US government denies ESRB's AI-powered face-scanning 'age estimation' proposal, but it's probably not gone for good

In 2023, the Entertainment Software Rating Board, along with digital identity company Yoti and "youth marketing solutions" provider Superawesome, filed a proposal with the FTC for a new "verifiable parental consent mechanism" called Privacy-Protective Facial Age Estimation. The FTC has now issued its response to that proposal, and the answer is "no"—for now.

The ESRB's proposed technology stirred feathers almost immediately, and understandably so: The idea of having to essentially submit a selfie to prove to a machine that you're old enough to play GTA 6 is inherently intrusive, and that's before you even get into questions of technological bias and whether or not the thing would work well enough to justify the headaches that would inevitably erupt for at least some users.

The ESRB moved quickly to reassure the public that the system is not meant to identify individuals but simply to estimate age, and that it would not store any data after the analysis was complete. It was also not intended to ensure compliance with the ESRB's age ratings, but rather with COPPA—the Children's Online Privacy Protection Act—a US privacy law that requires "verifiable parental consent" before companies are allowed to collect or share data from children under the age of 13.

Unlike the ESRB rating system, which is voluntary, COPPA is legally binding, and breaking that law can be awfully expensive. In 2022, for instance, Epic Games agreed to pay a $275 million penalty for COPPA violations, while in 2023 Microsoft ate a $20 million fine for violations of its own on Xbox Live. So you can understand why companies might be eager to find a low-effort system that enables them to at least say, "Hey, we tried."

But for now, the ESRB's proposed solution isn't going to be it. In a ruling issued on March 29, the FTC said that after receiving more than 350 comments on the proposal, it voted unanimously to deny the application. The denial was issued without prejudice, meaning the ESRB and its associates can resubmit the application in the future.

That reflects the reason for the denial, which came not because the FTC has concerns about millions of people submitting selfies to an AI-powered machine dedicated to government oversight, but because it's not clear how (or, I suppose, if) it will work. 

In a letter sent to the ESRB group, the FTC noted that Yoti had submitted a "facial age estimation model" to the National Institute of Standards and Technology in September 2023, but the NIST's evaluation has not yet been delivered. On March 22 the ESRB asked for a 90-day delay of any ruling on the matter to allow for the NIST's report to be delivered, but because there's no indication the report will show up within that time frame, the FTC has simply decided to toss the whole thing.

Frankly I think the world would be a better place if this whole idea went away completely, but that seems unlikely. In its denial, the FTC said it "is taking no position on the merits of the application," and effectively encouraged a re-submission once the NIST report is finished, "when the Commission anticipates that additional information will be available to assist the Commission and the public in better understanding age verification technologies and the application."

In a statement provided to PC Gamer, an ESRB representative said it was "disappointed" that the FTC didn't issue a "substantive decision" or allow for a further delay in the application.

"The ESRB, Yoti, and Kids Web Services [formerly part of Superawesome, now owned by Epic Games following the Superawesome spinoff in September 2023] filed the application in June 2023, and the Commission twice extended its decision on the application beyond the 120-day period set forth in the COPPA Rule," the rep said. "The Commission’s letter indicates that it believes it would be helpful to be able to review, as part of its decision-making process, a report about facial age estimation models that is anticipated to be released by the National Institute of Standards and Technology (NIST) in April.

"Unfortunately, instead of accommodating our request to stay its decision for another 90 days to give the Commission sufficient time for consideration of the NIST report, the FTC declined the application without prejudice. In light of the FTC’s statements in its recent COPPA Notice of Proposed Rulemaking (and elsewhere) welcoming innovation in VPC methods, we remain hopeful that facial age estimation and other innovative technologies will be considered COPPA-compliant when used to obtain verifiable parental consent in the near future."