In a move that could affect all game publishers and developers in the United States and Canada, the Entertainment Software Ratings Board (ESRB) has filed a “Application for Approval of a Verifiable Parental Consent Method” with the Federal Trade Commission (FTC) to implement in online services (game-related).
The Privacy-Protective Facial Age Estimation program is being facilitated by software developer Yoti and Epic Games-owned parental consent management software company SuperAwesome. The goal, according to the ESRB, is to make it easier for companies to be in compliance with the Children’s Online Privacy Protection Act (COPPA) by verifying the age of a consenting adult parent or guardian without collecting personal information.
According to data provided in the filing, this new Privacy-Protective Facial Age Estimation system would work in the following way:
1. Child visits an online service and is presented with a neutral age gate.
2. Operator collects a parent’s email address from the child.
3. Operator sends direct notice to parent pursuant to Section 312.4(c) of the COPPA Rule.
4. Parent provides relevant permissions for the child.
5. Operator informs parent of the requirement to verify they’re an adult; offers parent a
choice of verification methods.a. Parent selects Privacy-Protective Facial Age Estimation.
b. Parent is given notice of how facial age estimation works and provides consent
for the collection of a face scan for the purpose of VPC.c. Parent provides consent to access the camera on their device.
d. Parent presents face to the camera, the system performs a liveness test and takes a
selfie.e. Age estimation takes place and collected image is deleted.
f. System provides results of age estimation to operator, confirming whether the
parent is over the configured age threshold.6. If Facial Age Estimation concludes the person is not an adult, then one of the following
will occur (depending on the operator’s configuration):a. If the person is estimated as being 18-25, or there is some other uncertainty about
whether the person is an adult, the person is returned to the beginning of step 5,
where they can choose an alternative verification method that uses additional
personal information, such as a payment card, driver’s license or SSN.b. If the person is estimated as being under the age threshold, the operator will
inform the person that VPC is denied and direct them to contact the operator’s
customer support if they disagree with the result or believe there was a technical
error.
More details on the system can be found in this whitepaper. The ESRB filed with the FTC in June, but on July 19, the government watchdog agency announced a request for public comment to allow those who want to support or oppose the ESRB’s plan time to make their objections. The public comment period will close on Aug. 21.
The ESRB, which provides age and content ratings for video games in the United States and Canada, was established in 1994 by video game trade group the Entertainment Software Association (ESA) following a period of government concerns about violence in video games. The trade group decided to create an independent system, thus avoiding government-enforced ratings on video games. The ESRB’s system is modeled somewhat after similar ratings systems for movies and music in North America.
