New Draft Rules Mandate Parental Consent for Children's Social Media Accounts in India

The Ministry of Electronics and Information Technology (MeitY) has recently unveiled draft rules under the Digital Personal Data Protection Act 2023, which propose significant changes to how children's personal data is handled online. These rules, now open for public consultation, aim to enhance the protection of minors' privacy on digital platforms, including social media, e-commerce, and gaming sites.

Key Proposals of the Draft Rules

Parental Consent Requirement

One of the most critical aspects of the draft rules is the requirement for parental consent before any data fiduciary can process the personal data of children under the age of 18. This means that social media platforms, e-commerce websites, and gaming companies must obtain verified consent from a parent or legal guardian before allowing minors to create accounts or access their services.

To ensure that consent is valid, data fiduciaries must implement robust verification processes. This includes using government-issued identity proofs or digital identity tokens, such as those linked to Digital Locker services. The rules emphasize that data fiduciaries must adopt appropriate technical and organizational measures to verify the identity and age of the parent or guardian providing consent.

Illustrative Scenarios for Compliance

The draft rules provide specific scenarios to guide data fiduciaries in obtaining parental consent. For instance, if a child informs a platform that they are underage, the platform must facilitate the parent’s verification through its website or app. The parent must then provide verifiable credentials, either through government-authorized tokens or other digital methods.

Exceptions to the Rules

While the draft rules impose strict requirements on data fiduciaries, there are exceptions. Educational institutions, healthcare providers, and mental health professionals are exempt from obtaining parental consent under certain conditions. This exemption is designed to ensure that children can access necessary services without undue barriers.

Transparency and User Rights

The draft rules also focus on enhancing transparency in data processing. Data fiduciaries are required to provide clear and comprehensible notices to users regarding the purpose of data collection. This includes an itemized description of the personal data being collected and the specific purposes for which it will be used. Additionally , users must be informed of their rights, including the ability to withdraw consent at any time.

Grievance Redressal Mechanisms

To further empower users, the draft rules mandate that data fiduciaries publish grievance redressal mechanisms on their platforms. This ensures that users can easily raise concerns and receive timely responses regarding their data processing practices.

Cross-Border Data Transfer Restrictions

Another significant aspect of the draft rules is the restriction on transferring personal data outside India. Data fiduciaries must comply with specific requirements set by the Central Government before sharing personal data with foreign entities. This measure aims to safeguard the privacy of Indian citizens and ensure that their data is handled in accordance with local laws.

Public Participation and Feedback

The government has opened the floor for public consultation, inviting citizens and stakeholders to submit their objections and suggestions regarding the draft rules. Feedback can be provided through the MyGov platform until February 18, 2025. This initiative aims to create an inclusive regulatory framework that addresses the concerns of various stakeholders.

International Context and Implications

India's move to mandate parental consent for children's online accounts aligns with global trends in enhancing online safety for minors. For example, Australia has recently passed legislation that prohibits children under 16 from accessing social media platforms without parental consent. Such international developments highlight the growing recognition of the need to protect children's privacy in the digital age.

Potential Impact on Data Fiduciaries

Once implemented, these rules are expected to have a profound impact on how data fiduciaries operate in India. Companies will need to invest in technical infrastructure and processes to ensure compliance with the new regulations. Failure to adhere to these rules could result in significant penalties, with breaches potentially incurring fines of up to ₹250 crore.

Conclusion

The draft rules under the Digital Personal Data Protection Act 2023 represent a significant step towards safeguarding children's privacy in the digital landscape. By mandating parental consent and enhancing transparency in data processing, the government aims to empower parents and protect minors from potential risks associated with online activities. As the public consultation period unfolds, stakeholders will have the opportunity to shape the final regulations, ensuring that they effectively address the challenges posed by the evolving digital ecosystem.

In summary, the proposed rules not only aim to protect children's data but also enhance consumer rights and accountability among data fiduciaries. As India moves towards a more robust data protection framework, the implications for businesses and users alike will be profound, setting new standards for data privacy in the country.