FTC Considers 'Age Estimation' Scanning Tools

John Lister's picture

The FTC is asking the public whether facial "age estimation" is a smart way to make sure games companies don't break privacy rules for children. The tool would be used to check the age of adults giving consent, not to check the age of the player.

The proposal originally caused some major confusion as it comes from the Entertainment Software Rating Board (ESRB), which rates games for age suitability in a similar way to the Motion Picture Association's movie ratings. However, this proposal has nothing to do with checking whether somebody is old enough to play a game.

Instead, it's to do with the FTC's COPPA rule, which means companies can't collect personal data about a child aged under 13 without the consent of a parent or guardian. Modern video games often collect personal data, for example when setting up an account to track achievements in a game, allow a player to continue a game across multiple devices, or for online play.

For obvious reasons, companies can't just take a person's word for it when they claim to be an adult with the authority to consent to the data collection. In the strictest interpretation of the COPPA rule, companies must verify the identity and age of the adult, for example through a scan of an identity document.

Adults Must Look 25 To Pass

The ESRB has suggested using face scanning technology (for example, through a webcam) to estimate a person's age. As the technology is by no means perfect, the proposal is that the system would allow consent if the person appeared to be 25 or older.

The ESRB says the system would not store any images or data, that it would not be used to train AI systems, and that it would not attempt to identify an individual. It also says it does not intend to recommend the system for verifying somebody is old enough to play or buy a game. (Source: eurogamer.net)

Training Databases Could Cause Problems

The FTC now want public feedback on whether such technology would be adequate or necessary. It also asks where there is "a risk of disproportionate error rates or other outcomes for particular demographic groups". Previous studies have suggested facial recognition tools, often trained on databases of predominately white faces, have proven less accurate when assessing images of black faces. (Source: rockpapershotgun.com)

One potential limitation of the technology is that it can only estimate if the person is old enough to give consent. It doesn't confirm that the person is indeed a parent or guardian of the child in question.

What's Your Opinion?

Is this a good idea? Does setting the minimum estimated age at 25 offer enough leeway to be confident the person is an adult? Will children always find a way to bypass age restrictions?

Rate this article: 
Average: 4 (7 votes)


eric's picture

Besides the obvious and inevitable privacy issues, the best facial recognition right now is highly incompetent. Can it still be fooled by a photograph? I recently did a website facial verification process. It would not work with either my laptop (SD) or desktop (HD) webcams. I had to end up installing their app on my phone (S21+) and even then the selfie camera struggled to get it to work.
Unless they are planning on supplying the entire population with high quality webcams, the technical limitations alone make this a laughable proposition.

If there were no technical roadblocks, there is no way you'd ever get me to believe the government isn't scanning, recording, and filing every photo that goes thru the system.

This whole proposal is nothing but malarkey, from an increasingly incompetent FTC.

Chief's picture

Trust us.
We're the government.
If implemented, it will be just like the past 3 yrs when it comes to opting out.
Every day eroding freedom more.

rhcconsulting_14541's picture

@Chief is right. The scariest sentence in the world: "We're the government and we're here to help."

In my case, the software would have discriminated because I looked very young (I was refused admittance to "Saturday Night Fever" at age 28 even with my driver's licence -- the ticket seller told me it was fake).

Worse is any legislation requiring that you provide a credit card for age verification. Obviously those proposing such legislation are oblivious to the problem of identity theft.

Those proposing such regulation always say they are targeting terrorists or child pornographers, but poorly-written encryption and privacy laws affect us all.

The public would be better served with legislation that punished politicians for their lies.