Asking the FTC to approve facial age estimation for verifiable parental consent

profile picture Yoti 3 min read
Father and son using devices together

Together with the Privacy Certified program of the Entertainment Software Rating Board (ESRB) and Kids Web Services Ltd, a wholly owned Epic Games subsidiary, we are asking the Federal Trade Commission (FTC) for approval to implement facial age estimation as an authorised method for verifiable parental consent (VPC). The Children’s Online Privacy Protection Act (COPPA) requires companies to ensure they are not collecting personal data from children under the age of 13 without a parent’s consent. Currently, the COPPA Rule enumerates seven, non-exhaustive methods that enable parents to verify their consent. These include verification by government ID, credit card transaction, and a method that involves facial recognition, which is different from what we propose in our application.

We’d like the FTC to authorise facial age estimation as another VPC method to give parents and operators more choice in how parents can prove their age and grant consent. We are not seeking approval to implement this technology to check if children are old enough to purchase, download, and/or play a video game. Children are not involved in the age estimation process at all, which is designed to confirm that parents are adults, as required under COPPA.

We’d like to explain how the FTC application seeks to implement the technology in a way that is consistent with COPPA’s requirements for data minimisation, confidentiality and security.

  • Facial age estimation provides an accurate, reliable, accessible, fast, simple and privacy-preserving method to ensure that the person providing consent is an adult.
  • Facial age estimation is not facial recognition; it estimates a parent’s age without identifying them. It does so by converting the pixels of a facial image into numbers and comparing the pattern of numbers to patterns associated with known ages.
  • Facial age estimation does not create a database of faces. It doesn’t learn the user’s name, identity or anything about them. It does not scan their face against a database.
  • The technology is inclusive; it requires no collection of identity or payment card information.
  • It is accurate and does not show material bias among people of different skin tones. We have done extensive testing based on millions of facial scans and publish the accuracy levels transparently.
  • In our proposed application, facial age estimation is always presented as an option to parents alongside other approved methods of verification, providing the parent with a choice of methods.

If you have any questions about our FTC application, please get in touch.

Keep reading

An image of two people in an office, sitting at a desk and working together with a laptop.

Effective ways to improve your AML compliance

Managing financial crime presents a complex challenge for financial institutions. Due to its covert nature, the full scope of money laundering is difficult to truly know. The United Nations Office on Drugs and Crime (UNODC) estimates that between 2-5% of global GDP (up to $2 trillion in US dollars) is laundered every year. As financial crime becomes more sophisticated and regulations grow tighter, businesses must prioritise robust anti money laundering (AML) measures. Industries like banking, fintech and financial services need strong AML processes to protect themselves from fraud, penalties and legal risks. We explore how your business can strengthen

7 min read
Image of a woman using her smartphone to verify her identity with a driving licence. Small illustrations around her represent security, speed, seamlessness and accuracy.

Myth-busting identity verification

Identity verification is the process of confirming that a person is who they say they are. It typically involves validating an individual’s personal information, such as a name or date of birth, against identity documents or other official records and databases. Verifying a person’s identity is crucial for safe and trusted transactions. It helps you to protect your business from fraud, prevent deepfake attacks and comply with regulations.   Addressing misconceptions about identity verification There’s lots of conflicting information out there about how you can verify your customers’ identities. We’re here to dispel some commonly-held myths about identity verification.

7 min read
Companies house identity verification

An overview of changes to Companies House identity verification standard (and what it means for ACSPs)

As an Authorised Corporate Service Provider (ACSP), you’ll be aware of the upcoming changes to the Companies House identity verification standard. In 2025, anyone setting up, running, owning or controlling a company in the UK, namely directors and persons with significant control (PSCs), will be required to verify their identity to prove who they are. These changes come as part of the Economic Crime and Corporate Transparency Act 2023 and aim to prevent anyone seeking to use Companies House for fraudulent activities. Failing to comply with mandatory identity verification requirements could result in fines and restrictions on company activities.

3 min read