Antitrust Law Daily Wrap Up, PRIVACY NEWS: FTC declines to approve COPPA parental consent method, (Nov 14, 2013)

By Tobias J. Gillett, J.D., LL.M.

The FTC has denied AssertID, Inc.’s application for approval of its verifiable parental consent method under the agency’s Children’s Online Privacy Protection (COPPA) Rule, the Commission announced yesterday. The Commission’s November 12 letter to AssertID states that it would be “premature” to grant approval given the lack of evidence to demonstrate that it would be a sufficiently reliable method of verifying that an individual was a parent authorized to consent to the collection of a child’s personal information.

AssertID describes itself as a private for-profit corporation specializing in the development of proprietary privacy and identity verification technologies, products, and services that leverage advances in the science of Social Network Analysis. AssertID intended to use its core identity-verification technology to offer a new web service (“ConsentID”) that would “remove significant impediments to COPPA compliance faced by operators while at the same time empowering parents with the tools and information they need to manage their children’s online privacy,” according to its application.

AssertID’s core identity-verification service would allow participating parents to create a digital identity credential (an “AssertID”), which would contain the parent’s self-asserted identity attributes as provided by the parent. Once created, the parent’s AssertID would become available for verification by a select group of the parent’s social network “friends.” ConsentID was intended to ensure that the individual granting parental consent is in fact the parent of the child, as the COPPA rule requires.

AssertID submitted its application on July 1, 2013, and the Commission published it for comments in the Federal Register on August 21, 2013. The comment period closed on September 20, 2013.

The Commission concluded that AssertID did not provide sufficient evidence to show that its proposed parental consent method was “reasonably calculated, in light of available technology, to ensure that the person providing consent is the child’s parent,” as required by the Rule. AssertID had provided articles discussing “the general topic of the influence of social network on trust among their members,” but none of those articles “support[ed] a claim that AssertID’s social-graph verification is an effective method of verification,” in the Commission’s view. The agency noted that most of the articles predated the public availability of the social network AssertID intended to use, and that none of the articles established that AssertID’s “trust score,” based on a particular minimum number of verifiers, was adequate to verify an individual’s identity.

Moreover, AssertID’s beta testing of its service did not “demonstrate that social-graph verification will work in a live environment or that the method is reasonably calculated to ensure the person providing consent is the child’s parent.” The Commission noted comments that had expressed concern about the ease of fabricating social network profile and the fact that many children under age 13 had falsified their age information to create social media accounts.

“In short, identity verification via social-graph is an emerging technology and further research, development, and implementation is necessary to demonstrate that it is sufficiently reliable to verify that individuals are parents authorized to consent to the collection of children’s personal information,” the agency concluded.

The letter observed that AssertID had included information about other aspects of its ConsentID service that were not integral to its proposed parental consent method, and therefore the Commission declined to “opine as to whether these services satisfy the requirements of the Rule.”

On November 4, the agency concluded public comment periods on COPPA Rule parental consent methods filed with the agency by Imperium, LLC and Samet Privacy, LLC. The agency has yet to approve or deny those applications.

Companies: AssertID, Inc.; Imperium, LLC; Samet Privacy, LLC

News: Privacy ConsumerProtection FederalTradeCommissionNews