Children under the age of 18 will now need parental consent to open social media accounts, according to the draft rules of the Digital Personal Data Protection Act, 2023, published by the Center on Friday.
The Ministry of Electronics and Information Technology (MeitY), in its notification, announced that the public is invited to submit objections and suggestions to the draft rules through the government’s citizen engagement platform, MyGov.in. Response will be considered after February 18, 2025.
The draft laws emphasize strict measures to protect the personal data of children and people with disabilities under legal supervision. Data fiduciaries – entities entrusted with handling personal data – must ensure parental or guardian consent before processing any children’s personal data.
To ensure consent, fiduciaries must use government-issued IDs or digital identity tokens, such as those linked to Digital Lockers. Educational institutions and child welfare agencies, however, may be exempt from some provisions of the laws.
In addition to the focus on children’s data, the draft rules propose enhanced consumer rights, allowing users to demand the deletion of their data and demand transparency from companies about why their data is being collected.
A fine of up to Rs 250 crore is proposed for violations, to ensure strict accountability of data trustees. Consumers will have the right to challenge data collection practices and demand clear explanations of data use.
The rules define important digital intermediaries, including “e-commerce companies”, “internet gaming intermediaries”, and “social media intermediaries”, setting specific guidelines for each.
Social media platforms, as defined in the draft, are intermediaries that primarily enable online interaction between users, including the sharing, dissemination, and modification of information.
To oversee compliance with these laws, the government plans to establish a Data Protection Board, which will act as a comprehensive digital regulatory body.
The board will conduct remote hearings, investigate violations, apply fines, and register consent managers – entities tasked with managing data consents. Concessionaires will be required to register with the Board and maintain a minimum net worth of Rs 12 crore.
These broad measures aim to ensure that data custodians use strong technical and organizational protections, especially with regard to vulnerable groups such as children.
The draft legislation also includes provisions for exemptions in certain circumstances, such as educational use, to avoid unnecessary burdens on child care facilities.