WA Senate LC - Committee Meeting
(September 26, 2023)

Here are some observations from the Tuesday September 26th Washington State Senate Labor and Commerce Committee (WA Senate LC) Committee Meeting.

My top 3 takeaways:

• Use of physical or behavioral factors to determine identity in order to access age-restricted products or services is known as ‘biometric age verification,’ and had gained increasing attention in 2023 leading to lawmaker interest in the approach.
  • The use of retinal or palmprint scanning to verify identity wasn’t new, but state officials had been increasingly interested in leveraging this biometric data along with artificial intelligence in order to age-gate sales of alcohol - and potentially cannabis. 
  • News and editorial articles on the subject published in 2023 include:
    • AI Could Make Age Verification More Accurate and Less Invasive (Information Technology and Innovation Foundation)
    • Protecting Minors Online Through Biometric Age Verification (Forbes)
    • Online age verification is coming, and privacy is on the chopping block (The Verge)
    • Buying booze? Your face — or palm — could verify your age (Axios)
    • How to Get Age Verification Right (Institute for Family Studies)
  • On May 18th, the US Federal Trade Commission released a warning statement that biometric age verification systems “including those powered by machine learning, raises[d] significant consumer privacy and data security concerns and the potential for bias and discrimination.”
  • On June 27th, legislators heard from a panel on “Artificial Intelligence and the Future of the Workforce.” 
  • WSLCB leaders rejected a petition around using biometric data for alcohol sales following a presentation and discussion on July 5th.

