ESRB says proposed age verification scan is misunderstood: It doesn't 'confirm the identity of users' and is unrelated to videogame age ratings

Output of an Artificial Intelligence system from Google Vision, performing Facial Recognition on a photograph of a man, with facial features identified and facial bounding boxes present, San Ramon, California, November 22, 2019. (Photo by Smith Collection/Gado/Getty Images)
(Image credit: Smith Collection/Gado (Getty Images))

The ESRB recently filed a request with the FTC seeking approval for a "verifiable parental consent mechanism" called Privacy-Protective Facial Age Estimation, which will enable people to use selfies to prove that they are actually adults who can legally provide parental consent to their children. It struck me and many others as not a great idea—literally inviting Big Brother into your home and all that—but in a statement sent to PC Gamer, the ESRB said the system is not actually facial recognition at all, and is "highly privacy protective."

The filing, made jointly by the ESRB, digital identity company Yoti, and "youth digital media" company Superawesome, was made on June 2 but only came to light recently thanks to the FTC's request for public comment. It describes a system in which parents can opt to submit a photo of themselves through an "auto face capture module," which would then be analyzed to determine the age of the person in question. Assuming an adult is detected, they could then grant whatever permissions they feel are appropriate for their children.

It's basically a photo-verified age gate, then, not terribly different from showing your driver's license to the guy behind the counter before you buy booze—except that the guy behind the counter is a faceless machine, and you're not flashing government-issued ID, you're handing over a live image snapped within the confines of your own home. At a time when corporate interests around the world are racing to develop increasingly complex AI systems, while experts are warning us about the dangers inherent in that race, the idea of willingly submitting one's face for machine analysis understandably raised some hackles.

There were some misunderstandings, however, which the ESRB wants to correct. The system does not "take and store 'selfies' of users or attempt to confirm the identity of users," an ESRB rep said (which is a little confusing, since the FTC filing states plainly that "the user takes a photo of themselves (a selfie) assisted by an auto face capture module" which is then uploaded to a remote server for analysis), and it also would not scan the faces of children to determine if they're old enough to purchase or download a videogame. It would be used by adults, and has to do with a US privacy law, not the ESRB's age ratings for games. 

In the US, it's not actually illegal to sell M-rated games to minors: The age rating system developed and maintained by the ESRB represents a de facto policy for virtually all retailers, but legally there's nothing that says a 12-year-old can't buy Grand Theft Auto 5 if they want. In 2011, the US Supreme Court actually struck down a California law banning the sale of violent videogames to minors, declaring that videogames—like other forms of media—are protected speech under the First Amendment.

The Children's Online Privacy Protection Act (COPPA) is a different matter, however. It requires that companies gain "verifiable parental consent" before collecting or sharing any personal information from children under the age of 13, and it is legally required—in fact, Epic Games, the parent company of SuperAwesome, agreed to pay a $275 million penalty in December 2022 for violating it. Acceptable methods of COPPA consent include submitting a signed form or a credit card, talking to "trained personnel" via a toll-free number or video chat, or answering "a series of knowledge-based challenge questions." Those systems haven't been updated since 2015, according to the ESRB, and apparently an update is overdue.

But while the scanning system proposed in the application sounds like facial recognition, the ESRB took pains to emphasize that it does not determine identity beyond estimating age in order to establish that the requirements of COPPA compliance have been met.

"To be perfectly clear: Any images and data used for this process are never stored, used for AI training, used for marketing, or shared with anyone; the only piece of information that is communicated to the company requesting VPC is a 'Yes' or 'No' determination as to whether the person is over the age of 25," the ESRB rep said. "This is why we consider it to be a highly privacy protective solution for VPC."

(The proposed system sets 25 as the minimum threshold in order to "prevent teenagers or older-looking children from pretending to be a parent." Anyone determined to be in the "buffer zone" of 18-24 will have to pursue verification through other channels.)

Fair play to all involved, the proposed system doesn't function like a conventional facial rec system, but there's definitely an element of semantics to the ESRB's argument, too. The proposed system may not be used to recognize me, but it's using my photo to guess my age and I feel like that places the whole thing within a definition of "recognition" by any reasonable, non-technical measure. 

Concerns about biases, accuracy, and privacy remain valid—at the end of the day, you are granting a corporate entity permission to take a peek in your home just to be sure that everything is on the up-and-up—and just as a matter of principle, I can't shake the feeling that this commitment to the letter of privacy laws is pulling away from its spirit: We are protecting the privacy of children by allowing corporations to snap mugshots in our living room.

