Govt may not define specific steps for parental control measures

The meeting, led by IT secretary S Krishnan, included representatives from Meta, Google, Sharechat and Snap

The ministry of electronics and information technology (Meity) does not intend to prescribe a specific mechanism for data fiduciaries to verify parental consent for minors using digital services, people familiar with the matter said, citing discussions between the government and social media companies on the Digital Personal Data Protection Rules held on Thursday.

One social media executive, in the meeting, noted there is no “silver bullet” for age verification or establishing verifiable parental consent globally. (Pexel)

In the meeting with social media companies, senior MeitY officials acknowledged the technical challenges of verifying parental consent and emphasised the need to protect children online while remaining pragmatic about technical feasibility.

The meeting, led by IT secretary S Krishnan, included representatives from Meta, Google, Sharechat and Snap.

One social media executive, in the meeting, noted there is no “silver bullet” for age verification or establishing verifiable parental consent globally. The executive suggested integrating parental consent at “entry points” like app stores, operating systems and devices, rather than within individual apps, to avoid data maximisation and security risks.

A MeitY official responded that while this could become an industry standard if companies adopt it of their own volition, the ministry did not intend to codify specific methods in the rules.

Under Section 9 of the Digital Personal Data Protection Act, data fiduciaries must obtain “verifiable consent” from parents or guardians before processing children’s data. The section prohibits harmful data processing, ad targeting and behavioural monitoring of children.

Officials in the meeting said that data fiduciaries must implement “appropriate technical and organisational measures” to protect children online as part of their general obligations under Section 8(4) of the Act. They must be able to prove in court that they made “best efforts” to comply with Section 9. This, a person aware of the matter told HT, is because any technological solution that is prescribed in the rules may soon become obsolete, and section 8(4) casts an obligation on data fiduciaries to keep their systems up to date.

The industry, collectively, told officials that the process of dealing with children’s data is complex, something the officials acknowledged. At least two social media executives talked about the need to take a graded approach to verified consent on the basis of risk posed by the data processing. They cited the UK’s Age Appropriate Design Code (AADC) as an example, that prescribes fifteen standards for data fiduciaries to follow while processing children’s data.

The use of a digital locker for age verification and parental consent, previously mentioned by former minister of state Rajeev Chandrasekhar in a December meeting, was not discussed in Thursday’s meeting. People aware of the matter indicated the ministry is aware of MeitY’s digital locker, DigiLocker’s limitations in this context, including difficulties in age verification without identification and relationship mapping.

An official, aware of how DigiLocker works, said that there is no solution yet for age verification that does not simultaneously lead to identification of the individual. While age can be ascertained through an API that pulls the age from documents uploaded to DigiLocker, it is not possible to do this without also including the name as multiple people in a family might use the same phone, this person said. This person also said that relationship mapping is very difficult via DigiLocker as at times, instead of parents, guardians might be involved, like in the case of orphans.