Centre Mulls ‘Risk-Based’ Framework For Social Media Age-Gating

In the wake of several incidents related to children falling prey to online predators on social media, the government is reportedly planning to bring out a new strategy that offers multiple options to social media and internet intermediaries to enforce age-gating and subsequent parental consent management.

Age-gating is a technical protection method used to curb underage people from viewing a website with restricted or inappropriate content.

The ‘risk-based’ framework is expected to be implemented by companies like Meta-owned Facebook and Instagram, YouTube, as well as edtech and health platforms, among others, as per a report by ET.

Age verification takes into account various methods, including the use of documents stored in DigiLocker, an Aadhaar-based process, a digital token, or at the app store level. The choice of method would depend on the perceived risk of potential misuse of a child’s data and the likely harm.

“Social media companies will need to adhere to stricter age-gating as the possibility of a stranger getting in touch with children or vice-versa is much greater here, compared to say an education app or a website,” an official told ET.

In instances such as educational, news, accessory, and fashion apps and websites with users below 18, the verification of users’ age and the securing of parental consent could be facilitated through a less stringent approach, involving cross-checking age via documents stored in Digi Locker, according to another official.

Age verification for social media intermediaries, where the risk of a child interacting with a stranger is elevated, is expected to involve a more rigorous process, featuring multiple-layer authentication, as per an official.

The framework will function within the ambit of the Digital Personal Data Protection Act of 2023, approved by the parliament in August. The Ministry of Electronics and Information Technology (MeitY) is anticipated to release these rules by the end of November 2023, as reported by ET.

The DPDP Act defines users below the age of 18 as children and mandates that social media or internet intermediaries, known as data fiduciaries, must not process any data of any child without explicit parental consent.

As per an ET report from October, social media platforms are exploring methods like QR codes, virtual Aadhaar IDs, or age verification at the app store level to comply with DPDPA of 2023. 

The government introduced the DPDP Act in August, prompting social media platforms to propose effective “child gating” methods, emphasising data minimisation principles.

The provision has faced resistance from industry executives concerned about the privacy implications of the tools used to establish children’s age and parental connection. Despite this, the ministry may require intermediaries to adopt one of the suggested solutions for age-gating. These solutions would involve age verification tools based on determining the user’s age, identifying the parent, and establishing their connection with the child, according to an official.

Apart from the solutions to ensure the substantiation of age and parental consent, MeitY’s framework may also provide an exhaustive list of dos and don’ts for all intermediaries including social media companies, a ministry official said.