Shielding Young Minds: DPDP's Safeguards for Children's Data Privacy

• In 2023, a video-sharing platform was fined €345 million for failing to obtain parental consent, provide sufficient data usage information, and implement adequate safeguards.1

• In 2022, a social media platform was fined €405 million for failing to prevent unauthorized contact between adults and children, provide adequate data usage information to minors, and implement robust safeguards.2

• In 2019, a search engine giant was fined $170 million for tracking children's online activities without their consent, targeting them with personalized advertisements, and failing to provide adequate data usage transparency.3

1. Prioritize Age Verification:

Accurate age identification is the foundation of children's data privacy compliance. We recommend implementing robust age verification mechanisms, such as:

• Age-appropriate questionnaires Parental verification processes Third-party age verification services

These measures will help you accurately identify young users and ensure that data collection and processing align with the DPDP Act's requirements.

1. Empower Parents with Informed Consent:

Parental involvement is crucial in safeguarding children's data privacy. Entities should develop transparent and accessible communication materials that clearly inform parents about:

• Type of data being collected Purposes for which data is being used Measures in place to protect children's privacy Obtaining verifiable parental consent is paramount. Implement secure consent mechanisms, such as:

• Multi-stage consent processes Parental dashboards Clear opt-out options

This will empower parents to make informed decisions about their children's online activities.

1. Embrace Data Minimization Principles:

Entities should collect only the minimum amount of personal data necessary for the stated purpose. This means establishing a clear data retention policy in keeping with Sections 5 and 8 of the DPDP Act.

1. Implement Robust Data Security Safeguards:

Protect children's personal data with stringent security measures such as:

• Multi-factor authentication Data encryption Access controls Regular security audits

These measures will safeguard children's data from unauthorized access, use, disclosure, alteration, or destruction.

1. Conduct Regular Privacy Impact Assessments:

Regularly assess the privacy implications of data collection and processing practices, particularly those involving children's data. We recommend incorporating:

• LINDDUN analysis to identify what is PII and Non-PII and then go a step further to label which PII has potential risks Privacy impact assessments to evaluate compliance.

This proactive approach will help entities to identify and address potential data privacy issues before they escalate.

1. Utilise Age-Gating Assistance:

Platforms will also need to build age- gating mechanisms to restrict access to certain content or features based on user age. Some tools that can be used are:

• Age-appropriate content filters Age verification pop-ups Restricted user profiles

This will protect children from accessing inappropriate content and ensure that their data is only collected and processed for age-appropriate purposes.

1. Data Protection Commission. (2023, September 15). Irish Data Protection Commission announces €345 million fine of TikTok . https://www.dataprotection.ie/en/news-media/press-releases/DPC-announces-345-million-euro-fine-of-TikTok

2. Helen Dixon, Commissioner for Data Protection. (2022). In the matter of Meta Platforms Ireland Limited, formerly Facebook Ireland Limited, and the “Instagram” social media network https://www.dataprotection.ie/en/resources/law/decisions/Meta-Platforms-Ireland-Limited-formerly-Facebook-Ireland-Limited-and-the-Instagram-social-media-network-September-2022

3. Federal Trade Commission. (2019, September 4). Google and YouTube Will Pay Record $170 Million for Alleged Violations of Children’s Privacy Law . https://www.ftc.gov/news-events/news/press-releases/2019/09/google-youtube-will-pay-record-170-million-alleged-violations-childrens-privacy-law