CDT Comments Urge FTC to Consider Broad Implications of Confirming Parent-Child Relationships
Under the Children’s Online Privacy Protection Act (COPPA) regulations, the Federal Trade Commission (FTC) can approve new proposed methods for obtaining a parent’s verifiable consent to collect their child’s personal information online. Any method to obtain verifiable parental consent “must be reasonably calculated, in light of any available technology, to ensure that the person providing consent is the child’s parent.” CDT recently submitted comments on a new proposal before the FTC that uses facial age estimation for this purpose.
The proposed method would estimate whether a person giving consent for a child is over the age of 25 and is therefore old enough to be that child’s parent. Our comments observe that methods previously approved by the FTC combine multiple indicators to make it less likely that the person providing consent is someone other than the child’s parent, such as an older sibling, a nanny, or even an adult grooming the child.
In contrast, the new proposal uses the age estimation threshold alone to indicate a parent-child relationship. It is designed to be easy for parents to use while requiring minimal information from parents. But the FTC will have to weigh these benefits against the likelihood that this more frictionless approach would easily enable a person who is not the child’s parent to provide consent.
As CDT’s comments note, the FTC’s guidance as to whether a method meets this standard has implications not only for COPPA enforcement, but for any context that requires implementing methods that are sufficient to establish a parent-child relationship. In addition to examining whether the designated age threshold alone is adequate to confirm the relationship, the FTC’s guidance should advise on requirements to avoid disparate outcomes for certain groups.
