Shielding Young Minds: DPDP’s Safeguards for Children’s Data Privacy

Shielding Young Minds: DPDP’s Safeguards for Children’s Data Privacy

After considerable deliberations, the Digital Personal Data Protection (DPDP) Act is finally operational and brings a host of fiduciary obligations for any entity, private or public, that is handling personal data. The Act also emphasises a special category for children, which mandates additional obligations under Section 9 of the Act.  

Section 9 (1) mandates that entities which are processing data of children have to ensure they have verifiable consent of a parent or a legal guardian before processing the data. A failure to do so will be seen as a violation of the DPDP Act and could lead to stiff penalties which may extend to ₹200 crores. 

This poses many challenges since the entity processing personal data of children will have to put in place measures to verify the age of their users as well as processing parental/legal guardian’s consent. This could be though a consent manager framework that can also seek documentation similar to the Know Your Customer (KYC) process, where authentic government-issued identification can be verified to establish age and relationship between the child and her parents or legal guardian. 

Once a child’s age is established, companies must ensure that parents are informed about the types of data being collected, the purposes for which it is being used, and the measures in place to protect their child’s privacy. This requires clear, concise, and age-appropriate communication materials tailored to parents’ understanding of the digital world. 

Entities are required to implement a transparent and secure consent mechanisms, ensuring that parents fully comprehend the implications of sharing their child’s data. This may involve multi-stage consent processes, parental dashboards, and clear opt-out options. 

The General Data Protection Regulation (GDPR), the EU’s flagship data privacy law, has set a high standard. Companies that mishandled children’s data have faced significant fines under GDPR. 

• In 2023, a video-sharing platform was fined €345 million for failing to obtain parental consent, provide sufficient data usage information, and implement adequate safeguards.¹ 
• In 2022, a social media platform was fined €405 million for failing to prevent unauthorized contact between adults and children, provide adequate data usage information to minors, and implement robust safeguards.² 
• In 2019, a search engine giant was fined $170 million for tracking children’s online activities without their consent, targeting them with personalized advertisements, and failing to provide adequate data usage transparency.³ 

The tangled web of children’s data privacy regulations, especially under the DPDP Act, can be a daunting maze to navigate. To steer clear of hefty fines and ensure compliance, companies should consider the following measures:  

1. Prioritize Age Verification:

Accurate age identification is the foundation of children’s data privacy compliance. We recommend implementing robust age verification mechanisms, such as: 

• • Age-appropriate questionnaires 
  • Parental verification processes 
  • Third-party age verification services 

These measures will help you accurately identify young users and ensure that data collection and processing align with the DPDP Act’s requirements. 

2. Empower Parents with Informed Consent:

Parental involvement is crucial in safeguarding children’s data privacy. Entities should  develop transparent and accessible communication materials that clearly inform parents about: 

• • Type of data being collected 
  • Purposes for which data is being used 
  • Measures in place to protect children’s privacy 
  • Obtaining verifiable parental consent is paramount. Implement secure consent mechanisms, such as: 

• • • Multi-stage consent processes 
    • Parental dashboards 
    • Clear opt-out options 

This will empower parents to make informed decisions about their children’s online activities. 

3. Embrace Data Minimization Principles:

Entities should collect only the minimum amount of personal data necessary for the stated purpose. This means establishing a clear data retention policy in keeping with Sections 5 and 8 of the DPDP Act.  

4. Implement Robust Data Security Safeguards:

Protect children’s personal data with stringent security measures such as: 

• • Multi-factor authentication 
  • Data encryption 
  • Access controls
  • Regular security audits 

These measures will safeguard children’s data from unauthorized access, use, disclosure, alteration, or destruction. 

5. Conduct Regular Privacy Impact Assessments:

Regularly assess the privacy implications of data collection and processing practices, particularly those involving children’s data. We recommend incorporating: 

• • LINDDUN analysis to identify what is PII and Non-PII and then go a step further to label which PII has potential risks 
  • Privacy impact assessments to evaluate compliance. 

This proactive approach will help entities to identify and address potential data privacy issues before they escalate. 

6. Utilise Age-Gating Assistance:

Platforms will also need to build age- gating mechanisms to restrict access to certain content or features based on user age. Some tools that can be used are: 

• • Age-appropriate content filters 
  • Age verification pop-ups 
  • Restricted user profiles 

This will protect children from accessing inappropriate content and ensure that their data is only collected and processed for age-appropriate purposes. 

It is important to note that the Rules under the DPDP Act have not yet been notified. These Rules will further define the obligations of entities under the Act, for example, the Central Government may exempt entities under Section 9(5) from certain or all obligations for certain ages if they can demonstrate verifiable safety measures.  

By keeping in mind these recommendations, entities can demonstrate their commitment to protecting children’s data privacy and creating a safe digital environment for young users. 

ENDNOTES: 

1. Data Protection Commission. (2023, September 15).  Irish Data Protection Commission announces €345 million fine of TikTok [Press release]. https://www.dataprotection.ie/en/news-media/press-releases/DPC-announces-345-million-euro-fine-of-TikTok  
2. Helen Dixon, Commissioner for Data Protection. (2022). In the matter of Meta Platforms Ireland Limited, formerly Facebook Ireland Limited, and the “Instagram” social media network https://www.dataprotection.ie/en/resources/law/decisions/Meta-Platforms-Ireland-Limited-formerly-Facebook-Ireland-Limited-and-the-Instagram-social-media-network-September-2022
3. Federal Trade Commission. (2019, September 4). Google and YouTube Will Pay Record $170 Million for Alleged Violations of Children’s Privacy Law [Press release].  https://www.ftc.gov/news-events/news/press-releases/2019/09/google-youtube-will-pay-record-170-million-alleged-violations-childrens-privacy-law 

Across Borders and Across Ages: A Comparative Analysis of Data Protection Frameworks

While the DPDP Act of India imposes new obligations for protection of children’s data, European GDPR and USA’s COPPA have been in effect for some time. The following table provides an overview of the new Indian requirements with these two laws.