THE ‘PARENTAL CONSENT’ PROBLEM WITH THE DRAFT RULES OF THE DPDP ACT

‘The draft rules adopt a one-size-fits-all approach, not taking into account the hierarchy of risks across digital platforms’

- 

Personal data is central to digital economies, enabling access to a range of services while also creating vulnerabilities. Data protection laws have been seen as safeguards against misuse. However, recent regulations are increasingly addressing the needs and also the issue of the safety of children in digital spaces. The Indian Digital Personal Data Protection Act, 2023 (DPDP Act) acknowledges that children under the age of 18 years require enhanced protection for their personal data due to their limited capacity to navigate digital risks. To this end, the law mandates platforms to obtain verifiable parental consent before collecting a minor’s personal information. Though well-intentioned, it raises concerns about unforeseen consequences, potentially impacting, negatively, the rights, the privacy and the security of both minors and adults.

Approach to obtaining parental consent Unlike global practices which allow greater flexibility, Draft Rule 10 of the DPDP Act outlines only two methods for obtaining parental consent on digital platforms. It states that if parents are existing users, platforms can use their previously collected information for verifiable parental consent. If not, it must be done through a digital locker service or any government authorised entity. In addition, platforms must exercise ‘due diligence’ to confirm that anyone claiming to be a parent is an identifiable adult for legal compliance. However,