BACKGROUND

Over the past years, privacy and security policies, and related operations have become increasingly important. Breaches in security, leading to the unauthorized access of personal data (which may include sensitive personal data) have become more frequent among companies and other organizations of all sizes. Such personal data may include, but is not limited to, personally identifiable information (PII), which may be information that directly (or indirectly) identifies an individual or entity. Examples of PII include names, addresses, dates of birth, social security numbers, and biometric identifiers such as a person's fingerprints or picture. Other personal data may include, for example, customers' Internet browsing habits, purchase history, or even their preferences (e.g., likes and dislikes, as provided or obtained through social media).

Many organizations that obtain, use, and transfer personal data, including sensitive personal data, have begun to address these privacy and security issues. To manage personal data, many companies have attempted to implement operational policies and processes that comply with legal and industry requirements. However, there is an increasing need for improved systems and methods to manage personal data in a manner that complies with such policies.

SUMMARY

A method, according to various aspects, comprises: (1) responsive to a request to initiate a transaction between an entity and a data subject, generating a consent receipt set comprising a consent receipt identifier, a transaction identifier based on the transaction, and a subject identifier based on the data subject; (2) requesting, by the computing hardware, at least one piece of identifying information regarding the data subject; (3) receiving, by the computing hardware, the at least one piece of identifying information comprising an image of the data subject; (4) determining, by the computing hardware, based at least in part on the at least one piece of identifying information, an age of the data subject by: (A) causing an artificial intelligence image system to generate a prediction usable for determining the age of the data subject by providing the image of the data subject to the artificial intelligence image system for analysis; and (B) receiving, from the artificial intelligence image system, the prediction; (5) determining, by the computing hardware, based on the age of the data subject and the transaction, whether the data subject meets one or more age criteria for processing personal data under the transaction; and (6) in response to determining the data subject does not meet the one or more age criteria for the processing of personal data under the transaction, modifying, by the computing hardware, the consent receipt set to prevent a computing system from providing the data subject with access to functionality requiring valid consent.

In particular aspects, the consent receipt set comprises a consent status and generating the consent receipt set comprises initially setting, by the computing hardware, the consent status to valid in response to the request to initiate the transaction. In still other aspects, modifying the consent receipt set to prevent the computing system from providing the data subject with access to the functionality requiring valid consent comprises modifying, by the computing hardware, the consent status to invalid in response to determining the data subject does not meet the one or more age criteria. In some aspects, the method further comprises: (1) determining, by the computing hardware, image capture data associated with the image of the data subject, the image capture data comprising at least one of a capture time of the image of the data subject or an image capture location of the image of the data subject; and (2) determining whether the data subject meets the one or more age criteria for processing the personal data under the transaction is further based on the image capture data. In various aspects, the image capture data comprises the capture time of the image of the data subject. In any aspect described herein, determining whether the data subject meets the one or more age criteria for processing the personal data under the transaction comprises determining whether the capture time of the image of the data subject is within a threshold amount of time of a time of the request to initiate the transaction.

In particular aspects, the prediction comprises a confidence level; and the method further comprises: (1) determining, by the computing hardware based on the confidence level, whether the prediction satisfies a threshold confidence level; (2) responsive to determining that the prediction does not satisfy the threshold confidence level, requesting at least one second piece of identifying information; and (3) determining, by the computing hardware, based at least in part on the at least one second piece of identifying information, the age of the data subject by: (A) causing the artificial intelligence image system to generate a second prediction usable for determining the age of the data subject by providing the second image of the data subject to the artificial intelligence image system for analysis; and (B) receiving, from the artificial intelligence image system, the second prediction. In particular aspects, the at least one second piece of identifying information comprises a second image of the data subject. In some aspects, the method further comprises: (1) causing, by the computing hardware, the artificial intelligence image system to generate a second prediction usable for determining whether the data subject is performing a particular action in the image of the data subject; and (2) determining, by the computing hardware, whether the data subject meets the one or more age criteria for processing personal data under the transaction based on the second prediction.

