ESRB says proposed age verification scan is misunderstood: It doesn't 'confirm the identity of users' and is unrelated to videogame age ratings

25.07.2023 - 21:01 / pcgamer.com

The ESRB recently filed a request with the FTC seeking approval for a "verifiable parental consent mechanism" called Privacy-Protective Facial Age Estimation, which will enable people to use selfies to prove that they are actually adults who can legally provide parental consent to their children. It struck me and many others as not a great idea—literally inviting Big Brother into your home and all that—but in a statement sent to PC Gamer, the ESRB said the system is not actually facial recognition at all, and is «highly privacy protective.»

The filing, made jointly by the ESRB, digital identity company Yoti, and «youth digital media» company Superawesome, was made on June 2 but only came to light recently thanks to the FTC's request for public comment. It describes a system in which parents can opt to submit a photo of themselves through an «auto face capture module,» which would then be analyzed to determine the age of the person in question. Assuming an adult is detected, they could then grant whatever permissions they feel are appropriate for their children.

It's basically a photo-verified age gate, then, not terribly different from showing your driver's license to the guy behind the counter before you buy booze—except that the guy behind the counter is a faceless machine, and you're not flashing government-issued ID, you're handing over a live image snapped within the confines of your own home. At a time when corporate interests around the world are racing to develop increasingly complex AI systems, while experts are warning us about the dangers inherent in that race, the idea of willingly submitting one's face for machine analysis understandably raised some hackles.

There were some misunderstandings, however, which the ESRB wants to correct. The system does not «take and store 'selfies' of users or attempt to confirm the identity of users,» an ESRB rep said (which is a little confusing, since the FTC filing states plainly that «the user takes a photo of themselves (a selfie) assisted by an auto face capture module» which is then uploaded to a remote server for analysis), and it also would not scan the faces of children to determine if they're old enough to purchase or download a videogame. It would be used by adults, and has to do with a US privacy law, not the ESRB's age ratings for games. 

In the US, it's not actually illegal to sell M-rated games to minors: The age rating system developed and maintained by the ESRB represents a de facto policy for virtually all retailers, but legally there's nothing that says a 12-year-old can't buy Grand Theft Auto 5 if they want. In 2011, the US Supreme Court actually struck down a California law banning the sale of violent videogames to minors, declaring