Position: Age Estimation Models Do Not Process Biometric Data
This work clarifies a regulatory ambiguity for ML researchers and policymakers, determining that age estimation models do not constitute biometric data processing under laws like GDPR, BIPA, and the EU AI Act.
The paper investigates whether age estimation models process biometric data by checking if identity-discriminative representations emerge during inference. Across 14 models on 3 face verification benchmarks, age estimators perform orders of magnitude worse than identification thresholds, showing they cannot identify individuals.
When a neural network estimates someone's age from a photograph, does it process biometric data? The answer depends on whether identity-discriminative representations arise within the network during inference, a question that may seem trivial to ML researchers but triggers consent requirements under GDPR, statutory damages under BIPA, or high-risk AI classification under the EU AI Act. Yet no regulatory guidance addresses it. This position paper provides empirical evidence: 14 models evaluated across 3 face verification benchmarks show age estimators fall orders of magnitude short of identification thresholds. Age estimation models cannot identify individuals. We call on researchers to provide transparency about what systems store and can do, and on regulators to distinguish transient processing from template storage.