• Washington State Liquor and Cannabis Board (WSLCB) leadership briefed on what officials at the agency knew about biometric age verification, and what would be needed in order to use the technology more widely for age-restricted products.
  • Director of Legislative Relations Marc Webster said he was there to “discuss biometric age verification. What is it? What's it for? What's allowed? And what are the risks?” He said staff were finding it to be a “very popular topic,” and that the “more you look into it, I think, the more policy implications it has in areas that go far beyond just buying a beer” (audio - 4m, Video - TVW, presentation).
    • “Biometric age verification is a tool that uses some biometric data or a scan” depending on the vendor, that’s used “to find an already known identification and that links that identification with the user’s…uploaded State issued ID,” Webster told committee members. For the time being, he said systems like these were “opt-in, we are not talking about a broad-based facial recognition out on the street somewhere,” but instead when someone could choose to “upload your ID, and usually a picture” for vendors to “verify that the person standing in front of them is the same person who created the account, and is on the ID.”
    • Biometric information was “typically validated by some sort of algorithm,” Webster stated, and could be “stored by a third party, often with limited data stored by the vendor.” The adopters of the technology so far “have often been sports stadia where they're seen as a way to kind of improve the flow of customers buying alcohol at a game,” he noted. Instead of people finding and showing valid identification to event staff, “the thought is you could…essentially increase the number of customers per hour…and it's also a way to reduce the mental math at the point of sale” by having a system tell a clerk “either ‘yes, this person is over 21,’ or ‘no, they're not.’”
    • Webster's first example was Coors Field in Denver, where the Amazon One palm recognition technology was being used for alcohol sales. He indicated that this combined face scanning from a company called Wicket, whose platform had been used in otherbaseball stadiums. Webster described how one reason “Colorado use[d] it at Coors Field [was] because Colorado ha[d] state issued electronic ID that is recognized by state agencies including the Colorado State Patrol.” It wasn’t available to all local law enforcement, but “you can have your ID on an app on your iPhone or Android device.”
      • The Amazon One palm recognition service launched in 2020, but the expansion to alcohol sales was announced by the company on May 22nd. While promoting the service, Amazon policies had also raised privacy concerns in several class-action lawsuits related to unauthorized use of facial data or recognition technology from people playing a popular video game, working in one of the company’s facilities, or visiting Amazon Go convenience stores, though none of those cases involved usage of the Amazon One palm recognition system mentioned by Webster.
    • Bringing up passage of HB 1155, the “My Health, My Data Act” earlier that year, Webster suggested the law was “much more about identifiable biometric information around health data, but it does set up standards for how companies use, store, and share biometric data, and the definition in that bill would include face scans and palm scans.”
    • Webster felt that biometric age verification would have several implications beyond WSLCB, and encouraged lawmakers to “broaden” conversations on the subject to include representatives from the Washington State Department of Licensing (WA DOL) and Washington Technology Solutions (WaTech). He acknowledged that staff from Amazon and the Seattle Seahawks as well as WA Senate committees had approached them about the topic, “so let's invite all of those groups, too.”
  • Director of Policy and External Affairs Justin Nordhorn started off talking about where biometric age verification would intersect with current laws, “and the challenges” (audio - 7m, Video - TVW).
    • He described leadership at WSLCB as “pretty neutral on the concept of biometrics,” but he wanted to point out some obstacles and “risk issues.” Nordhorn seconded Webster’s remark on the need to involve WA DOL officials, but recognized that some stakeholders were “asking ‘hey, can we use this as an acceptable form of ID?’ and our answer has been ‘no, not really because that's not a government issued ID.’ However, there's nothing in statute or rule that prevents anybody from utilizing biometrics as a tool right now so they can use it already.” WSLCB staff didn’t need to create rules for private companies to use biometrics, he commented, but some businesses were “sharing with companies who are providing this service” that they wanted “rules developed so they can have a little bit more assurance on their risk mitigation” in the event “a minor were to get access to alcohol.”
    • Nordhorn identified applicable statutes for checking identification and ‘certification’ cards for the purposes of alcohol sales. He said that certification cards “where people can look at the ID, they're not sure if the person's 21 or not. They believe they are, they can fill out this card and it gives them immunity, and those are rarely used anymore.”
      • RCW 66.20.170 - Card of identification may be accepted as identification card and evidence of legal age.
      • RCW 66.20.180 - Card of identification to be presented on request of licensee.
      • RCW 66.20.190 - Identification cardholder may be required to sign certification card—Contents—Procedure—Statement.
      • RCW 66.20.200 - Unlawful acts relating to identification or certification card—Penalties.
    • Biometric age verification could be used by licensees now, similar to use of ID scanners, but as far as "acceptable forms of ID" for WSLCB, Nordhorn remarked they generally were required to include a name, date of birth, signature, and expiration date, and were inclusive of “all government issued IDs.” Identification verification by a private company raised some concerns for Nordhorn: “what is the oversight and how can we have confidence that that software is going to be utilized in such a way that it would provide that consistent mitigation?”
    • “I think there's some really good companies out there, but then…when we open this up…there's questions about what, what it would look like coming in,” Nordhorn argued. He said some existing laws requiring people to fill out information or display state-issued identification would need to be considered, citing laws and circumstances for restricted substance sales where, “if somebody's asked for their ID, they have to produce it.” Nordhorn added that a temporary existing policy on alcohol delivery had “mandatory identification and the signature component with that where they would be matching that up in statute.”
    • Nordhorn laid out several questions and considerations raised by their review:
      • “Accuracy on that technology is, is of concern. How can we know that it's right?”
      • “If a business owner is investing in that type of technology and they want that protection - how can they be assured that this is [a] good use of technology for them?”
      • “When you think about the facial recognition, it's not necessarily equitable across the board.”
      • “When we're looking at the oversight of that technology…is there any audit functions? Is there a reporting mechanism?”
      • When “having all of your personally identifying information provided to somebody, what is…the security around that? Does the State have access to that, or not?”
    • “When we were talking to one of the companies, they indicated that their particular software basically will have people move through 90% of the time,” said Nordhorn. One in ten people using that platform would need to display valid ID anyway, “and that kind of brings up the…issue around the convenience factor” where “people leave credit cards at home now because they have their phones.” Creating an expectation that people didn’t need to carry physical identification cards meant “you may not bring it with you; and then when you're asked for it and you don't have it then that's going to create some other issues for you,” cautioned Nordhorn.
    • He stated that strictly speaking, licensees weren’t required to check every person’s ID, but they were required to ensure only those 21 and older were in age-restricted business areas. The result was policies on checking all patron IDs, “and those types of things…probably need to be considered” and “worked out” by officials before authorizing biometric age verification.

