Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC approves new COPPA verifiable parental consent method, (Dec 23, 2013)

By John W. Arden, J.D., LL.M.

The FTC has approved a new method for companies to obtain parents’ consent for their children to access online services covered by the Children’s Online Privacy Protection Act, the agency has announced.

In a letter dated today, the FTC informed Imperium, LLC that its knowledge-based authentication method, proposed on August 13, 2013, was acceptable for obtaining verifiable parental consent, as long as the specific process uses dynamic, multiple-choice questions with enough options to ensure that the chances of a child guessing the correct answer is low and the questions are of sufficient difficulty.

Knowledge-based authentication (KBA) is a way to verify the identity of a user by asking a series of challenge questions, typically that rely on so-called “out-of-wallet” information; that is, information that cannot be determined by looking at an individual’s wallet and are difficult for someone other than the individual to answer. This authentication method has been used by financial institutions and credit bureaus for a number of years, and has been acknowledged by the Commission and other government agencies as effective for that purpose.

Imperium submitted its proposal on August 13, 2013. The Commission published the application in the Federal Register on September 12, 2013 and sought public comments through November 4, 2013. The Commission received five comments. Two commenters—AssertID and the Center for Digital Democracy—objected to the approval of the application. One commenter—PRIVO, an approved COPPA Safe Harbor company—supported approval of KBA to authenticate users. Two individual commenters expressed concern for children’s privacy, but did not specifically address Imperium’s application.

Government agencies such as the Federal Financial Institutions Examination Council and the Commission itself have recognized the efficacy of KBA using appropriate challenge questions, the letter noted.

Companies: Imperium, LLC

News: Privacy ConsumerProtection FederalTradeCommissionNews