When to use Facial Age Estimation for online compliance

If you run an online platform that may be subject to age regulations, you may be wondering how to determine the age of your online users. Facial age estimation and age verification technologies help protect the online privacy and safety of children and teens. They assist in complying with laws and best practices. But what are the differences between them, and what are the pros and cons of each?

What is facial age estimation and how does it work?

Facial age estimation uses facial recognition to estimate a person’s age based on their appearance. It’s quick, efficient, and only requires a live facial image. The technology converts an image into numbers and compares them to a data set associated with known ages. The output is a non-identifying age-range estimation.

What is age verification and how does it work?

Age verification relies on documents, such as IDs or credit cards, to confirm the age of a user. It requires users to provide some personal information, and may involve some delay or cost for online platforms. Age verification compares a document or a credential from to a trusted source to verify or reject their identity.

Reasons for using facial age estimation

Facial age estimation can help online platforms filter content they show to their users based on their estimated age.Websites can guess how old users are and stop them from seeing certain things if they’re too young. Platforms may block inappropriate or harmful for them, such as violence, nudity, or gambling.

This can help online platforms comply with the legal or ethical requirements that apply to their services or features, such as COPPA, KOSA, or CCPA.

What are the pros and cons of facial age estimation?

Pros

• Less friction and higher conversion rates
• Less intrusive to privacy
• Lower cost

Cons

• Age estimation is not certain
• Doesn’t guarantee being within a specific age boundary
• Doesn’t allow for identity mapping
• Doesn’t support parental consent

When and why to choose age verification over facial age estimation?

Some of the reasons why someone might want to choose age verification over age estimation are:

Confirm the age of users who claim to be over a certain age: 

Age verification can provide high certainty of an individual’s identity, based on their documents or credentials. These documents show their legal age. Age verification is more accurate and consistent because data is not affected by lighting, angle, expression, or makeup.

Age verification can also be more difficult to fool or bypass by users who use fake or stolen documents. This can be useful for online platforms that need to check age before accessing content restricted to adults, such as alcohol, tobacco, or gambling.

Obtain parental consent for data collection or content exposure for users who are under a certain age: 

You can use age verification as a part of verifying a parental relationship. This can help in cases when:

• A child under 13 requires parental consent.
• Avoiding collecting minors’ personal information
• Content exposure subject to COPPA, KOSA, or other laws or regulations
• Verifying the age or the consent of a child who may be using a parent’s device or account

Age verification can also prevent a child from accessing inappropriate or harmful content or services that are intended for adults, or vice versa. This can be useful for online platforms that need to comply with the legal and ethical standards of online conduct, and to protect the rights and interests of children and teens.

Verify the identity of users who need to provide proof of identity for certain transactions or activities: 

Age verification can verify the identity of users who need to provide a valid ID or a credit card, before making a purchase, opening an account, or accessing a service that requires identity verification, such as banking, healthcare, or education. Age verification can also provide a binary decision related to meeting a specific age requirement. This can be useful for online platforms that need to ensure the security and integrity of their transactions or activities, and to prevent fraud or abuse.

Avoid racial bias and inequity that may affect facial recognition algorithms: 

Age verification may perform equally well for different racial groups, as documents or credentials are more likely to identify people of color correctly than facial recognition algorithms. Age verification may also create fewer barriers or disadvantages for users of color, who may have more access to or trust in document-based technologies, or who may face lower privacy or security risks from document data collection or misuse. This can be useful for online platforms that need to respect the diversity and equity of their users, and to avoid unfair or discriminatory outcomes.

How does facial age estimation differ from biometric verification and why is it more privacy-friendly?

Facial age estimation uses facial recognition to estimate a person’s age based on their appearance. Biometric technology can be used for authentication, but it can also pose various risks, such as identity theft, data breach, or discrimination.

Facial age estimation is different because Biometric verification requires collecting and storing personal information from the user.

Facial age estimation does not require any additional input from the user, other than their face, and can be done in real time and at scale.

Age estimation also does not collect or store any personal information from the user, other than their face, which can be anonymized or deleted after the estimation is done. Age estimation also respects the user’s choice and consent, as they can opt out of the estimation or provide their own age if they prefer. The U.K. Information Commissioner’s Office (ICO) recognized this distinction, explaining facial age estimation “can be distinguished from other facial recognition technologies that are designed to identify a unique individual”1.

