India’s Digital Personal Data Protection (DPDP) Act has posed a significant challenge for tech companies, especially concerning the age verification of users under 18 and obtaining parental consent. The Ministry of Electronics and Information Technology (MeitY) has been engaging with industry stakeholders to find viable solutions, yet a universally accepted method remains elusive.
The act mandates that organisations implement robust data protection measures, including obtaining explicit consent from individuals before collecting their data, and provides individuals with greater control over their personal information. One of the critical aspects of the DPDP Act is its focus on protecting the privacy of vulnerable groups, particularly children, who are more susceptible to online risks.
Significance Of Children’s Data Privacy
Children’s data privacy has become a pressing concern in the digital age, where young users are increasingly exposed to online platforms. Protecting the personal information of children is crucial, as they are often unaware of the potential risks and implications of sharing their data online. The DPDP Act recognises this vulnerability and places significant emphasis on ensuring that children’s data is handled with the highest level of security and care.
The importance of children’s data privacy is underscored by the growing number of cyber threats targeting young users. According to a report by the Mobile Association of India (IAMAI), approximately 71 million children aged 5-11 years in India use the Internet on family members’ devices. This group makes up about 14 per cent of the country’s active Internet user base, which exceeds 500 million, making them potential targets for cybercriminals. Ensuring that their data is protected is not only a legal obligation but also a moral imperative.
Government’s Stance On Age Verification
On July 18, MeitY communicated to major social media platforms that the government would not prescribe a specific method for verifying the age of children and obtaining parental consent. This decision came after considering and finding methods like Aadhaar and DigiLocker unfeasible. Instead, platforms are encouraged to devise their tech-enabled solutions that comply with the DPDP Act’s requirements.
During the meeting chaired by MeitY secretary S. Krishnan, with attendance from top tech companies like Meta, Google, Sharechat, and Snap, the government emphasized flexibility. They suggested that platforms should implement “appropriate technical and organizational measures” as per Section 8(4) of the DPDP Act to ensure compliance.
The tech industry has acknowledged the necessity of age verification but raised concerns about practical implementation and user safety. Senior Government officials highlighted the limitations of current methods in verifying the identity of minors using:
- Aadhaar Authentication: During Aadhaar Authentication, issues arise in establishing the relationship between a child and the parent, especially with outdated data.
- DigiLocker and One-Time Electronic Tokens: Methods like DigiLocker verification struggle to keep pace with rapid technological changes and are not robust enough for consistent social media verification.
The industry has proposed a more streamlined solution involving app-store-level verification. This method would require users to verify their age once at the app store level, simplifying the process for both platforms and users. This approach could provide a more uniform and manageable solution, reducing the burden on parents and ensuring compliance across various apps.
A significant discussion point during the meetings was the restriction on behavioural tracking and targeted advertising for children. While these restrictions aim to protect minors, platforms argue that such tracking is essential for ensuring online safety and providing beneficial personalisation.
Without the ability to monitor user behaviour, platforms might struggle to prevent children from engaging with inappropriate content or interacting with potential threats. This could lead to a compromise in user safety, a concern echoed by industry executives.
While no definitive solution has been reached, the government has invited tech companies to submit their proposals. The aim is to develop a feasible solution, protect user privacy, and ensure the safety of minors online.
In the long term, implementing these checks at the app store and device levels, rather than at the individual app level, seems to be a promising direction. This would facilitate a more consistent application of the age verification process across various platforms and reduce redundancies.
Conclusion
The challenge of verifying the age of children under the DPDP Act highlights the complexities of balancing regulatory compliance, user privacy, and safety. The collaborative approach between the government and the tech industry is crucial in finding a viable solution. As discussions continue, the goal remains to develop a method that is both effective and practical, ensuring the safety and privacy of minors in the digital space.
