FTC Considers 'Age Estimation' Scanning Tools

The FTC is asking the public whether facial "age estimation" is a smart way to make sure games companies don't break privacy rules for children. The tool would be used to check the age of adults giving consent, not to check the age of the player.

The proposal originally caused some major confusion as it comes from the Entertainment Software Rating Board (ESRB), which rates games for age suitability in a similar way to the Motion Picture Association's movie ratings. However, this proposal has nothing to do with checking whether somebody is old enough to play a game.

Instead, it's to do with the FTC's COPPA rule, which means companies can't collect personal data about a child aged under 13 without the consent of a parent or guardian. Modern video games often collect personal data, for example when setting up an account to track achievements in a game, allow a player to continue a game across multiple devices, or for online play.

For obvious reasons, companies can't just take a person's word for it when they claim to be an adult with the authority to consent to the data collection. In the strictest interpretation of the COPPA rule, companies must verify the identity and age of the adult, for example through a scan of an identity document.

Adults Must Look 25 To Pass

The ESRB has suggested using face scanning technology (for example, through a webcam) to estimate a person's age. As the technology is by no means perfect, the proposal is that the system would allow consent if the person appeared to be 25 or older.

The ESRB says the system would not store any images or data, that it would not be used to train AI systems, and that it would not attempt to identify an individual. It also says it does not intend to recommend the system for verifying somebody is old enough to play or buy a game. (Source: eurogamer.net)

Training Databases Could Cause Problems

The FTC now want public feedback on whether such technology would be adequate or necessary. It also asks where there is "a risk of disproportionate error rates or other outcomes for particular demographic groups". Previous studies have suggested facial recognition tools, often trained on databases of predominately white faces, have proven less accurate when assessing images of black faces. (Source: rockpapershotgun.com)

One potential limitation of the technology is that it can only estimate if the person is old enough to give consent. It doesn't confirm that the person is indeed a parent or guardian of the child in question.

What's Your Opinion?

Is this a good idea? Does setting the minimum estimated age at 25 offer enough leeway to be confident the person is an adult? Will children always find a way to bypass age restrictions?