A question of balance in age gating for children of the internet

India's new cyber law on parental consent sparks debate on digital privacy and security

Police officer Pawan Kumar shows his worry when asked about cybercrimes. Kumar is a sub-inspector with the cyber cell of the Uttar Pradesh Police and specialises in crimes against minors. “I have been working with the cyber cell for almost nine years now. Things are just getting worse with each passing day. We are witnessing astounding levels of innovation and complexity in crimes against children,” he said, blaming artificial intelligence (AI).

A little over a week ago, Kumar and his team busted a gang of three in Katra, a town southeast of Bareilly, for digitally manipulating images of children below 12 years for use on porn websites. Before that, Kumar tracked down a group of young unemployed technology professionals who collected samples of children’s voices and digitally modified the recordings to make ransom calls to parents. Another hacker used modified versions of audio samples to make scam calls asking for sensitive financial information.

Kumar and his colleagues have worked with the police in Delhi, Punjab, Maharashtra, Bihar, West Bengal and Odisha, tracking cyber abuse of children. “It’s sickening to see how easily innocent children are made a target of these crimes,” said Kumar, whose name has been changed for this report on his request.

Age bar 18

The Digital Personal Data Protection Act (DPDP), a new law, says digital platforms need to obtain verifiable parental consent to process children’s personal data. The DPDP Act classifies everyone below 18 years of age as children. 

Parents will decide if a digital platform is safe to access and it can process their children’s personal data. Social media companies have sought relaxations in the rulebook that says the government can prescribe exemptions. Companies believe the provision about parental consent hurts digital inclusion, privacy, and children's safety.

The EU General Data Protection Regulation mandates that parental consent is needed to process data of children below the age of 16 years. 

“Verifiable parental consent is one of the most worrying obligations. It may expose the child and the parent to a great deal of risk. It will endanger Indian users with an onerous obligation of submitting ID documents to multiple apps with varied security practices,” said a senior industry executive in India on the condition of anonymity. 

Another executive said regulation should not follow a one-size-fits-all approach as all digital platforms are not the same. “Stringent regulations with technical complexity will create compliance problems. Our ask for the government will be that we think we have really a compelling practice that is safe by design and regulation should incentivise good design,” she said.

As many as 73 per cent of urban parents want the DPDP Act to have mandatory parental consent for children under 18 years, said a survey by LocalCircles, which calls itself a community social media platform. 

The government, however, has said it may only consider lowering the age below which parental consent is required for some kinds of apps, like those of edtech companies. Rajeev Chandrasekhar, minister of state for information technology, said recently that e-KYC and digilocker could be means of getting parental consent by social media platforms.

“While the Act requires verifiable consent from a parent or lawful guardian, it does not suggest how it can be obtained. This will require the organisation to have an age gate (assurance) or verification mechanisms in place using artificial intelligence for facial age estimation or a verification is performed using government ID while striking a balance with privacy requirements as additional information will be collected,” said Sundareshwar Krishnamurthy, partner and leader (cybersecurity) at PwC India.

Parents are concerned about security but ironically many of them end up exposing their children to cyber abuse. In a recent advertisement, Deutsche Telekom, shed light on the dangers of parents sharing their children’s images, videos, and audio messages on social media. The ad used the photo of a little girl called Ella that her parents shared on social media to create a grown-up avatar using AI. The avatar, in an audio-visual presentation, reveals how digital footprint in social media posts makes Ella a target for cyber abuse.

Parents of the world

US cybersecurity firm Keeper Security recently released its global survey on parental practices for cybersecurity of children.

Almost 30 per cent of parents have never spoken to their children about cybersecurity, said the survey. Around 40 per cent of parents did not know how to create strong passwords. 

The data appears even more worrisome when one considers the 'McAfee’s Global connected Family' study of 2022. Indian children are among the youngest to reach mobile maturity. Smartphone use at the age of 10-14 is at 83 per cent, compared to the international average of 76 per cent. 

Cyberbullying or harassment is not merely misuse. “It leads to feelings of fear, anxiety, depression, and low self-esteem in children,” said Dr Priyanka Puri, consultant child psychologist at Sir HN Reliance Foundation & Research Centre in Mumbai.

Age gating isn’t quite the silver bullet against the cyber wolf, experts say. “When properly implemented, age-gating procedures are not harmful. However, there are several potential pitfalls that must be avoided. A false sense of security caused by age gating may unwittingly encourage youngsters to submit more personal information,” said Shamini Murugesh, chief mentor of WNS Cares Foundation, and creator of CyberSmart, a portal that teaches children online safety.