Push to protect children online faces basic challenges: Experts

India's ambitious attempt to protect children online through its draft Digital Personal Data Protection Rules rests on a shaky foundation: it depends on children voluntarily declaring they're underage and assumes that parents have a higher degree of digital literacy, triggering a complex verification system that experts say is inherently flawed yet might be the best available option.

- Aditi Agrawal

The rules, at present a draft released on Friday for public consultation until February 18, represent India's most comprehensive attempt yet to protect digital privacy of its citizens, and sets in place specific protections for children.

They mandate parental consent for users under 18, require platforms to verify guardians' identities through undefined mechanisms, and prohibit behavioural tracking of minors. But experts say the effectiveness of these stringent measures hinges on trusting children to voluntarily identify themselves as minors, highlighting fundamental challenges in protecting young users online while preserving accessibility and privacy.

"The fundamental question is - what happens if I don't give my correct age? How will the entire mechanism work?" asked technology lawyer Gowree Gokhale, Age gating, the process of restricting access to services based on age, can range from simple pop-ups requiring users to confirm their age to complex age verification systems involving government IDs or facial scanning and biometrics.

For verifiable parental consent, platforms must accomplish four tasks: determine if the user is a child, verify an adult's identity, establish the relationship between them, and retain a record of the adult's consent.

The verification process creates multiple paths and challenges. For major platforms like Facebook, existing adult users' data could verify parental identity. But smaller platforms face a heavier burden, needing to either collect government IDs or integrate with third-party digital locker service providers (DLSPs) as proposed in the DPDP Rules.