A system, according to various aspects, comprises: (1) a non-transitory computer-readable medium storing instructions; and (2) a processing device communicatively coupled to the non-transitory computer-readable medium. In particular aspects, the processing device is configured to execute the instructions and thereby perform operations comprising: (1) responsive to a request to initiate a transaction between an entity and a data subject, generating a consent receipt set comprising a consent receipt identifier, a transaction identifier based on the transaction, and a subject identifier based on the data subject; (2) receiving a piece of identifying information for the data subject; (3) causing a third-party artificial intelligence system to generate an output related to determining an age of the data subject by providing the piece of identifying information to the third-party artificial intelligence system for analysis; (4) receiving the output related to determining the age of the data subject from the third-party artificial intelligence system; (5) determining, based on the output, whether the data subject satisfies an age criterion for the transaction; and (6) in response to determining that the data subject does not meet the age criterion, modifying the consent receipt set to prevent a computing system from providing the data subject with access to functionality requiring valid consent.

In any aspect described herein, the output may comprise a request for additional identifying information. In particular aspects, the operations further comprise: (1) receiving the additional identifying information for the data subject; (2) causing the third-party artificial intelligence system to generate a second output related to determining the age of the data subject by providing the additional identifying information to the third-party artificial intelligence system for analysis; and (3) receiving the second output. In some aspects, determining whether the data subject satisfies the age criterion for the transaction is further based on the second output.

In a particular aspect, the output comprises at least one of a predicted age of the data subject, a predicted age range for the data subject, or an age prediction confidence level for the data subject. In yet another aspects, the consent receipt set comprises a consent status and generating the consent receipt set comprises initially setting the consent status to valid in response to the request to initiate the transaction, and modifying the consent receipt set to prevent the computing system from providing the data subject with access to the functionality requiring valid consent comprises modifying the consent status to invalid in response to determining the data subject does not meet the age criterion.

In some aspects, the piece of identifying information comprises an image of the data subject. In particular aspects, the operations further comprise determining image capture data associated with the image of the data subject, the image capture data comprising at least one of a capture time of the image of the data subject or an image capture location of the image of the data subject. In such aspects, determining whether the data subject satisfies the age criterion may be further based on the image capture data. In various aspects, the image capture data comprises the image capture location of the image, and determining whether the data subject satisfies the age criterion comprises determining whether the image capture location is within a particular distance of a determined location of a computing device from which the request to initiate the transaction originated.

A non-transitory computer-readable medium, according to various aspects, stores computer-executable instructions that, when executed by processing hardware, configure the processing hardware to perform operations comprising responsive to a request to initiate a transaction between an entity and a data subject, generating a consent receipt set. In some aspects, the request comprises a transaction parameter, a data subject parameter, and a consent parameter indicating consent by the data subject to processing of personal data received via a computer network as part of the transaction. In particular aspects, the consent receipt set comprises a consent receipt identifier, a transaction identifier based on the transaction parameter, a consent status based on the consent parameter, and a subject identifier based on the data subject parameter. According to particular aspects, the operations further comprise: (1) receiving an image of the data subject; (2) causing an artificial image system to generate an output related to determining an age of the data subject by providing the image of the data subject to the artificial intelligence image system for analysis; (3) receiving the output related to determining the age of the data subject from the artificial intelligence image system; (4) determining, based on the output, whether the data subject satisfies an age criterion for the transaction; and (5) in response to determining that the data subject does not meet the age criterion, modifying the consent status to prevent a computing system from providing the data subject with access to functionality requiring valid consent.

According to a particular aspect, the output comprises at least one of a predicted age of the data subject, a predicted age range for the data subject, or an age prediction confidence level for the data subject. In some aspects, the output comprises a prediction usable for determining the age of the data subject. In a particular aspect, the output comprises a second prediction usable for determining whether the data subject is performing a particular action in the image of the data subject. In various aspects, the operations further comprise determining image capture data associated with the image of the data subject, the image capture data comprising at least one of a capture time of the image of the data subject or an image capture location of the image of the data subject. In particular aspects, determining whether the data subject satisfies the age criterion is further based on the image capture data.

In a particular aspect, the output comprises a request for additional identifying information. In such aspects, the operations may further comprise: (1) receiving the additional identifying information for the data subject; (2) causing the third-party artificial intelligence system to generate a second output related to determining the age of the data subject by providing the additional identifying information to the third-party artificial intelligence system for analysis; and (3) receiving the second output. In other aspects, determining whether the data subject satisfies the age criterion for the transaction is further based on the second output.

