Children below 18 will need parents’ consent to create social media account: Draft rules
The draft of Digital Personal Data Protection rules, released by the central government on Friday, stated that children under the age of 18 will now require parental consent to create social media accounts.
“A data fiduciary shall adopt appropriate technical and organization measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, ” the much awaited draft of the DPDP rules states.
However, the draft does not mention any penal action for violations.
The notification for the draft DPDP rules reads, “Draft of rules proposed to be made by the central government in exercise of the powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), on or after the date of coming into force of the Act, are hereby published for the information of all persons likely to be affected thereby.”
These draft rules will be taken into consideration for final rule after February 18.
The draft rules further elaborate that the data collecting entity is also required to check that the “individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law for the time being in force in India”.
These is by reference to the reliable identity and age details available with the data fiduciary or the “voluntarily provided details of identity and age or a virtual token mapped to the same”, which is issued by any entrusted government body.
E-commerce, social media and gaming platforms will all come under the category of data fiduciaries.
Notably, the draft rules further lay out provisions related to consent processing of individuals, data collecting bodies, and the functioning of authorities under the Digital Data Protection Act, 2023.
The DPDP Act has a provision to impose a penalty of up to ₹250 crore on data fiduciaries which are bodies responsible for determining the purpose and means of processing of personal data.