The Digital Personal Data Protection Act (PDPA) is a new law in India that helps people protect their personal information. Think of it as a set of rules that tell companies and organizations how they can and cannot use your personal data.
The law gives every person in India the right to control who can access their personal information and how it can be used. This includes things like:
- Your name and address
- Your phone number
- Your email address
- Your photos and videos
- Your location data
- Information about what you do online
The PDPA is especially careful about protecting information belonging to children and people with disabilities. This article focuses on how the law protects children’s data.
Table of Contents
How Does the PDPA Define a “Child”?
Under the PDPA, anyone under 18 years old is considered a child. This is different from other places:
- In the European Union, a child is someone under 16 years old
- Under the General Data Protection Regulation (GDPR), a child is someone under 13 years old
India has chosen to be more protective by setting the age higher at 18 years.
Special Rules for Children’s Data
Section 9 of the PDPA has special rules for handling children’s personal information:
1. Parents Must Give Permission
Companies cannot collect or use a child’s personal information without getting permission from their parents or guardians first. This is called “verifiable parental consent” (VPC).
The law says parents must give permission, but it doesn’t explain exactly how companies should get this permission. The government still needs to create clear guidelines about this.
2. No Harmful Data Processing
The PDPA strictly forbids using children’s data in ways that could harm them. Companies:
- Cannot track children’s activities online
- Cannot monitor children’s behavior
- Cannot target advertisements specifically at children
If a company breaks these rules, they can be punished under the law.
What Does “Harmful” Mean?
The PDPA mentions that companies cannot use children’s data in ways that have a “detrimental effect” on them. This means anything that could negatively affect a child’s:
- Physical health
- Mental health
- Overall well-being
However, the law doesn’t provide many details about what exactly counts as “harmful.” This lack of clarity creates some confusion.
Challenges with the Current Rules
The Parental Consent Problem
India hasn’t yet created specific methods for getting parental consent. Looking at other countries might help:
In the United States, companies can get parental consent through:
- Signed consent forms sent by mail
- Email plus additional verification steps
- Phone calls to toll-free numbers
- Video calls for identity verification
- Knowledge-based questions (asking things only a parent would know)
- Government ID verification
- Facial recognition technology
Many people in the US complain that these methods are too complicated and time-consuming. However, parents generally support having thorough verification processes to protect their children.
One possible solution is creating a special platform that verifies parents once and then works across multiple websites and apps. This would make the process easier for everyone.
The Age Gap Issue
The PDPA protects all children under 18, but many social media platforms allow users who are 13 and older. This creates a gap where:
- Social media platforms can legally collect data from users aged 13-17 in many countries
- But in India, this would require parental consent
- This might be difficult to enforce
Understanding Different Age Groups
Children develop at different rates:
- A 5-year-old has a very different understanding than a 15-year-old
- A 10-year-old with a social media account needs different protections than a 17-year-old
- The law currently treats all under-18s the same way
Online Learning Platforms
Many online education platforms track how students use their services, including:
- What videos do they watch
- How long do they spend on different activities
- What questions do they get right or wrong
- How they interact with learning materials
Since most students are under 18, these platforms will need to:
- Get parental consent
- Make sure their tracking doesn’t harm children
- Be careful about how they use this data
Gaming and Advertising
The gaming industry often targets children with:
- Games designed specifically for younger players
- In-app purchases that children might not understand
- Advertisements that appear within games
- Collection of behavior data to make games more addictive
Under the PDPA, game companies will need to:
- Get parental permission before collecting data
- Stop targeting advertisements specifically at children
- Avoid designing games that could harm children’s mental health
Benefits for People with Disabilities
The PDPA also includes special protections for people with disabilities. The law requires:
- Information about data collection to be provided in accessible formats
- Special consideration for how data is collected from people with disabilities
- Extra protection against discrimination based on disability-related data
What Needs to Improve
While the PDPA is a good start, it needs more clarity in several areas:
- Better definition of “detrimental effect”: The government should explain exactly what kinds of data uses could harm children.
- Clear guidelines for parental consent: Companies need to know exactly how to properly get parents’ permission.
- Age-appropriate protections: Different rules might be needed for different age groups (for example, rules for 6-12 year olds versus 13-17 year olds).
- Enforcement mechanisms: The government needs to explain how it will check if companies are following the rules.
- Education for parents and children: Families need to understand their rights under this new law.
In Summary
India’s Digital Personal Data Protection Act is an important step toward protecting children’s personal information in the digital age. While the law still needs some clarification and detailed guidelines, it shows that the government is serious about keeping children safe online.
As technology continues to develop and more children go online at younger ages, these protections will become increasingly important. With the right implementation and enforcement, the PDPA could help create a safer digital environment for India’s children.
By making companies get parental permission and prohibiting harmful uses of children’s data, the law helps balance the benefits of digital technology with the need to protect young people as they grow and develop.
