In order to implement the relevant requirements of the U.S. COPPA (Children’s Online Privacy Protection Act), the Entertainment Software Rating Board (ESRB) and other U.S. institutions have proposed a new mechanism for obtaining parental consent.
At present, the U.S. Federal Trade Commission (FTC) is soliciting public comments on this application.
Under COPPA, where an online website or service is primarily directed to children under the age of 13, parental consent must be obtained before collecting or using a child’s personal information.
The rule sets out several example methods and also reserves a mechanism allowing the public to submit new methods of verifiable parental consent to the FTC for approval.
“If you intend to disclose a child’s personal information to a third party, or permit the child to publicly disclose such information (for example, through social networking services, online forums, or personal profiles), you must use a method that is reasonably calculated, in light of available technology, to ensure that the person providing consent is the child’s parent.
The specific methods set forth in the Rule or separately approved by the Commission include:
Providing a consent form signed by the parent and returned by U.S. mail, facsimile, or electronic scan (the “print-and-send” method);
Requiring the parent, in connection with a monetary transaction, to use a credit card, debit card, or other online payment system, and providing notification of each discrete transaction to the primary account holder;
Allowing the parent to call a toll-free telephone number staffed by trained personnel, or allowing the parent to contact trained personnel through a video conference;
Verifying the parent’s identity by checking a government-issued identification document against a database containing such information, provided that you promptly delete the parent’s identification document after verification is completed;
Requiring the parent to answer a series of knowledge-based challenge questions that would be difficult for anyone other than the parent to answer, with such questions separately approved by the Commission pursuant to the procedures set forth in FAQ I.12;
Verifying a photograph of the parent’s driver’s license or other photo identification, and then using facial recognition technology to compare that image with a second photograph submitted by the parent, subject to separate Commission approval under the procedures set forth in FAQ I.12; and
If you intend to use the child’s personal information solely for internal purposes (i.e., you will not disclose such information to third parties or make it public), you may use any of the methods above, or you may use the “email plus” method for obtaining parental consent.
Under the “email plus” method, the parent provides consent in response to a direct notice sent to the parent’s online contact address.
To properly use the email plus method, you must take an additional confirmation step after receiving the parent’s message (this is the “plus” factor).
The confirmation step may include:
In the initial message to the parent, requiring the parent’s reply to include a telephone number, fax number, or mailing address so that you may confirm consent by telephone, fax, or postal mail; or
After a reasonable delay, sending a second message to the parent’s online contact information to confirm consent. This confirmation message should include all of the original information contained in the direct notice, inform the parent that he or she may revoke consent, and explain how such consent may be withdrawn.”
(FTC-listed verifiable methods)
The ESRB is currently operating a COPPA Safe Harbor Program. Digital verification company Yoti and software company SuperAwesome have also joined the program to provide technical support and help companies comply with parental verification requirements.
The ESRB and these companies have requested that the FTC approve a new Verifiable Parental Consent (VPC)mechanism, namely “Privacy-Protective Facial Age Estimation” technology.
This technology accurately determines a person’s age by analyzing the geometric structure of the user’s face and further confirms whether the user is an adult.
The verification process includes the following steps:
- The user takes a photograph of themselves;
- The system then checks whether a real human face is present in the image;
- The image is then uploaded to Yoti’s backend server for age estimation.
At present, the FTC is soliciting comments on the proposal, including:
whether the proposed age verification method falls within the scope of existing approved methods;
whether it complies with the requirements of the COPPA Rule; and
whether the proposed method may create privacy risks relating to consumers’ personal information, including biometric information.
