Facial Recognition Data of Minors

Question

I have a cool app a couple of high school librarians use. It's pretty simple: students scan their IDs when they enter and leave the library. Librarians then can then see who's in the library at any given time via simple dashboard. Student usage is then stored and is downloadable by the librarians should they want a report.

I'm interested in adding a facial recognition feature to my app because I'm interested in machine learning. The idea is to replace card scanning with just looking at a camera. To do this, I'd have to train a model with the faces of the students. I was thinking of creating a webapp that allowed students to submit photos of themselves should if they're interested in the feature - otherwise they can keep card scanning if they want.

Considering that they're all under 18, do I need parental approval if the students want to submit their own photos? Who else should I contact to get approval for such a feature?

Other potentially relevant details:

Currently the app tracks ~200 unique students per day, but has ~5000 students in it. I own the physical server that the webapp and proposed facial recognition feature would go on. I also have librarian approval for this feature. The high schools that use this app are in Washington state.

Answer 1

If you were doing this independent of the schools, you don't need parental permission as long as you're complying with COPPA rules, the most important part being whether the site is directed to children under age 13. If you are asking for the sanction of the school, you need to comply with the school's policy. The Washington law regarding student privacy are here. You would need to comply with the law regarding securing and disseminating such personal information – I assume that you do that. RCW 28A.604.030 addresses consent: you may do this "with the consent of the student or the student's parent or guardian".

The school would also have to approve of your idea in order for it to be practically implementable – you can't force them to use your program. You would need to persuade them that they are not at legal risk in adopting your system, and also that the system distinguishes identical twins Dana and Donna.