protection Act (COPPA). In general, COPPA prohibits websites or apps from collecting “personal information” from children under the age of 13 without first obtaining verified parental consent (VPC). Through rulemaking, the Federal Trade Commission (FTC) has modified the definition of personal information over the years to include a wide array of information, including precise geographical information and persistent identifiers that are used for, among other things, behavioral advertising.
COPPA has many exacting requirements, and we are seeing more FTC law enforcement focusing on making sure all the technical niceties of COPPA are met. Children’s privacy has been an FTC focus for years, and COPPA is particularly important now because it does allow the FTC to seek civil penalties or potentially other forms of monetary relief.
Here we discuss VPC in more depth. The COPPA Rule itself details a few approved methods for obtaining parental consent (including signed consent forms or ID checks) but also provides a way for companies to submit proposals regarding new methods of obtaining parental consent for the FTC to review and consider. This is a particularly important process, given the practical challenges with existing VPC methods and broad interest in new VPC methods that are less costly, less expensive, and more practical and efficient.
This process of obtaining a new approved method of VPC has only been attempted six times in the past, and according to the FTC’s handy-dandy scorecard, it has a 33 percent success rate. The agency looks quite closely at the proposals and the comments that are filed. So when new proposals arise, they warrant the agency’s and the public’s scrutiny.
The latest proposal comes from the Entertainment Software Rating Board, SuperAwesome and Yoti, and it proposes a new and unique method of VPC that would use “facial age estimation” in order to confirm that an adult is granting COPPA consent. In short, the proposal explains that “[f]acial age estimation uses computer vision and machine learning technology to estimate a person’s age based on analysis of patterns in an image of their face” and that the model was developed through the use of “millions of images of diverse human faces with their actual month and year of birth.”
Given broad concerns and restrictions on the collection and use of biometric data, the proposal explains in detail how this system is designed with privacy and data minimization in mind. It would only estimate age and would not identify the person providing consent. Further, images would be “immediately, permanently deleted.” And to address concerns about kids trying to circumvent the proposal through photos, the proposal explains that the system would also prevent the use of still images and would require a “live human face.” There is also an interesting discussion on how the proposal can mitigate potential bias by using a broad range of individuals across a spectrum of skin tones and ages.
The proposal has been shared with the public, and the FTC is now seeking comments until August 21, on whether this proposal meets COPPA’s VPC requirements. Given persistent concerns about the challenges of existing VPC methods, we are eager to see how the public and the FTC respond to this innovative proposal.
[View source.]
