FTC rejects software companies’ bid to use facial recognition to verify user age

The Federal Trade Commission voted unanimously to reject an application from three software companies looking to install a new parental consent mechanism that would leverage biometric technologies to determine a user’s age. 

In a 4-0 decision made last Friday, commissioners rejected an application submitted in June of 2023 by the Entertainment Software Rating Board; Yoti, a digital identity verification company; and SuperAwesome, a vendor that helps other tech companies comply with parental verification requirements under the Children’s Online Privacy Protection Rule. The decision followed an open comment period that sought feedback on whether to approve a “Privacy-Protective Facial Age Estimation” system.

This system would analyze the geometry of a user’s face to confirm the person is an adult and can access certain content. The FTC confirmed that 354 comments raised concerns with the software’s data collection and storage capabilities, particularly in regards to generating deepfake content, along with other privacy violations.

The FTC acknowledged Yoti submitted the same biometric facial analytics model to the National Institute of Standards and Technology for an evaluation.

“The Commission declines to approve the ESRB group’s application at this time,” the decision reads. “The Commission expects that this report will materially assist the Commission, and the public, in better understanding age verification technologies and the ESRB group’s application.”

Despite NIST’s pending analysis and report, the FTC elected not to “stay” a formal decision to permit time for NIST to complete its review. 

“The Commission does not have sufficient information to indicate that the 90-day timeframe will be adequate to allow the Commission to receive such test results and analyze their impact on the ESRB group’s application,” the decision reads. “Therefore, rather than staying or extending the deadline for the Commission to make a decision on the application, the Commission is declining the application without prejudice to the applicants refiling in the future.”

Advocacy organizations celebrated the FTC’s decision. Fight for the Future, a digital rights nonprofit, characterized it as a victory for privacy rights. 

“Based on a long history of error-ridden facial recognition technologies disproportionately harming people who aren’t affluent, white, and male, we applaud the FTC’s rejection of this facial recognition technology marketed as a tool to verify age,” Campaigns and Communications Director Lia Holland said in a statement. “With technologies like this, the only winner will ever be the tech corporations. Adults must give up not only their faces to be analyzed and potentially monetized, but also allow the rooms in which their children play and learn to be invaded.”

In response, the ESRB told Nextgov/FCW that it was disappointed with the FTC’s ruling.

“We are disappointed that the Federal Trade Commission (FTC) declined to either issue a substantive decision or delay further ruling on our pending application for authorization of Privacy-Protective Facial Age Estimation as a verifiable parental consent method under the COPPA Rule,” the statement reads. 

ESRB added that it remains “hopeful” that its facial age recognition estimation along with “other innovative technologies” used to gain parental consent will be considered compliant with COPPA in the near future based on previous FTC statements on COPPA provisions.

Yoti also said that its technology does not fall under the category of facial recognition. Julie Dawson, Yoti’s chief regulatory and policy officer, told Nextgov/FCW that the distinction between facial recognition and facial analysis systems hinges on cross-checking user facial patterns against a larger database and retaining an identity. 

“Our technology uses facial analysis to estimate a person’s age without identifying or recognising any individual,” Dawson said in a statement. “The technology never knows or learns the name or identity of a person.”

Some push back on this distinction. The Electronic Frontier Foundation, a digital rights nonprofit headquartered in San Francisco, wrote in 2021 facial analysis is a division within facial recognition technologies, and that the distinction is negligible.

“Face recognition has many applications beyond matching one faceprint to another,” the blog post reads. “It is also used to try to guess a person’s demographic traits, emotional state, and more, based on their facial features. A burgeoning industry purports to use what is often called ‘face analysis’ or ‘face inference’ to try to extract these kinds of auxiliary information from live or recorded images of faces.”

CORRECTION: This article was updated April 3 to reflect the correct spelling of the company Yoti and to include additional information.