Real Safety AI Foundation / Research

Privacy, Surveillance, and Consent

The Compliance Impossibility: Why Ambient Biometric Devices Cannot Comply with Amended COPPA

Publisher: Real Safety AI Foundation

Research paper.

Written
February 2026
Pages
18
Download PDFPlain language slides (PDF)Export BibTeXExport RIS

Abstract

The Federal Trade Commission’s 2025 amendments to the Children’s Online Privacy Protection Act (COPPA) Rule expanded the definition of personal information to include biometric identifiers such as facial templates, voiceprints, and gait patterns. Under COPPA, operators must obtain verifiable parental consent before collecting personal information from children under 13. This paper identifies a structural compliance impossibility affecting an entire class of consumer technology products: ambient biometric sensing devices. These devices, which include smart glasses with facial recognition, AI powered wearable recorders, smart home cameras with person identification, cashierless retail systems, and mixed reality headsets, must process biometric data from every person in their sensing environment to function. When children are present in that environment, the device must collect a child’s biometric data to determine whether the subject is a child, but that collection itself constitutes collection of children’s personal information requiring prior parental consent under amended COPPA. The device must break the law to determine whether it is breaking the law. This paper demonstrates that this paradox is not a product specific engineering problem but a category wide structural impossibility inherent to ambient biometric sensing. We survey ten product categories encompassing dozens of shipping and announced devices from companies including Meta, Amazon, Apple, Google, Samsung, and numerous startups, demonstrating that the impossibility applies universally. We further show that existing legal scholarship and regulatory guidance has not identified this cross product structural problem, treating bystander biometric collection as a product specific compliance challenge rather than a systemic regulatory paradox. With the COPPA compliance deadline of April 22, 2026, approaching, hundreds of billions of dollars in planned product launches face a legal obstacle that cannot be engineered around.

Keywords

  • COPPA
  • biometric identifiers
  • ambient sensing
  • facial recognition
  • children’s privacy
  • regulatory compliance
  • smart glasses
  • wearable AI
  • structural impossibility
  • consent paradox

Plain language slides

First slide of the plain language summary of The Compliance Impossibility: Why Ambient Biometric Devices Cannot Comply with Amended COPPAOpen the 23-slide summary (PDF)

Suggested citation

Gilly, Travis. "The Compliance Impossibility: Why Ambient Biometric Devices Cannot Comply with Amended COPPA." Real Safety AI Foundation Research Paper, February 2026. https://realsafetyai.org/research/compliance-impossibility/

Other versions

This paper is also posted on SSRN.

SSRN version

References (37)

This list was read from the PDF text. Where the two differ, the PDF is correct.

