Curbs on tracking minors’ data may hurt tech giants

MUMBAI: Technology behemoths such as Google, YouTube, Facebook, Instagram and Snapchat, which have a large following among teenagers in India, are likely to be hit if Justice Srikrishna Committee’s recommendations to curb data tracking of and advertising targeted at users under the age of 18 are accepted.

The draft data privacy law submitted by the panel calls for severe restrictions on guardian data fiduciaries — companies that operate commercial websites or online services directed at children or process large volumes of personal data of children. It suggests barring such companies from profiling and tracking of children, carrying out their behavioural monitoring or targeting them with advertisements, and undertaking any other processing of personal data that can cause significant harm to them.

Apart from the social media and technology giants, education tech companies like Bengaluru based Byju’s that provides online coaching services to children and gaming firms may also face restrictions if the recommendations are accepted.

“The justification for such differential treatment arises from the recognition that children are unable to fully understand the consequences of their actions,” the panel said in its report.

Need For Parental Consent
“This is only exacerbated in the digital world, where data collection and processing is largely opaque and mired in complex consent forms,” the panel said in its report submitted to the government on Friday.

Though some of the websites and apps allow children to sign up if they are 13 years of age or older, their consent to the terms and conditions isn’t valid under India’s laws.

Under the Indian Contract Act 1872, a minor cannot enter into a contract — this would mean that they could not have consented to the terms and conditions of usage of websites and apps. The Srikrishna panel is recommending enforcement of this.

Google, Facebook, Instagram and Byju’s were not immediately available for comment.

“Since companies targeting children can’t profile such children, track behavioural data and send targeted advertising the companies are dependent on, revenues maybe hit,” said Kartik Maheshwari, leader for technology companies at law firm Nishith Desai Associates.

graph

“I see a possible shift in business models from an advertisement-dependent model to a subscription or even freemium model.”

The draft law requires companies to set up age-verification mechanisms and get parental consent of users under the age of 18 to process data. Some experts think it may lead to higher compliance costs but is astep in the right direction.

“The provisions on child’s consent will require companies to be more careful than they might currently be while handling data of children. While it’s not possible to make exact predictions at this time, it seems likely that operationalising the Bill’s provisions on child’s consent will raise compliance costs for companies,” said Nehaa Chaudhari, public policy lead at law firm TRA.

In the US, the Children’s Online Privacy Protection Act is applicable for those under the age of 13 — this is what the social media majors currently follow in India, too. The European Union’s General Data Protection Regulation (GDPR) has set the age limit for parental consent at 16.

“Children are more vulnerable than adults, so longer the protection, the better. Everyone is interested in the generation that is coming, not the generation that has gone by. Everything that is popular today was once popular with teenagers. Companies would want a lower age, obviously,” said Mishi Choudhary, legal director at the Software Freedom Law Center in New York and managing partner of Mishi Choudhary & Associates in India.

It is important to note that children constitute a large constituency of users of the Internet — about a third of the total Internet users globally. In India, the potential is even bigger as 40% of India’s population is below the age of 18, according to the latest census.

“The fast-paced changes in our digital environment and open access to social media have led to the emergence of the new-age, digitally savvy citizen — more importantly, children and teenagers,” said Jaspreet Singh, partner-cyber security at global consultancy EY. “While this (proposed law) may indicate a surge in compliance costs for organisations, it will act as a positive step in the long term.”