On March 29, 2024, the Federal Trade Commission (the “FTC”) published a unanimous decision to deny an application by the Entertainment Software Rating Board, Yoti, and SuperAwesome (collectively, the “Applicants”) to add a new verifiable parental consent (“VPC”) mechanism under the Children’s Online Privacy Protection Rule (“COPPA Rule”). The application, which our previous blog post analyzed in more detail, requested the FTC to approve Yoti’s “Facial Age Estimation” technology as a valid method to obtain VPC.

COPPA Rule requires covered operators to obtain VPC before collecting personal information from children under thirteen, and it currently recognizes seven (7) acceptable VPC mechanisms. COPPA Rule also gives the FTC an authority to permit new VPC mechanisms that are “reasonably calculated, in light of available technology, to ensure that the person providing consent is the child’s parent.” The Applicants requested the FTC to exercise this authority to approve the Facial Age Estimation technology, a machine-learning technology that analyzes a person’s facial geometry to confirm whether he or she is an adult, as a new mechanism to obtain VPC.

After receiving more than 350 public comments, the FTC denied the application but expressly stated that it is “taking no position on the merits of the application.” The decision instead referenced Yoti’s submission of its facial age estimation model for review by the National Institute of Standards and Technology (the “NIST”), the result of which would likely have material impacts on the FTC’s evaluation of the application. Having insufficient information as to when the NIST would release the result, the FTC refused to approve the application or extend its March 29, 2024 decision deadline. The FTC thus denied the application without prejudice, which would allow the Applicants to refile the application once the result of the NIST’s review becomes available.

[View source.]