CDD Executive Director Jeff Chester wrote in an email Thursday that child privacy advocates had scored a significant victory as the FTC had ordered Riyo to immediately destroy any data it gathers from a child or parent. The organization holds, however, that the mechanism for parental consent using facial recognition is ill-advised. “While facial recognition technology has many applications, its role protecting children’s privacy is unproven,” Chester added.
The Federal Trade Commission has approved a new method for companies to get parents’ consent for their children to access online services covered by the Children’s Online Privacy Protection Act (COPPA) Rule. Based on an application submitted by Riyo, Inc., the Commission has approved the use of “face match to verified photo identification” (FMVPI) as a method to verify that the person providing consent for a child to use an online service is in fact the child’s parent. Under the COPPA Rule, online sites and services directed at children must obtain permission from a child’s parents before collecting personal information from that child. The rule lays out a number of acceptable methods for gaining parental consent, but also includes a provision allowing interested parties to submit new verifiable parental consent methods to the Commission for approval. FMVPI is a two-step process. In the first step, a parent provides an image of their photo identification, such as a passport or driver’s license. The authenticity and legitimacy of the document is then verified using various technologies that analyze the image to ensure that it is an authentic government-issued identification. In a second step, the parent is then prompted to provide a picture of themselves taken with a phone or web camera, which is analyzed to confirm that the photo is of a live person and not a photo of a still photo. The image is then compared to the identification photo using facial recognition technology to confirm whether the person submitting the photo is the one in the identification. The process includes certain privacy safeguards such as requiring encryption and prompt deletion of any personal information that is collected. The Commission vote to issue the letter and accept FMVPI as an acceptable verifiable parental consent method was 4-0. The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics. Like the FTC on Facebook, follow us on Twitter, and subscribe to press releases for the latest FTC news and resources.