The Data Does Not Disappear When the Age Gate Works
The subject of this chapter is the data lifecycle inside an age-assurance system: what enters the process, what produces the age result, who can receive the information, and what happens afterward. The specific judgment it supports is easy to state but easy to miss in practice: a minimal output does not prove that the collection process was minimal. To evaluate the FTC’s age-verification policy responsibly, readers must follow the underlying input—not just the final yes-or-no answer—from capture through deletion.
An age gate is often described as if it handles one harmless fact: age. In operation, it may handle a photograph, a voice sample, a government-issued identifier, a persistent device signal, or a biometric template. The legal and practical questions attach to that flow at each stage. What the system asks for, what it sends elsewhere, what it keeps, and what it does with the result can all matter independently.
The age decision is an output; the input remains part of the analysis
Start with a simple distinction between evidence and conclusion. The evidence is the information submitted or observed to determine age. The conclusion is the age result the service wants to use—for example, that a visitor has or has not been identified as under 13. The conclusion may reveal less than the evidence. But reducing the conclusion does not automatically reduce the obligations that applied when the evidence was collected.
The amended COPPA Rule makes this distinction concrete through its definition of personal information. It expressly includes a photograph, video, or audio file containing a child’s image or voice. It includes government-issued identifiers such as a state identification, birth-certificate, or passport number. It includes persistent identifiers that can recognize a user over time and across different websites or online services. And it includes a biometric identifier that can be used for automated or semi-automated recognition of an individual.
The biometric category is intentionally described by capability, not only by a company’s stated purpose. The rule gives examples such as fingerprints, handprints, retina or iris patterns, genetic data, voiceprints, gait patterns, facial templates, and faceprints. The FTC explained that requiring actual use for identification could create room for operators to collect and retain sensitive information for future use and would make enforcement harder. At the same time, the final rule removed broader proposed language about all data derived from voice, gait, or facial data because that language could reach data that cannot currently identify or contact a specific individual.
That combination produces an important boundary. Not every age signal is automatically personal information in every design. The rule’s collection, online, child, operator, and identification conditions still matter. But a service cannot assume that an input is outside COPPA because it calls the input a “signal,” because the process returns only a binary result, or because the operator says the input was collected for safety. A child’s image can be covered as an image even before anyone argues about whether a derived facial template is biometric. A biometric template can be covered because it can support recognition, even if the operator says the immediate purpose was age assurance rather than identification.
Imagine a service that asks a visitor to submit a selfie, sends the image to an age-verification provider, receives a result, and intends to keep only the result. The result may be the smallest useful output. Yet the operator still has to analyze the selfie and the transfer.