Social media companies list the concerns as government readies data protection law

Social media intermediaries have highlighted the undoing behavioural tracking of children, verifiable parental consent (VPC) and targeted advertisements as the biggest concerns with the data law.     

The Rules for the Digital Personal Data Protection (DPDP) Act, which will fortify the enforcement of the law, are anticipated soon. Companies are hopeful that the government will address their concerns.   

Section 9 of the DPDP Act, which was notified in the Gazette in August last year, does not allow behavioural tracking of children on digital platforms.

This bars the companies from keeping track of a child’s activity online which in turn has an impact on the effectiveness of their safety features.

As per a social media intermediary’s, “There are some signals we must pick up of our users, of adults and children, to inform the effectiveness of our safety features.”

“We’re working with the ministry of electronics and information technology (MeitY) and other stakeholders to figure out a pragmatic, balanced approach to ensure privacy and safety of teenagers. We should be able to do as platforms do, the things that protect young users,” the executive said.

In order to protect teenagers’ from predatory behaviour and paedophiles, the social media companies track their behaviours.  

“We had made an unequivocal representation to Meity that a wholesale ban on behavioural tracking is counterproductive to the government’s own objectives. We have made that case to the government repeatedly. The caveat for exemptions however leaves room for advocacy,” the official said.

Another social media intermediary’s executives told a news souce, “Turning off behavioural tracking compromises safety, integrity, and security for children on the platform.”

Companies had to suspend a range of classifiers on the platform in order to comply with the compliance. The companies also notified the regulator regarding the suspensions.  

In response, the regulator provided an exception for companies to reinitiate the classifiers.

“The unintended consequence for not having an exemption for security remains of very high concern. It is important for us and any other platform to prevent predators and unrelated adults from approaching and communicating with children,” the executives said.

However, the Act allows the government to either exempt certain data fiduciaries or to exempt certain types of data processes from undoing behavioural tracking and this has made companies hopeful.

Another clause of Section 9 requires companies to obtain permission from parents before processing a child’s data.  

Companies are at loggerheads on arriving at a mechanism to take this permission and are hoping that the Rules would provide more clarity on the same.

The companies looking forwards to the government to identify third parties who can do VPC. The companies are not able to do it completely on their own.

“In the Rules, the government must tell us who those third parties are going to be. Once that is done, we will work closely with those third parties to comply,” the executives from the second company said.

Many respected policy experts have suggested that a token-based solution would be safer than requiring parents to share their IDs with multiple companies, they said.

“Also, if it is not possible for us to provide age-appropriate advertising, several dangers emerge like children getting inappropriate ads like that for adult diapers or hygiene products which are not right for kids,” executives said.

“In our stack rank of problems with the law, the biggest problem is section 9 of the DPDP Act on verifiable parental consent, behavioural monitoring and tracking, and targeted advertisements. These are important issues,” executives from the first company said.

“In our stack rank of problems with the law, the biggest problem is section 9 of the DPDP Act on verifiable parental consent, behavioural monitoring and tracking, and targeted advertisements. These are important issues,” executives from the first company said.

“If these three are resolved, there won’t be as much consternation. The P0 (Priority 0) impact to our company in the form of product changes, revenue and user growth is verifiable parental consent, and behavioural monitoring and tracking,” they added.