Draft Rules of India's Digital Personal Data Protection (DPDP) Act Reaffirm That Children Under 18 Will Require Parental Consent to Access Social Media Platforms

Introduced in the DPDP Act passed in August 2023, this provision lacked clarity on verification methods, which the new draft rules aim to address.

The Digital Personal Data Protection (DPDP) Act's draft rules stipulate that children under 18 must obtain parental or guardian consent to use social media platforms. This provision was included in the DPDP Act, which was passed in August 2023, but the methods for age verification were unclear. The new draft rules aim to address this issue.

The proposed rules, which are open for public feedback until February 18, suggest using a government-issued ID or a token that has been authenticated by a Digital Locker service provider to verify a child's age.

An example in the draft explains the process: If a child (C) wants to create an account, the platform, which is referred to as the Data Fiduciary (DF), must verify parental consent. The parent (P) would identify themselves as a registered user with verified identity and age details. Before processing the child's data, the DF must confirm the reliability of the parent's identity.

Since 2023, the Act's provisions on children's data have sparked debates. Tech giants like Meta and Google have pushed for lowering the legal age threshold from 18 to 14, arguing that the current definition poses challenges for platforms targeting teenagers. However, despite industry pressure, the government has maintained the age limit of 18 in the draft.

The DPDP Act aims to strengthen children's data protection, but it also raises concerns about implementation and compliance for digital platforms. Public feedback on the draft rules will be crucial in determining the final guidelines.