Real Safety AI Foundation / Research

Children, Schools, and Youth Policy

No Compliance, No Enforcement: What a State Attorney General Can Do About Ambient Biometric Devices While the Commission Will Not

Publisher: Real Safety AI Foundation

Working paper. Not peer reviewed.

Written
August 2026
Pages
24
Download PDFPlain language slides (PDF)Export BibTeXExport RIS

Abstract

On February 25, 2026, the Federal Trade Commission announced that it will not bring enforcement actions under the Children's Online Privacy Protection Rule against operators who collect personal information for the sole purpose of determining a user's age. The announcement has been read as a general retreat from children's privacy enforcement in the age of biometric sensing. That reading is wrong, and the error matters. The policy statement is narrow by its own terms. It reaches general audience and mixed audience services, it requires that the collection serve age determination and nothing else, it conditions relief on prompt deletion, and it withholds relief from any operator not otherwise in compliance. An ambient biometric device satisfies none of these conditions. It collects because collection is the product, it retains because retention is the product, and it collects from bystanders who are not its users at all. The Commission did not license ambient biometric collection. It built a lane that ambient devices cannot enter, and then declined to walk down the other one. This paper argues that the resulting gap is an enforcement gap rather than a legal one, and that it is a gap State attorneys general are already authorized to close. Section 6504 conditions State enforcement on a single obstacle, the pendency of a Commission action against the same defendant for the same regulation. Where the Commission has announced it will not act, that obstacle is absent by the Commission's own representation. Section 6502(d) preempts only inconsistent State law, and the Ninth Circuit, with the Commission's own agreement as amicus, has held that State causes of action which proscribe the same conduct COPPA proscribes are not inconsistent. The paper closes by taking the Commission's premise seriously: if the measuring instrument cannot separate a child of twelve from a child of fourteen, a rule that turns on that boundary cannot be administered, and the boundary should be moved to where measurement is not required, as the European, United Kingdom, and South African regimes already illustrate in different ways.

Keywords

  • COPPA
  • age verification
  • age assurance
  • ambient biometric sensing
  • smart glasses
  • bystander consent
  • enforcement discretion
  • State attorneys general
  • parens patriae
  • preemption
  • children's privacy
  • biometric identifiers

Plain language slides

First slide of the plain language summary of No Compliance, No Enforcement: What a State Attorney General Can Do About Ambient Biometric Devices While the Commission Will NotOpen the 25-slide summary (PDF)

Suggested citation

Gilly, Travis. "No Compliance, No Enforcement: What a State Attorney General Can Do About Ambient Biometric Devices While the Commission Will Not." Real Safety AI Foundation Working Paper, August 2026. https://realsafetyai.org/research/r6gczk/

Other versions

This paper is also posted on SSRN.

SSRN version

References (53)

