Your go-to hub for Expert Insights,
Publications, and Resources on
data privacy and compliance

Teenagers are naturally curious and eager to try new things. However, letting them have unsupervised screen time can sometimes lead them to explore websites and content which are not age-appropriate.

To address this, there are two main methods used to confirm a user's age online:

·       Age Verification

·       Age Gating

Age Gating often isn't very effective because it's easy for kids to bypass. Many underage users simply lie about their age or use fake birth dates to access things like alcohol in online stores. Given the strict regulations around personal data privacy, companies need to implement stricter age verification measures.

Let's explore what age gating and age verification are, and how they can help to enhance personal data protection on the internet for minors.

What is Age Gating?

Age gating is a basic practice in managing access to age appropriate digital content. It's like having a bouncer at a club checking IDs to ensure everyone is old enough to enter.

This method uses a barrier or gate, such as a page or pop-up, that asks visitors to confirm they are of legal age to use the site's products or services before they proceed. The main goal is to prevent children from accessing or interacting with content that isn’t age appropriate.

Common Industries That Use Age Gating

Age gates are commonly used in industries that offer age-sensitive products or services. It acts as a first line of defence to prevent underage access.

This includes content like:

·       Pornography

·       Alcohol

·       Tobacco products, vaping, and e-cigarettes

·       Cannabis

·       Gaming

·       Age-rated video games

·       Firearms

Types of Age Gating

1. Self Reporting

In this method, users enter their age and confirm their date of birth voluntarily. It's a weak system that relies on users being honest. Many reports show that self-reporting is easy to bypass and isn't reliable for sensitive cases.

2. Parental Consent

This method ensures that minors trying to access adult websites or platforms can't bypass the age-gating filter. When a user attempts to access such a site, a pop-up or screen appears asking for parental consent and approval.

Here's how it works:

• A user signs up, stating their age as 13 or above.
• The site then requests parental consent via an online form filled out by a parent, including details like contact number, email, or social media profile for digital identity verification.
• After verification and confirmation, the account is created but regularly monitored for suspicious activity.

However, this method has loopholes, such as the inability to ensure the form is filled out by an actual parent rather than a friend with a fake account.

To address these weaknesses, age verification is often preferred over age gating.

What is age verification?

An age verification system takes things a step further than age gating by requiring proof of identity to confirm a visitor's age. This can involve:

• Scanning a valid ID document
• Using facial recognition to match selfies with ID photos
• Cross-referencing ID data with third-party sources like government databases

While less secure methods only use data cross-referencing, top-tier solutions combine this with stronger methods like photo ID checks and live selfie verification.

Age Verification Methods

1.     Self Declaration

This involves users providing their age or date of birth voluntarily. Common on social media platforms, it relies heavily on user honesty and lacks ways to verify the accuracy.

2.    Credit Card Analysis

This method uses credit card information, assuming that owning a credit card means the user is of legal age.

3.   Data base Scrutiny

This approach involves checking against verified databases like voter registers and utility providers.

Document Authentication

Users provide identification documents for careful examination, often paired with biometric checks to confirm identity.

4.   Facial Biometric

This method uses selfie verification to assess age, offering a secure and privacy-focused approach without needing personal information.

Advantages of Age Verification Over Age Gates

5.   Protecting Minors

Age verification offers stronger protection for minors. Its advanced algorithms can quickly spot fake or forged identities. In contrast, age gates don't verify a user’s age and rely only on self-reported data. This makes it easy for minors to bypass by lying about their age or using a fake birth date.

6.   Regulatory Compliance

Age verification is essential for complying with national regulations and helps businesses avoid legal issues and fines. An age gate often doesn't meet the minimum regulatory standards. The DPDP Act recommends stricter age verification than what age gates provide.

7.    Maintaining brand reputation

Age gating often gets criticized for its security flaws. A weak age-gating system can make people question a brand’s commitment to online safety and privacy. In contrast, using strong age verification methods shows that your brand is serious about protecting minors and meeting regulatory requirements.

