• by Wendy Davis , 11 hours ago

The Federal Trade Commission said this week that web companies won't violate the children's privacy law by collecting personal information from young children in order to determine their ages, provided the companies don't use the data for other purposes and meet some additional security requirements.

The agency explicitly said its new policy aims to encourage businesses to use age verification technology, adding that some verification technology is more reliable than companies' current methods of determining users' ages.

“Age verification technologies are some of the most child-protective technologies to emerge in decades,” Christopher Mufarrige, head of the agency's consumer protection division, stated. “Our statement incentivizes operators to use these innovative tools, empowering parents to protect their children online.”

But even though the FTC characterizes its policy as encouraging age verification, observers say its more accurate to describe the policy as removing an obstacle to verification technology.

That's because the Children's Online Privacy Protection Act currently appears to ban web companies from asking children to submit personal information -- including photos of themselves -- for age verification purposes.

The Children's Online Privacy Protection Act prohibits companies from knowingly collecting personal data from children under 13, including their biometric information, without parental consent. The new policy statement, however, creates an exemption to that prohibition -- but only for the purpose of determining whether a user is 12 or younger.

Currently, many web companies attempt to follow the children's privacy law by employing "age-gates" -- meaning the companies ask users to provide a birthdate, and then either ban those who say they're under 13, or direct them to sections of the site that don't collect data.

The FTC's move comes as some online companies have started deploying age verification technology.

But the use of age verification has alarmed civil liberties advocates, who say the technology threatens people's privacy, exposes them to security breaches, and impedes their ability to access speech anonymously. Age verification systems also aren't necessarily precise enough to determine exact ages, and can be circumvented -- in some cases, simply by using a fake photo.

Adam Schwartz, privacy litigation director at the digital rights group Electronic Frontier Foundation, sharply criticized the FTC's new policy.

"It will allow businesses to do more of what they want to do, which is vacuum up young people's information," he says. 

"We're living in an era of massive leaks and breaches of data," he adds. "It's a threat to privacy to force people to upload this information."

Santa Clara University law professor Eric Goldman adds that even though the new policy statement removes one barrier to age verification, businesses that deploy facial recognition technology face other legal risks.

For instance, the Illinois Biometric Information Privacy Act prohibits companies from collecting biometric identifiers without written consent, and allows individuals to sue for up to $5,000 in damages.