Children under the age of 18 will now need parental permission to create social media accounts, according to the central government’s draft of the Digital Personal Data Protection regulations, which was made public on Friday.
According to the eagerly anticipated draft of the DPDP guidelines, “A data fiduciary shall adopt appropriate technical and organisation measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence.”
Penalties for infractions are not mentioned in the draft, though. “Draft of rules proposed to be made by the central government in exercise of the powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), on or after the date of coming into force of the Act, are hereby published for the information of all persons likely to be affected thereby,” states the notification for the draft DPDP rules.
After February 18, these draft rules will be considered for the final rule. The data collection body must also verify that the “individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law for the time being in force in India,” according to the final draft rules.
The “voluntarily provided details of identity and age or a virtual token mapped to the same,” which is issued by any entrusted government body, refers to the trustworthy identity and age information that is accessible with the data fiduciary. Platforms for social media, gaming, and e-commerce will all be considered data fiduciaries.
Notably, the draft regulations also include clauses pertaining to data collection organisations, person consent processing, and the operations of authorities under the 2023 Digital Data Protection Act. A penalty of up to ₹250 crore can be imposed by the DPDP Act on data fiduciaries, which are organisations in charge of figuring out why and how personal data is processed.