In 2023, the Entertainment Software Rating Board, in collaboration with digital identity firm Yoti and provider of “youth marketing solutions” Superawesome, submitted a proposal to the FTC for a new method of “verifiable parental consent” known as Privacy-Protective Facial Age Estimation. The FTC has recently responded to this proposal with a temporary “no.”
The introduction of the ESRB’s proposed technology immediately raised concerns, particularly regarding the requirement of submitting a selfie to a machine to verify eligibility to play GTA 6. This process is seen as intrusive, raising questions about technological biases and the effectiveness of such a system, which could lead to complications for some users.
The ESRB was swift to clarify that the system’s purpose is solely to estimate age, not to identify individuals, and that no data would be retained post-analysis. The primary objective was to ensure compliance with COPPA—the Children’s Online Privacy Protection Act—a US law mandating “verifiable parental consent” for data collection from children under 13, unlike the voluntary ESRB rating system.
While violating COPPA can result in substantial penalties, such as the \(275 million penalty for Epic Games in 2022 and the \)20 million fine for Microsoft in 2023, companies are motivated to find efficient solutions to demonstrate compliance. However, the FTC’s ruling on March 29 rejected the proposed solution due to uncertainties about its functionality.
The denial was issued without prejudice, allowing the ESRB and its partners to resubmit the application in the future. The FTC’s decision was based on the lack of clarity on how the proposed system would operate, rather than concerns about mass submission of selfies for age verification.
The FTC mentioned that Yoti had submitted a “facial age estimation model” to the National Institute of Standards and Technology in September 2023, but the evaluation report was pending. Despite the ESRB’s request for a 90-day delay to await the NIST report, the FTC proceeded with the denial due to the uncertainty of the report’s timeline.
In conclusion, the FTC neither endorsed nor rejected the application but suggested a potential resubmission post the NIST report’s release for a better understanding of age verification technologies and their applications.
