Age-gating rules apply to all firms under data law
Not just social media platforms, but all companies will need to have age verification mechanisms, otherwise, there's no way to record the verifiable consent of users, experts told ET. The mandate will be high cost and time consuming, which is wo...
The new data law's mandate of verifying the age of minors through parental consent has sent scores of companies from telcos, banks, to ecommerce companies and their lawyers in a tizzy.
Not just social media platforms, but all companies will need to have age verification mechanisms, otherwise, there's no way to record the verifiable consent of users, experts told ET. The mandate will be high cost and time consuming, which is worrying all firms, they added.
Technology, and telecommunication lawyers who are being approached for guidance on the implementation of the Digital Personal Data Protection Act, 2023, have told companies to read the finer details and realise that the age-gating clause in the DPDPA is not just for social media companies and education technology platforms, a chunk of whose consumer base, are children. It will be applicable to others too who have to make sure their customers are not minors.
DPDPA stipulates that personal data of children and persons with disabilities is processed only with the consent of such a person's parent or lawful guardian.
ADVERTISEMENT
Shreya Suri, partner at Indus Law firm, told ET, what is confusing for some businesses is the concept of verifiable consent. What is verifiable is not defined. "While verifiable consent is not defined, the fact that you need to know who you're dealing with means that you need to have some sort of age verification measures in place in any event to be able to first understand that I'm dealing with a minor and now I need verifiable consent," she explained.
"If you read between the lines, it means every platform will need to have age verification mechanisms. Otherwise, there's no way you'd be able to record the verifiable consent of users," Suri said.
In a previous ET interview, minister of state for electronics and information technology Rajeev Chandrasekhar, had said that the rules around the manner and procedure for capturing the verifiable consent would be finalised upon consultation with various stakeholders including parents, students, and industry.
Companies across - manufacturing, business-to-business space, logistics, consumer-facing companies, technology platforms, automobile sector, investors, funds, venture capital portfolio companies - have approached the law firm for guidance on the DPDPA's implementation, Suri said. "It's sector-agnostic to be honest," she said.
Companies are looking for guidance from the government on how to verify the age of a person on the internet, and clarification on whom to ask consent from and how to take the consent. Another technology lawyer requesting anonymity said, "Another confusion is the fact that government IDs like Aaadhaar or other identification records mostly only have the father as the listed parent. So, who should the company send the consent notice to? The father or the mother?"
A third technology lawyer requesting anonymity said they had spoken to several MeitY officials regarding this. "MeitY officials are also not sure how to go about the three-step verification process. First, to establish the age of the child, second the identity of the parent, third to establish that both are indeed related," the lawyer said.