Interestingly, the ESRB said the FTC filing that brought all of this to light wasn't actually necessary at all: Because the ESRB Privacy Certified [EPC] program is a "COPPA Safe Harbor," it's authorized to make changes to verifiable parental consent systems without the FTC's involvement. "That said, EPC takes its role (and its responsibilities to member companies) very seriously and, considering how new the technology is, EPC preferred to obtain approval directly from the FTC through their application process before approving its use by EPC members," the ESRB rep said.

Andy Chalk
US News Lead

Andy has been gaming on PCs from the very beginning, starting as a youngster with text adventures and primitive action games on a cassette-based TRS80. From there he graduated to the glory days of Sierra Online adventures and Microprose sims, ran a local BBS, learned how to build PCs, and developed a longstanding love of RPGs, immersive sims, and shooters. He began writing videogame news in 2007 for The Escapist and somehow managed to avoid getting fired until 2014, when he joined the storied ranks of PC Gamer. He covers all aspects of the industry, from new game announcements and patch notes to legal disputes, Twitch beefs, esports, and Henry Cavill. Lots of Henry Cavill.

Read more
The jester from Balatro, portrayed in unsettling detail in real life, wears an uncanny smile and stares at the viewer.
PEGI digs its heels in over Balatro's 18+ rating, according to its disappointed dev: 'blaming EU laws, blaming storefronts, waiting for the future'
Genshin Impact 5.0 codes - Murata
FTC says Genshin Impact 'deceived children' and orders its publisher to pay a $20 million fine and stop selling loot boxes to kids
A woman and daughter upset at something on a phone
Valve is fixin' to start some arguments over the holidays because 'All adult members in a Steam Family' can see your Steam Replay page
A smudged joker face
Balatro finally escapes its silly 18+ age rating, PEGI promises 'a more granular set of classification criteria' for gambling-themed games in the future
Picture of a cat wearing yellow sunglasses and a purple cape of some sort
The weird cat game announced at The Game Awards is not made with AI, developers say, and has 'zero blockchain technology' or NFTs
Alisaie, a headstrong ally in Final Fantasy 14: Dawntrail, looks skeptically while standing in the middle of a beautiful blue forest.
Yoshi-P says FF14 team is 'discussing' options to fight mod that can be used for stalking, like 'legal action' and, uh, asking them to stop
Latest in Software
Closeup of the new Copilot key coming to Windows 11 PC keyboards
Microsoft co-authored paper suggests the regular use of gen-AI can leave users with a 'diminished skill for independent problem-solving' and at least one AI model seems to agree
Microsoft's Task Manager in Windows 11
After years of complaints about Windows Task Manager displaying CPU utilization incorrectly, a fix is finally on its way
Still image of Bastion holding a bird, taken from Microsoft's Copilot for Gaming reveal trailer
Microsoft unveils Copilot for Gaming, an AI-powered 'ultimate gaming sidekick' that will let you talk to your console so you don't have to talk to your friends
BURBANK, CALIFORNIA - AUGUST 15: Protestors attend the SAG-AFTRA Video Game Strike Picket on August 15, 2024 in Burbank, California. (Photo by Lila Seeley/Getty Images)
8 months into their strike, videogame voice actors say the industry's latest proposal is 'filled with alarming loopholes that will leave our members vulnerable to AI abuse'
live action Jimbo the Jester from Balatro holding a playing card and addressing the camera
LocalThunk forbids AI-generated art on the Balatro subreddit: 'I think it does real harm to artists of all kinds'
Promotional image of the HP Envy Inspire inkjet printer
Haunted printers turning on by themselves and printing nonsense has to be one of my favorite Windows 11 bugs ever
Latest in News
Man facing camera
The Day Before studio reportedly sues Russian website for calling infamous disaster-game a 'scam'
Will Poulter holding a CD ROM
'What are most games about? Killing': Black Mirror Season 7 includes a follow-up to 2018 interactive film Bandersnatch
Casper Van Dien in Starship Troopers
Sony, which is making a Helldivers 2 movie, is also making a new Starship Troopers movie, but it's not based on the Starship Troopers movie we already have
Assassin's Creed meets PUBG
Ubisoft is reportedly talking to Tencent about creating a new business entity to manage Assassin's Creed and other big games
Resident Evil Village - Lady Dimitrescu
'It really truly changed my life in every possible way': Lady Dimitrescu actor says her Resident Evil Village role was just as transformative for her as it was for roughly half the internet in 2021
Storm trooper hero
Another live service shooter is getting shut down, this time before it even launched on Steam