New data protection rules propose Aadhaar-based consent framework for children to access online platforms

The Digital Personal Data Protection Act, 2023, which was notified in August, has provisions that will introduce a consent framework for children before they can use certain online services, the Indian Express reported on Sunday.

The upcoming rules propose to include an Aadhaar-based system to verify children’s age for using online services and to gather their parents’ consent.

The Union Ministry of Electronics and IT (MeitY) has scheduled a closed-door consultation with industry stakeholders on the proposed rules on December 19, Indian Express reported.

Government has to formulate at least 25 rules to operationalise the Act.

The Act will require companies to obtain verifiable parental consent before allowing anyone under 18 to use their platform.

However, the Act does not mention how this is to be done.

The rules, as per the Indian Express, will suggest two ways to perform this age-gating. The first of the two is an Aadhaar-based system where the parents will be allowed to add their children’s Aadhaar details to the DigiLocker platforms. When the kids try to create an account the platform will have to ping the app to verify their age.

A senior government official was quoted in the report that platforms will not be able to access the Aadhaar details and it will be a simple yes/no query to identify if the age of the children matches the requirement of the platform.

Another system that is being given thought is the electronic token system. In this, a system will be created that will turn a government ID into an encrypted form where only the name and age will be shared which will be used to verify if the person is matching the requirements of the platform or not. However, it will need the Centre’s green flag before being worked upon.

Healthcare, education and some other platforms where age gating is not required will be exempted from this requirement.