On November 18, 2015, the Federal Trade Commission (FTC) approved Riyo Verified Limited’s (Riyo) application for approval under the Children’s Online Privacy Protection Rule (the Rule) of a proposed verifiable parental consent method that involves the use of facial recognition technology. Riyo’s proposed method, Face Match to Verified Photo Identification, requires that the parent take a picture of his or her photo identification, such as a driver’s license or passport, using a phone’s camera or a webcam. The authenticity and legitimacy of the photo identification are verified using computer vision technology, algorithms, and image forensics to ensure that the photo identification is authentic. Once the photo identification is authenticated, the parent takes a picture of his or her own face. The system ensures that the photo is of a live person and then uses facial recognition technology to compare the image of the parent’s face to the image on the photo identification. If the system determines that the photos are a match, they are reviewed by a live agent. Once the verification process has been completed, the parent’s identifying information is deleted.
In approving Riyo’s proposed verification method, the FTC noted that it is very similar to an existing verification method under the Rule which verifies a parent’s identity by checking a government-issued identification against a database. The FTC further stated that Riyo’s proposed verification method is more rigorous than the existing method because it uses facial recognition technology to ensure that the identification was issued to the person who is interacting with the system. The FTC also noted that, like the existing method, Riyo’s verification method requires the prompt deletion of the information submitted by the parent. The FTC concluded that the use of facial recognition technology to perform a one-to-one verification of the images submitted by the parent followed by review of the images by a trained professional is a sufficiently reliable method of verifying the parent’s identity to satisfy the Rule’s requirement for approval of a new parental verification method. The approval of Riyo’s application marks only the second time that the FTC has allowed a new verifiable parental consent mechanism since the Rule was amended in 2013 to allow the FTC to approve methods of obtaining verifiable parental consent that are not currently enumerated in the Rule.