  1. Children’s Online Privacy Protection Act of 1998, 15 U.S.C. §§6501-6506.
  2. CNET. (2026, January 7). Why Plaud’s newest tiny AI gadget is my CES 2026 secret weapon. https://www.cnet.com/tech/services-and-software/plauds-newest-wearable-ai-notetaker-is-my-ces-2026-se
  3. Corbett, M., David-John, B., Shang, J., Hu, Y. C., & Ji, B. (2024). Securing bystander privacy in mixed reality while protecting the user experience. IEEE Security & Privacy, 22(1), 33–42. https://doi.org/10.1109/MSEC.2023.3331649
  4. Counterpoint Research. (2025, August 11). Global smart glasses shipments soared 110% YoY in H1 2025, with Meta capturing over 70% share. https://counterpointresearch.com/en/insights/post-insight-research-br
  5. Libin, N., & Dharia, A. (2025, May 5). FTC amends COPPA Rule to address changes in technology and online practices. Davis Wright Tremaine LLP. https://www.dwt.com/blogs/privacy--security-law-blog/2025/05/coppa-rule-ftc-amended-childrens-privacy
  6. Escobar-Planas, M., Gómez, E., & Martínez-Hinarejos, C.-D. (2022). Guidelines to develop trustworthy conversational agents for children. arXiv:2209.02403. https://arxiv.org/abs/2209.02403
  7. European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation), Arts. 4(14), 8, 9.
  8. Federal Trade Commission. (2023, May). Policy statement of the Federal Trade Commission on biometric information and Section 5 of the Federal Trade Commission Act. https://www.ftc.gov/legal-library/browse/policy-statement-federal-trade-commission-biometric-information-section-5-fed
  9. Federal Trade Commission. (2025, April 22). Children’s Online Privacy Protection Rule; Final Amendments, 90 Fed. Reg. 16,918. https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule
  10. Federal Trade Commission & Department of Justice. (2022, December 19). Fortnite video game maker Epic Games to pay more than half a billion dollars over FTC allegations of privacy violations and unwanted charges [Press release]. https://www.ftc.gov/news-events/news/press-releases/2022/12/fortnite-video-game-
  11. Federal Trade Commission & Department of Justice. (2023, May 31). FTC and DOJ charge Amazon with violating children’s privacy law by keeping kids’ Alexa voice recordings forever and undermining parents’ deletion re-quests [Press release]. https://www.ftc.gov/news-events/news/press-releases/2023/05/ftc-doj-charge-amazon-violating-childrens-privacy-law-keeping-kids-alexa-voice-re
  12. Federal Trade Commission & New York Attorney General. (2019, September 4). Google and YouTube will pay record $170 million for alleged violations of children’s privacy law [Press release]. https://www.ftc.gov/news-events/news/press-releases/2019/09/google-youtube-will-pay-record-170-million-a
  13. Dupree, L. P., & Saeedi, Z. (2025, July 25). The FTC’s updated COPPA Rule: Redefining children’s digital privacy protection. Finnegan, Henderson, Farabow, Garrett & Dunner, LLP. https://www.finnegan.com/en/insights/articles/the-ftcs-updated-coppa-rule-redefining-childrens-digital-privacy-p html
  14. Gilly, T. (2026a). The device that can’t legally exist in a room with children [Substack post]. Real Safety AI Foundation. https://open.substack.com/pub/travisgilly/p/the-device-that-cant-legally-exist
  15. Gilly, T. (2026b, February 16). The glasses that can’t legally look at your kids: Meta’s Name Tag and amended COPPA [Medium article]. Real Safety AI Foundation. https://medium.com/@tgil212121/the-glasses-that-cant-l
  16. Grand View Research. (2026). Smart glasses market size, share & trends analysis report (2026–2033). https://www.grandviewresearch.com/industry-analysis/smart-glasses-market-report
  17. Hanif, K. (2025, August 22). Meta’s new AI glasses could have a ‘super-sensing’ mode with facial recognition. AllAboutAI. https://www.allaboutai.com/ai-news/metas-new-ai-glasses-could-have-a-super-se
  18. Hicks, M. L. (2026, January 14). CES 2026 laid out a Black Mirror future of wearable AI that’s always listening, watching, ready to help, and ‘knows everything about you.’ I’m not enthusiastic. Android Central. https://www.androidcentral.com/wearables/ces-2026-laid-out-black-mirror-future-of-wearable-ai-th
  19. Hill, K., Huang, K., & Isaac, M. (2026, February 13). Meta plans to add facial recognition technology to its smart glasses. The New York Times. https://www.nytimes.com/2026/02/13/technology/meta-facial-recognition-smart-glasses.html
  20. Germano, C. (2026, January 26). Reminder: Amended COPPA Rule compliance date is approaching. BBB National Programs / Children’s Advertising Review Unit. https://bbbprograms.org/media/insights/blog/coppa-amended
  21. International Data Corporation (IDC). (2026, March 25). XR market expands 44.4% in 2025 as smart glasses take center stage. https://www.idc.com/promo/arvr/
  22. Bryan Cave Leighton Paisner LLP. (2026, January 16). U.S. biometric laws & pending legislation tracker – January 2026. JD Supra. https://www.jdsupra.com/legalnews/u-s-biometric-laws-pending-legislation-87039
  23. Koebler, J. (2025, December 22). Flock exposed its AI-powered cameras to the internet. We tracked ourselves. 404 Media. https://www.404media.co
  24. Loper Bright Enterprises v. Raimondo, 144 S. Ct. 2244 (2024) (overruling Chevron U.S.A., Inc. v. Natural Resources Defense Council, Inc., 467 U.S. 837 (1984)).
  25. MacRumors. (2026, February 13). Meta plans ‘Name Tag’ facial recognition for Ray-Ban smart glasses. https://www.macrumors.com/2026/02/13/meta-facial-recognition-smart-glasses/
  26. Shen, L., Thomson, A. C., & von Klein, M. P. (2025, April 28). FTC announces significant amendments to COPPA. Mayer Brown. https://www.mayerbrown.com/en/insights/publications/2025/04/ftc-announces-s
  27. Niemeyer, K. (2024, October 13). The Harvard students who added AI facial recognition to Meta glasses share some of their other big ideas. Business Insider. https://www.businessinsider.com/harvard-students-facial-rec
  28. Nguyen, A., & Ardayfio, C. (2025, January 29). I-XRAY: The AI glasses that reveal anyone’s personal details [Event with Prof. Jonathan Zittrain]. Harvard Library Innovation Lab. https://lil.law.harvard.edu/events/i-xray-lunch/
  29. Perez, A. J., Zeadally, S., Matos Garcia, L. Y., Mouloud, J. A., & Griffith, S. (2018). FacePET: Enhancing bystanders’ facial privacy with smart wearables/Internet of Things. Electronics, 7(12), 379. https://doi.org/10.3390/electronics7120379
  30. Quandary Peak Research. (2024, June). Expanding protections: Tracking new biometric privacy laws across the U.S. https://quandarypeak.com/2024/06/expanding-protections-tracking-new-biometric-privac
  31. Harary, M. (2024, November 27). Amazon’s “Just Walk Out” tech faces BIPA lawsuit. Darrow AI. https://www.darrow.ai/resources/amazon-bipa-lawsuit
  32. Shahmansoori, A., & Roedig, U. (2022). Dynamic recognition of speakers for consent management by contrastive embedding replay. arXiv:2205.08459. https://arxiv.org/abs/2205.08459
  33. State of Illinois. (2008). Biometric Information Privacy Act, 740 ILCS 14.
  34. State and federal age-knowledge statutes. See, e.g., Fla. Stat. Ann. §501.1736 (treating willful disregard of age as actual knowledge); Conn. Gen. Stat. §42-515 et seq. (combining actual and constructive knowledge standards); Children and Teens’ Online Privacy Protection Act (COPPA 2.0), S. 1628, 118th Cong. (proposing constructive knowledge standard for large platforms).
  35. Takhshid, Z. (2024). Wearable AI, bystander notice, and the question of privacy frictions. Boston University Law Review, 104 (forthcoming). https://ssrn.com/abstract=4693396
  36. Davis, D.-M. (2025, May 23). Apple could launch AI-powered smart glasses in 2026. TechCrunch. https://techcrunch.com/2025/05/23/apple-could-launch-ai-powered-smart-glasses-in-2026/
  37. U.K. Information Commissioner’s Office. (2020). Age Appropriate Design Code (Children’s Code). https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/age-appropriate-design-a-code-of-practice-for-

All research