The ESRB Wants to Scan Gamers’ Faces to Verify Their Ages

The Entertainment Software Rating Board (ESRB) is seeking approval from the FTC to implement facial age estimation technology to stop kids skirting parental controls. If the industry’s self-regulating body gets its way, kids and their parents may need to get used to taking selfies to sign up for games.

In a recent application submitted by the ESRB, digital identity firm Yoti, and youth digital media company SuperAwesome, the three organizations jointly asked the FTC for approval to implement what it’s calling “Privacy-Protective Facial Age Estimation.” The proposed system would use facial age-matching technology similar to facial recognition that estimates the age of a person based on patterns in their face. If approved, the system wouldn’t replace other verification methods entirely but would rather serve as “an additional, optional verification method.”

The ESRB emphasized its commitment to privacy with the tool in a statement sent to Gizmodo. An ESRB spokesperson said the tool would not store face images after they are scanned and that the scanner cannot be used to confirm the identity of users. The ESRB does not intend to use facial age estimation to prevent children from purchasing restrictively rated games, the spokesperson added.

“First and foremost, this application is not to authorize the use of this technology with children. Full stop,” the ESRB spokesperson said. “Any images and data used for this process are never stored, used for AI training, used for marketing, or shared with anyone.”

If not for rated M games, what would the age verification be used for?

The ESRB spokesperson said, “If a player or user is looking to sign up for a new service and they are under the age of 13, they will be prompted to provide their parent’s email address to obtain.” The parent will then receive an email and have the option to give consent for the child to create the account. 

Users engaging with the facial verification system would be asked to submit a selfie which is then transformed into a set of numbers and compared against Yoti’s database of face measurements. Users then receive a yes/no result based on the system’s determination of their age. The proposed tools only let users submit live photos as a way to safeguard against kids who may try to weasel around the age gate by submitting a still photo of their parents. Photos that don’t meet the system’s “required level of quality” also aren’t accepted. The verification process, the application estimates, takes just about one second, on average, to complete.

The ESRB spokesperson says it recommended an age threshold of 25 be set “to prevent teenagers or older-looking children from pretending to be a parent.”

The application, which was first submitted in June and now open to public FTC comments, makes a point to try and distinguish the technology used here from the more well-known, and controversial, facial recognition. In this case, the system only compares the measurements of faces associated with determining age. That’s different, they claim, than other broad applications of facial recognition that can be used to identify a specific person in a photo with multiple faces. Yoti claims “establishing the identity of an individual” isn’t’ required for its particular system to work. SuperAwesome and the FTC did not immediately respond to Gizmodo’s requests for comment.

ESRB will need to convince skeptical privacy critics

Privacy and human rights have spoken critically about facial recognition technology and systems similar to it over its inability to accurately identify women and people of color at the same rates as white users. At the most extreme level, underlying issues of accuracy have already contributed to the wrongful arrest of multiple Black men in the United States. The ESRB and its partners try to address these concerns head-on in the application. Yoti and SuperAwessome claim their facial age estimation system has accurately identified users as adults 99.97% of the time in previous cases and claims the difference in rejection rates between gender and skin tone is “very small.”

All of this, the groups argue, serves a real need. Around 35% of the users in the UK and EU who have tried submitting face scans to the system in the past have been rejected, meaning it’s not uncommon for kids to try, and fail, to skirt past the system. And while face scans inherently feel more invasive and, dare we say, creepier than alternatives, the ESRB and its partners argue it’s actually more secure than other methods of identity verification like credit card numbers, driver’s licenses, or social security numbers which can potentially be misused by bad actors to commit identity fraud.

Yoti Chief Policy and Regulatory Officer Julie Dawson told Gizmodo she believes facial age estimation is a privacy-preserving and accurate tool that’s easier for parents to use than other verification alternatives. Where available outside the US, Dawson said 70% of parents use the tool over other methods.

“Facial age estimation can confirm that a person is an adult without requiring the user to submit additional personal information,” Dawson said. “The technology produces only a yes/no result on whether the individual meets the required age threshold. Facial age estimation is a privacy-preserving and inclusive method, which does not require users to share any personal information or identity documents.”

Surveillance Technology Oversight Project Executive Director Albert Fox Cahn, who has helped author multiple reports detailing surveillance practices in the gaming industry, was less convinced by privacy assurances from Yoti and the ESRB. Fox Cahn fears an “error-prone” system like the ones proposed by the ESRB could expand beyond gaming and pose privacy risks for the wider swaths of the internet.

“As gaming platforms increasingly converge with other internet services, these sorts of practices pose a potent threat to the promise of an open internet,” Fox Chan told Gizmodo. “And the fact that ESRB is exploring an invasive, biased, and error-prone technology like facial recognition for this purpose is even more concerning.”

Age verification is gaining ground outside of gaming

Facial age verification has been in place in China since 2021 when Tencent announced it would scan the ages of gamers in order to comply with a 2019 law preventing them from playing games between 10:00 p.m. and 8:00 a.m. Tenent’s system, dubiously called “Midnight Patrol” goes a step further than the ESRB’s proposed tool by scanning users’ faces while they are actively playing and locking them out if they’ve played past the mandated curfew time.

But Chinese authorities aren’t the only officials interested in mandating age verification. Around a dozen US states have either passed or are considering sweeping new legislation requiring parental consent for minors to access games and other online services. Others, like Louisiana and Missouri, have introduced legislation mandating age verification to access pornographic sites. The common thread here is an increasing goverment interest in widely deployed age verification tools. Facial recognition and facial age estimation tools like those proposed by the ESRB may become even more attractive solutions, but they are almost guaranteed to face a wall or resistance from a privacy community still highly skeptical of the tools’ efficacy.

“This is yet another example of video game surveillance harming the very children it’s supposed to help,” Fox Cahn added.

Services Marketplace – Listings, Bookings & Reviews

Entertainment blogs & Forums