Online platforms may be required to delete data of users inactive for 3 years

At least 25 rules have to be formulated to operationalise the Act notified in August and the government has also been empowered to enact rules for any provision that it deems fit.

One of them is developing a consent framework to verify a child’s age before they can use an online service. The Act states that companies will need to gather “verifiable parental consent” for letting anyone under 18 years access their platform. This has been a major sticking point for the industry since the Act itself does not suggest ways in which platforms can perform age-gating.

The rules, it is learnt, are expected to recommend two methods. One is to use a digital locker system backed by a government ID like Aadhaar, this paper had earlier reported. The other is for the industry to create an electronic token system which will be allowed only if the government authorises it. Some entities can be exempted from obtaining verifiable parental consent and age gating requirements including healthcare and educational institutions.

It is also understood some entities can be exempted from the norms on a restricted basis, that is, depending on the specific purpose for which they need to process a child’s data.