New Digital Personal Data Protection Act Rules: Children Under 18 Will Need Parental Consent to Create Social Media Accounts

The rules also include age verification methods and data security provisions.

The Digital Personal Data Protection Act (DPDP Act) draft rules now require children under 18 to obtain parental consent before creating accounts on social media platforms. These rules also outline age verification methods and data security provisions.

New Delhi: Children will now need the permission of their parents or guardians to access social media platforms, as per the Digital Personal Data Protection Act (DPDP Act) that was approved by Parliament in August 2023. However, the Act did not clearly mention the method of checking consent. Now, its draft rules have been issued for public consultation, and feedback can be submitted till February 18.

According to these rules, the age of children will be confirmed through a government ID or a token verified by the digital locker service provider.

For example, if a child (C) wants to create an account on a platform, the data fiduciary (DF) will have to check the consent of the parents (P), as per an example given in the draft rules.

What will happen?

The provisions related to children’s data processing have been a matter of controversy since 2023. Many big tech companies like Meta and Google had demanded to reduce the definition of children from 18 years to 14 years. At the same time, some sections of civil society and industry had expressed concern that such rules could affect innovation and create problems for the technology sector.

However, in the DPDP rules, the government has exempted some data fiduciaries from the restrictions imposed on children’s data processing. These institutions include:

Mental health institutions and health care professionals

What is a data fiduciary?

In simple terms, a data fiduciary is an organization or person who collects and uses your data. When you use an app, website, or service, some information (such as name, email, phone number, location) is taken from you. Whoever is given this information is called the data fiduciary. It is the responsibility of the data fiduciary to keep your data safe and use it only for the purposes for which your consent has been taken.