• Senators posed questions as they contemplated whether a “regulatory framework” for use of biometric information by officials and businesses was warranted.
  • Chair Karen Keiser asked whether WSLCB staff were “undertaking answers as you go through all of these questions? Have you put together a proposed rulemaking process to do this?” (audio - 2m,  Video - TVW)
    • Nordhorn replied that they hadn’t beyond having “people asking us to develop some rules,” but he felt “there's too many variables for the LCB to be able to develop those rules…we really need to have that discussion with the Department of Licensing to have them on board.” He further believed “the other major consideration” related to “trends that we see towards self checkouts, and all of these types of things, and if you have less people monitoring” he saw a greater potential for “over service issues.” Nordhorn appreciated that speed of sales was a “business advantage,” but if that meant fewer staff were “assessing sobriety” it would be a safety concern. Overall, Nordhorn didn’t feel WSLCB leaders were “in a good position to develop rules" without legislative guidance.
    • Webster reported the topic came up in a rulemaking petition, so there had been some internal discussions, “and I think we're also going to get pitched…with folks who want to do this on some sort of a pilot basis as well.”
  • Senator Drew MacEwen—presuming passage of a law “that allows this to be a valid form of ID—we don't have to solve all these other issues necessarily…because it's incumbent upon a licensed establishment to ensure that they're complying with the law.” Understanding that “these questions are certainly valid, we don't have to have the answers necessarily, is that correct?” (audio - 1m,  Video - TVW)
    • Webster agreed with MacEwen’s reasoning, as did Nordhorn, while qualifying that “we just want to make sure that…youth aren't getting access to alcohol and people are drinking responsibly, and that's really the two bottom lines when it comes to the alcohol regulation.” Nordhorn then indicated that “there could be some unintended consequences and impacts to other groups. For example, the tribes we approve their government issued IDs…and that probably wouldn't translate into some of the, the biometric technology.”
  • Keiser asked if any biometric verification was already used in Washington. He answered that it had been used for payment purposes, but he was uncertain of any current biometric age verification by companies around the state (audio - 1m,  Video - TVW).
    • Webster noted biometric technology had been utilized in the Seattle Climate Pledge Arena, and “there's a spirits retailer in Seattle that has something similar…but to my knowledge there's still somebody checking IDs at the door, but then you could just go through, pick up whatever you want, and walk out.”
  • Keiser got the impression that regulators were seeking some “statutory framework…to start answering all these questions.” Nordhorn replied that it was only needed if elected officials wanted more “consistent application” of how agency staff responded to those systems. “What it kind of boils down to is folks don't want to use it yet because they don't have the security, but they can use it if they want to,” he commented (audio - 1m,  Video - TVW)
  • Vice Chair Steve Conway was curious how consumers would know “the basis for age verification if we have biometrics out there, as well as the traditional form of bringing a driver's license and scanning it?” He worried “about getting so many different ways of age verification that we lose control of it.” Keiser said his concern was “duly noted,” and Nordhorn considered “It's just a matter of time before it's, it's coming in and we need to be able to adapt and adopt some of these types of policies, and how we do that is, is what's important” (audio - 1m,  Video - TVW).
  • MacEwen mentioned that he opted into the Clear program at the airport to avoid lines, and was curious “what does the retailer see when they do scan the back of your ID?” (audio - 1m,  Video - TVW)
    • Nordhorn was unsure, deferring to WA DOL expertise, “I know we have a 2D barcode and a 4D barcode and I'm not sure which one they scan.” One had “basic information…and the other one has more detailed information, and I'm not sure which one those companies are utilizing.” He stated that there had been members of the public expressing privacy concerns about how such information was collected and used.
      • In November 2022, WSLCB denied a petition related to ID scanning data being saved and used for marketing by cannabis retailers, though Board Chair David Postman voiced an interest in learning more about that practice, since “the question is a good one.”
      • Learn more about ID cards and requirements from WA DOL.
  • Keiser thanked Nordhorn and Webster “for opening up this whole can of worms, but I think it bears further work and I appreciate you putting the thought and effort into that” as she brought the work session to a close (audio - <1m,  Video - TVW).