Govt to introduce 'risk-based' framework for age-gating on social media

The framework will operate as a part of the Digital Personal Data Protection Act, of 2023, which was passed by the parliament in August

The government is working on a detailed "risk-based" framework with multiple options for social media and other internet intermediaries, The Economic Times (ET) has reported. This is being done to enforce age-gating (limiting user access based on their age) to access social media services only with parental consent, people familiar with the development told the newspaper.

Importantly, this framework will require compliance by large social media companies like Meta, which operates Instagram and Facebook, and Google, which operates YouTube. The edtech platforms and health-related applications that manage user data will also need to adhere to these guidelines.

How will the age verification work?

Several methods are under consideration for age verification and the same could be facilitated using documents saved in DigiLocker, an Aadhaar-based process, a digital token, or at the app store level, depending on the risk of a child's data being possibly misused and the likely harm, a government official told The Economic Times (ET).

The official told ET, "There cannot be a one-size-fits-all approach here." "Social media companies will need to adhere to stricter age-gating as the possibility of a stranger getting in touch with children or vice-versa is much greater here, compared to say an education app or a website, the official added."

For instance, educational, news, accessory, and fashion-related applications and websites having under-18 users, may need to verify the age of their users and obtain parental consent. The official was cited in the report as saying that documents such as a school leaving certificate, board exam mark sheets, and birth certificates can be used to perform basic checks about a user's age. Some websites may require only these details to ensure verification without the need to store this data, according to the official.

DPDP Act and age-verification framework

The framework will operate as a part of the Digital Personal Data Protection Act, of 2023, which the parliament passed in August. These rules are expected to be released by the Ministry of Electronics and Information Technology (MeitY) by the end of November 2023, according to ET.

The DPDP Act defines users below 18 years of age as children and mandates that social media and other similar entities must not process data of underage users without the consent of their parents.