FTC’s Greenlight of Age Verification Tech Sparks Vendor Scrutiny

Online service providers are racing to find the best age verification service providers after the FTC gave the technology its stamp of approval this week.

The FTC provided a huge boon to online platforms and the age verification technologies vying for their business when it announced their exemption from kids’ privacy enforcement. The policy statement on Wednesday is a significant endorsement from the agency which just two years ago declined to weigh in on the technology citing its nascent stage.

The policy, which comes with tight guardrails on how collected data should be used and retained, solves a major issue for companies worried that adopting age verification technologies could put them at odds with the Children’s Online Privacy Protection Act. The federal law requires companies get verifiable parental consent before collecting the data of kids under 13 years old.

“This policy statement from the FTC is like they’ve rolled out the red carpet for age verification providers,” said Dona Fraser, senior vice president of privacy initiatives at BBB National Programs.

The agency doesn’t, however, answer another big question for companies: which providers the FTC and other regulators will consider compliant with the new safe harbor.

“That’s the new fight—whether the technology you implemented was reasonable or not,” said Amy Lawrence, chief privacy officer and head of legal at marketing technology company SuperAwesome. “I do think companies want to hear from the FTC or regulators on what is reviewed and approved.”

The memo requires that companies take steps to make sure the technologies they use are “reasonably” secure and accurate. These guarantees should have written assurances, said the FTC. Liability for violating COPPA falls on both companies and their service providers.

”The details of how precisely operators are to implement these protections are left open to interpretation, and leave companies potentially vulnerable to risk,” Jessica Lipson, partner at Morrison Cohen wrote in an email.

Companies are unlikely to get a gold star list of approved vendors, however.

“The FTC has never picked winners or losers when it comes to any sort of service providers,” said Stacy Feuer, senior vice president of privacy certified at the Entertainment Software Rating Board. “What they’ve always done is set out clear standards for what companies should expect of their service providers.”

The open-ended nature of the requirements could also spur industry innovation and competition.

“I suspect that the FTC’s use of the word reasonable is to allow companies some flexibility and not really tie their hands on exactly what this needs to look like, especially understanding that technology is evolving in the space,” said Fraser. “They want to encourage companies to come up with some really innovative solutions.”

Companies can look for further guidance from changes to the COPPA rule, set to be enforced April 26, she said. The updates set standards around security, defining a mixed-audience platform and collecting only personal data that is necessary, known as data minimization.

“Every company is going to have to figure out which is the best provider for me?” said Fraser. “Obviously, cost is a huge issue, but how does it fit? Do they have the same risk tolerance that you have?”

Companies can also look to other standards bodies that have tested age assurance providers, including National Institute of Standards and Technology and the Australian government, Feuer suggested.

In the interim, companies will have to adapt by experimenting. For example, Discord pulled back its global age verification rollout this week after consumer pushback, Lawrence noted.

“I think what Discord is doing, you’ll see a lot of more companies are doing,” she said. “It’s a little bit of trial and error.”