The Federal Trade Commission (FTC) is taking a step toward potentially implementing a lasting policy measure by encouraging companies to use age verification technologies. The FTC plans not to enforce a children’s online privacy law against specific websites that collect and use minors’ personal information for age verification purposes.
Christopher Mufarrige, director of the Bureau of Consumer Protection, stated in a press release that age verification technologies are among the most child-protective technologies to appear in decades, enabling parents to protect their children online. The agency’s statement provides incentives for operators to adopt these tools.
Websites must meet certain criteria to avoid enforcement under the Children’s Online Privacy Protection Act (COPPA) Rule, which typically requires obtaining parental consent to collect data on children under 13. General or “mixed audience” sites can gather minors’ data without parental consent solely to verify age if they adhere to specific protocols: deleting the data after use, limiting data disclosure to third-party providers taking reasonable steps to maintain its confidentiality, providing a clear notice of data collection, employing reasonable security measures, and ensuring that age verification results are reasonably accurate.
While the statement is welcomed by proponents of age verification technologies, privacy advocates such as the Electronic Frontier Foundation (EFF) express skepticism, fearing the approach may not adequately protect children. They cite concerns about potential data breaches and leaks associated with age-checking systems. Discord’s disclosure last year of a breach exposing 70,000 users’ government IDs collected by a third-party vendor for age verification highlights this issue.
The FTC’s policy statement emphasizes the need for responsible implementation of age assurance, reducing data misuse and ensuring adequate data security, according to Suzanne Bernstein from the Electronic Privacy Information Center (EPIC).
The announcement reflects the agency’s discretion in enforcing the law and signals a move toward making these changes permanent. The FTC plans to review the underlying rule to address age verification further, with the policy statement remaining effective until either withdrawn or revised.