All Firms Must Comply With Age-Gating Rules Under New Data Law

All companies, not just social media platforms, are facing the challenge of implementing age verification mechanisms as mandated by the Digital Personal Data Protection Act, 2023. Experts have emphasised that it is essential to have these mechanisms to record verifiable consent from users. However, this requirement is causing concern among various firms due to the associated high costs and time-consuming processes.

While the age-gating clause was initially associated with social media and education technology platforms, legal experts in the field of technology and telecommunications have clarified that it extends to other companies as well. These companies need to ensure that their customers are not minors.

Under the Digital Personal Data Protection Act, it is specified that personal data of children and individuals with disabilities should only be processed with the consent of their parents or lawful guardians. The idea of “verifiable consent” poses a challenge as it lacks a clear definition. Businesses are interpreting this to mean that age verification measures are necessary to understand who they are dealing with, particularly when dealing with minors.

To put it plainly, this implies that virtually every platform will need to incorporate age verification mechanisms to be able to record verifiable consent. Without such mechanisms in place, it would be impossible to confirm the age and gain the required consent from users, according to experts.

Minors make purchases on e-commerce platforms like Amazon and Flipkart, adding to the complexity of the issue. While the rules surrounding the process of capturing verifiable consent are yet to be finalised, the government plans to consult various stakeholders, including parents, students, and industry representatives.

Companies from various sectors, including manufacturing, logistics, technology, and more, are seeking guidance on the implementation of the DPDPA from law firms. This regulatory change affects a wide range of industries, and companies are looking for government guidance on how to verify a person”s age online and whom to seek consent from.

A concern revolves around government-issued IDs, such as Aadhaar, which often list only one parent. This leads to questions about which parent should receive the consent notice. Companies and legal experts are also navigating the complexities of the three-step verification process required, which includes establishing the child”s age, confirming the identity of the parent, and ensuring the relationship between them.