Facial age estimation adoption in government regulations

Facial age estimation is becoming more accepted by governments around the world, as they recognize its benefits and limitations, and provide guidance and regulation for its use. For example, the FTC issued a Biometric Information Policy Statement, which outlines its views on the use of biometric information with respect to consumer privacy, data security, and the potential for bias and discrimination.

The FTC also provided some recommendations for online platforms that use biometric information, such as obtaining consent, providing notice, implementing security measures, and providing choices and controls for users4. The ICO also issued a guidance on the use of facial recognition technology, which covers the use of facial age estimation, and provides some examples and scenarios of how it can be used in a lawful and ethical manner. The ICO also encourages online platforms to conduct data protection impact assessments, and to consult with stakeholders and users, before using facial age estimation5.

Online platforms that use or consider using age estimation should follow the guidance and regulation from the relevant authorities, and also adhere to the best practices and recommendations from the International Association of Privacy Professionals (IAPP) and other organizations that address the ethical and legal implications of age estimation and biometric technology678. Online platforms should also be transparent and accountable to their users, and inform them about how and why they use facial age estimation, and what choices and rights they have.

Why online platforms need to comply with age regulations

Online platforms that collect data from children and teens may face various legal and ethical challenges, such as:

• Protecting the rights and interests of children and teens, who are vulnerable and impressionable online users, and who may face various risks and harms online, such as exposure to inappropriate or harmful content, exploitation or abuse by predators, cyberbullying or harassment by peers, identity theft or fraud by hackers, or manipulation or influence by advertisers or marketers.
• Complying with the legal and ethical standards of online conduct, such as COPPA, KOSA, CCPA, and BIPA, which may require online platforms to obtain parental consent, provide notice and transparency, implement data security and privacy measures, and respect user choices and rights, among other obligations. Online platforms that fail to comply with these standards may face legal actions, fines, penalties, or reputational damages, as well as lose the trust and confidence of their users and stakeholders.

Some examples of online platforms that have not complied with age regulations and the consequences they have faced are:

Google and YouTube pay $170 million to COPPA allegations

In 2019, Google and its subsidiary YouTube agreed to pay a record $170 million to settle allegations by the FTC and the New York Attorney General that they violated COPPA by collecting personal information from children without their parents’ consent. The FTC alleged that YouTube used persistent identifiers, such as cookies, to track viewers of child-directed channels and deliver targeted ads to them, without notifying the channel owners or the parents of the data practices or obtaining verifiable parental consent1.

TikTok pays $5.7 million to settle COPPA violations

In 2019, TikTok, formerly known as Musical.ly, agreed to pay $5.7 million to settle allegations by the FTC that it violated COPPA by collecting personal information from children under 13 without parental consent. The FTC alleged that Musical.ly required users to provide an email address, phone number, username, first and last name, a short biography, and a profile picture, and also allowed users to interact with other users through direct messages and public comments, without providing notice to parents or obtaining verifiable parental consent2.

OnlyFans and Pornhub fail to verify age of users and performers

In 2020, OnlyFans and Pornhub, two popular online platforms that host adult content, were accused of failing to verify the age and identity of some of their users and performers, and of hosting illegal and abusive content, such as child pornography, rape, and revenge porn. OnlyFans and Pornhub faced criticism and pressure from lawmakers, activists, and payment processors, and were forced to implement stricter age and identity verification measures, such as requiring users to upload a photo of their ID and a selfie, and to pass a facial recognition test.

Roblox violates COPPA and pays $5.5 million

In 2018, Roblox, a gaming platform that allows users to create and play games, was fined $5.5 million by the FTC for violating COPPA by collecting personal information from children under 13 without parental consent. The FTC alleged that Roblox collected names, email addresses, and IP addresses from children who registered for accounts, and also allowed children to chat with other users, without providing notice to parents or obtaining verifiable parental consent.

Online platforms need to comply with age regulations, not only to avoid legal risks and liabilities, but also to protect the rights and interests of children and teens. Online platforms should also be transparent and accountable to their users, and inform them about how and why they use age estimation, and what choices and rights they have.

Conclusion

Facial age estimation and age verification are two ways to figure out the age of your online users. They can help you follow the rules and protect the kids and teens who use your platform. But they are not the same thing.

Age estimation uses facial recognition to guess the age of a user based on how they look. It’s fast, easy, and private, but it’s not always accurate or reliable. Age verification uses documents or cards to check the age of a user based on who they are. It’s more certain and suitable, but it’s also more costly and intrusive. Age estimation can be good for filtering content or gating access. It also has many benefits related to user experience and reducing privacy concerns.