  1. 720 Ill. Comp. Stat. 5/14-2.
  2. 740 Ill. Comp. Stat. 14/15.
  3. Alfred L. Snapp & Son, Inc. v. Puerto Rico ex rel. Barez, 458 U.S. 592 (1982).
  4. Anda, F., et al. (2018). Evaluating automated facial age estimation techniques for digital forensics. 2018 IEEE Security & Privacy Workshops, 129.
  5. Anda, F., et al. (2019). Improving borderline adulthood facial age estimation through ensemble learning. ARES ’19: Proceedings of the 14th International Conference on Availability, Reliability and Security.
  6. Balderas v. Google LLC, 489 F. Supp. 3d 1254 (D.N.M. 2020).
  7. Balderas v. Tiny Lab Prods., 457 F. Supp. 3d 1103 (D.N.M. 2020).
  8. Balderas v. Tiny Lab Prods., 516 F. Supp. 3d 1293 (D.N.M. 2021).
  9. Bates v. Dow Agrosciences LLC, 544 U.S. 431 (2005).
  10. Cal. Penal Code §632.
  11. Carter v. Welles-Bowen Realty, Inc., 736 F.3d 722 (6th Cir. 2013).
  12. Children’s Online Privacy Protection Act, 15 U.S.C. §§6501–6506.
  13. Children’s Online Privacy Protection Rule, 16 C.F.R. pt. 312.
  14. Children’s Online Privacy Protection Rule, Notice of Proposed Rulemaking, 64 Fed. Reg. 22,750 (Apr. 27, 1999).
  15. Children’s Online Privacy Protection Rule, Notice of Proposed Rulemaking, 89 Fed. Reg. 2034 (Jan. 11, 2024).
  16. Children’s Online Privacy Protection Rule, Statement of Basis and Purpose, 90 Fed. Reg. 16,918 (Apr. 22, 2025).
  17. Chowdhury, S., Ferdous, M. S., & Jose, J. M. (2016). Bystander privacy in lifelogging. Proceedings of the British HCI Conference.
  18. Chowdhury, S., Ferdous, M. S., & Jose, J. M. (2016). Lifelogging user study: Bystander privacy. Proceedings of the British HCI Conference.
  19. Congressional Research Service. (2025). Identifying Minors Online (R47884).
  20. Cooley LLP. (2026). FTC issues COPPA enforcement discretion policy to incentivize use of age verification technologies.
  21. Cothron v. White Castle Sys., Inc., 216 N.E.3d 918 (Ill. 2023).
  22. Data Protection Act 2018, c. 12 (UK).
  23. Davis Polk & Wardwell LLP. (2026). FTC prioritizes COPPA enforcement as new compliance obligations take effect.
  24. Electronic Frontier Foundation. (2026). Move fast, surveil things.
  25. Electronic Frontier Foundation. (2026). VICTORY: Meta strips facial recognition code from smart glasses app after public outcry.
  26. Explanatory Notes to the Data Protection Act 2018, c. 12 (UK).
  27. Federal Trade Commission. (2026). COPPA: Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology.
  28. Federal Trade Commission. (2026). FTC issues COPPA policy statement to incentivize the use of age verification technologies to protect children online [Press release].
  29. G.T. v. Samsung Elecs. Am., Inc., No. 25-1120 (7th Cir. Aug. 7, 2026).
  30. Greenberg Traurig LLP. (2026). FTC signals relaxed COPPA enforcement for age-verification technologies.
  31. Hazlitt v. Apple Inc., 543 F. Supp. 3d 643 (S.D. Ill. 2021).
  32. Hogan Lovells. (2026). FTC COPPA workshop and policy statement promote flexibility for use of age verification technologies.
  33. Hubbard v. Google LLC, 508 F. Supp. 3d 623 (N.D. Cal. 2020).
  34. Hubbard v. Google LLC, 546 F. Supp. 3d 986 (N.D. Cal. 2021), rev’d sub nom. Jones v. Google LLC, 73 F.4th 636 (9th Cir. 2023).
  35. Information Commissioner’s Office. (2020). Age Appropriate Design: A Code of Practice for Online Services.
  36. Information Commissioner’s Office. (n.d.). What are the rules about an ISS and consent?
  37. Jones v. Google LLC, 73 F.4th 636 (9th Cir. 2023).
  38. Keller & Heckman LLP. (2026). FTC issues COPPA enforcement policy statement promoting age-verification technology.
  39. Loper Bright Enters. v. Raimondo, 603 U.S. 369 (2024).
  40. Markey, E. J., et al. (2026). Letter to Mark Zuckerberg, Chairman and CEO, Meta.
  41. Mayer Brown LLP. (2026). FTC issues policy statement on age verification technologies under COPPA.
  42. Medtronic, Inc. v. Lohr, 518 U.S. 470 (1996).
  43. Ngan, M., et al. (2014). Face Recognition Vendor Test (FRVT): Performance of automated age estimation algorithms. National Institute of Standards and Technology.
  44. Norja, R., et al. (2021). How old was she? The accuracy of assessing the age of adolescents based on photos. Nordic Psychology.
  45. O’Hagan, J., Saeghe, P., Gugenheimer, J., et al. (2022). Privacy-enhancing technology and everyday augmented reality. Proceedings of the ACM on Interactive, Mobile, Wearable and Ubiquitous Technologies, 6(4), 1.
  46. Ogletree Deakins. (2026). FTC releases COPPA policy statement promoting age verification technology.
  47. Protection of Personal Information Act 4 of 2013 (S. Afr.).
  48. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation), 2016 O.J. (L 119) 1.
  49. Ren, S., et al. (2026). Out of the box age estimation through facial imagery: A comprehensive benchmark of vision-language models vs. out-of-the-box traditional architectures. arXiv.
  50. Stardust, Z., et al. (2024). Mandatory age verification for pornography access: Why it can’t and won’t “save the children”. Big Data & Society.
  51. Wigod v. Wells Fargo Bank, N.A., 673 F.3d 547 (7th Cir. 2012).
  52. Zellmer v. Facebook, Inc., No. 3:18-cv-01880-JD, 2022 WL 976981 (N.D. Cal. Mar. 31, 2022).
  53. Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024).

All research