Parental Consent Must For Children To Open Social Media Account: Draft Rules

New Delhi: Children under the age of 18 will now require parental consent to open social media accounts, states the draft of Digital Personal Data Protection rules released on Friday. “A data fiduciary shall adopt appropriate technical and organization measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child and shall observe due diligence, " read the draft of the Digital Personal Data Protection Act rules.

The new guidelines were published for public feedback, with the government inviting objections and suggestions via its citizen engagement platform, MyGov.in. The deadline for submitting feedback is set for February 18, 2025.

"Draft of rules proposed to be made by the central government in exercise of the powers conferred by sub-sections (1) and (2) of section 40 of the Digital Personal Data Protection Act, 2023 (22 of 2023), on or after the date of coming into force of the Act, are hereby published for the information of all persons likely to be affected thereby," the draft notification said.

The rules have spelt out a mechanism for obtaining explicit consent from individuals and mandate parental consent for children to use their data in any form.

The Digital Personal Data Protection (DPDP) Act 2023 describes entities collecting and using personal data as data fiduciaries.

"A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child," the draft rule said.

As per the draft, the data fiduciary will have to carry out due diligence to check that the individual identifying herself as the parent of a child is an adult and identifiable if required in connection with compliance with any law in force in India. According to the draft rules, data fiduciaries will have to keep it only for the time being for which consent has been provided and delete it thereafter.

E-commerce, social media and gaming platforms will fall under the category of data fiduciaries.

The draft rules have laid out provisions related to the consent processing of individuals and independent entities that will manage consents, data fiduciaries and the functioning of authorities under the Digital Data Protection Act 2023.

The draft rules have not mentioned penalties that were approved under the DPDP Act, 2023.

The Act has the provision to impose a penalty of up to Rs 250 crore on data fiduciaries in case of personal data breach.

The draft rules, which have been published for public consultations, will be taken into consideration for making the final rule after February 18. The draft is available on the MyGov website for public comments.