As Govt of India starts preparing rules for DPDP Act, social media platforms worried

Social media companies are raising significant concerns about the upcoming Rules for the Digital Personal Data Protection (DPDP) Act, specifically around issues such as behavioural tracking of children, verifiable parental consent (VPC), and targeted advertisements. These rules, designed to enforce the DPDP Act, have the industry hoping for solutions to their pressing challenges.

The DPDP Act, which was officially notified in The Gazette of India in August of last year, includes Section 9, which prohibits behavioural tracking of children on digital platforms.

This measure is intended to protect children’s privacy by preventing companies from monitoring a child’s online activities. However, social media companies argue that this restriction negatively impacts the effectiveness of safety features designed to protect young users.

According to a report by the Economic Times, executives from a social media intermediary expressed their concerns, emphasizing the need to track certain user signals, including those from children, to ensure safety features are effective.

They are in discussions with the Ministry of Electronics and Information Technology (MeitY) and other stakeholders to find a balanced approach that maintains both privacy and safety for teenagers.

Social media companies assert that tracking teenagers’ behaviour is essential for safeguarding them from predators and harmful interactions. One official mentioned that a complete ban on behavioural tracking is counterproductive to the government’s objectives of protecting children. They noted that the provision for exemptions leaves room for continued advocacy on this issue.

Another executive highlighted the adverse consequences of turning off behavioural tracking, citing the European Union’s e-privacy directive as an example. In the EU, companies had to suspend certain safety measures due to similar regulations but were later allowed to reinitiate them after regulatory review. The executives stressed that without exemptions for security purposes, platforms will struggle to prevent predators from targeting children.

The DPDP Act does allow the government to exempt specific data fiduciaries or data processes from the behavioural tracking prohibition, providing some hope for companies. They believe that future notifications of the rules might introduce such exemptions, avoiding the need to disable critical safety features.

Parental consent is another major issue under Section 9, requiring companies to obtain permission from parents before processing a child’s data. Companies are struggling to devise a practical method for obtaining this consent and are looking to the forthcoming rules for guidance. They hope the government will identify third parties who can handle VPC, as companies cannot manage this entirely on their own.

Executives suggest that a token-based solution could be safer than having parents share their IDs with multiple companies. They also warn that without age-appropriate advertising, children might receive inappropriate ads, such as those for adult hygiene products.

Executives from various companies stress that resolving issues related to verifiable parental consent, behavioural monitoring and tracking, and targeted advertisements is crucial.

These challenges represent the most significant problems with the DPDP Act. Addressing these concerns will help mitigate the impact on product changes, revenue, and user growth for social media platforms.