Internet giants seek extended transition for DPDP Act compliance on children's data

Ministry for Electronics and Information Technology held a consultation meeting on the Digital Personal Data Protection Act on September 20

Social media and major internet companies have asked the government for an extended transition period to ensure compliance with the detailed provisions of the Digital Personal Data Protection (DPDP) Act. This includes additional time for the development of essential features like age gating mechanisms and addressing situations where data fiduciaries have dependencies on third parties. An extended transition period would provide these entities with the necessary time to align their operations with the requirements outlined in the DPDP Act.

The DPDP Act, which was enacted into a law in August, mandates that parental consent is required to process the data of a child. Hence, social media and other firms have to develop age-gating mechanisms where one can verify their age.

Also read: What the Digital Personal Data Protection Act means for you

"We have to keep in mind the technical complexity of actually building out some of the compliances... at the top of the list, that will require the most engineering effort is Section 9 (of the DPDP Act), which has a parental consent requirement," said a Snap representative at a consultation on the DPDP Act held by the Ministry for Electronics and Information Technology (MeitY) on July 20.

A Meta representative during the meeting said that the company does not expect a longer transition period where the obligations of the law are similar to other global laws.

"But where the obligation is unique to India, and wherever the obligation has a dependency on third party and the third party does not have a mature solution...," the Meta representative said while explaining scenarios that would require a longer transition period.

"As we discussed today, the industry would like to have sufficient timelines, so to meet the dual purpose of compliance with the act, and maintaining business continuity," Kumar Deep Banerjee, Country Director, ITI India said in a statement. ITI India represents significant global tech companies.

"Certain provisions regarding verifiable parental consent may need additional extended timelines for compliance. We hope government provides sufficient timelines for industry feedback when it comes out with the draft rules for stakeholder consultation," Banerjee added.

During the consultation meeting, Minister for State in MeitY Rajeev Chandrasekhar informed the audience comprising of industry stakeholders that the government will notify the Data Protection Board and come out with few rules of the DPDP Act in the next 30 days.

While speaking to media persons on the sidelines of the consultation on September 20, Chandrasekhar said that the government expects compliance to most provisions of the DPDP Act within a year, barring provisions such as the age-gating mechanism which would require additional architectural changes.