8.   Requirement for Sensitive Industries

For industries dealing with highly regulated or sensitive content like alcohol, tobacco, and adult entertainment, age gating isn't enough. In these cases, strict digital identity verification tools offer much stronger protection.

9.   Accurate Data Collection

Age gating doesn't provide the verified demographic data that more advanced age verification solutions do. This data can be crucial for businesses to understand and serve their target audience better. Strong digital identity verification methods give a reliable confirmation of a person’s identity and age, leading to more accurate demographic insights.

Age Verification vs Age Gating

Age Gating Under the DPDP Act

The Digital Personal Data Protection Act 2023 (DPDPA 2023) sets rules for handling digital personal data in India. Section 9 focuses on processing children’s data, defining a ‘child’ as anyone under 18. It introduces strict guidelines on how to collect, use, and protect children's personal data to ensure their privacy and safety.

Key requirements for handling children’s data include:

• Getting verifiable consent from a parent or guardian before processing any child’s personal data.
• Avoiding any data processing that could harm a child's well-being.
• Not tracking, monitoring, or targeting children with ads.

What this really means is that every platform will need to have age verification systems in place. Without them, you won’t be able to properly record users' verifiable consent.

Issues with Existing Age Verification Solutions

Many earlier methods, like using Aadhaar, Digi-Locker, or one-time electronic tokens to verify children’s ages and confirm consent from guardians, have been deemed unfeasible.

For instance, with Aadhaar, the main problem is proving the relationship between a child and their parent. Often, the data doesn’t reflect recent changes, like a new address or the death of a parent, which creates issues.

Solutions like Digi-Locker or one-time tokens don’t keep up well with rapid technological changes, especially for age verification on social media and communication platforms.

Collaborating with Big Tech Companies

The government is considering letting social media platforms and other online services create their methods for age restriction and obtaining verifiable parental consent. These company-developed solutions could be used alongside government-prescribed methods to ensure businesses can continue operating smoothly.

Senior officials from the Ministry of Electronics and Information Technology recently met with executives from major tech firms, startups, and industry associations to discuss how to accurately verify the age of users under 18 and secure proper parental consent as required by the DPDP Act.

They agreed that a uniform approach wouldn’t work for everyone. Companies were asked to propose the best strategies for their specific needs.

Companies like Meta suggest that the most effective way to manage age verification and consent is through app-store-level verification of users.

Protecting Children's Data Privacy with Age Verification and DPDP Act Compliance

While age gating is a basic way to limit access based on age, the future of online safety and compliance lies in using robust age verification systems. These systems provide greater reliability, meet strict legal standards, build user trust, and help prevent fraud.

Over the next few months, we'll see new rules and regulations under the DPDP being developed and rolled out in phases. It will be interesting to watch how the age-gating requirements of the DPDP are implemented and what measures will be put in place to ensure compliance.

In the meantime, to make online spaces safer for minors, organizations should improve data security, frequently review their practices, and educate both children and their guardians about their rights under the DPDPA.

DPDP Consultants offers a complete range of tools and services to help you manage the complexities of personal data protection compliance.

• The DPDPA Readiness Review helps organisations assess the DPDPA's impact on all aspects of their operations.
• The Data Protection Consent Management (DPCM) tool, offered as a SAAS model, ensures valid consent, automating personal data consent requests and establishing a robust system for tracking and handling such requests within companies.
• For existing contracts, the Contract Review service ensures alignment with DPDP specifications, necessitating revisions when necessary.
• Their dedicated team provides comprehensive DPDPA Compliance Assistance, establishing internal audit frameworks for regulatory alignment.
• They assist in conducting DPIAs to assess and mitigate risks in data processing. Their Data Protection Impact Assessment (DPIA) tool automates the process, allowing concerned individuals/DPOs to conduct DPIAs through a user-friendly platform. It tracks identified risks and ensures all concerned are informed about mitigation progress.
• The Data Principal Grievance Redressal (DPGR) tool enables data principals to raise their rights through a user-friendly platform, accessed manually or automatically by Data Protection Officers/concerned persons. This reduces response time and ensures compliance.
• They offer a training program to educate staff on the new regulation, ensuring DPDP Act compliance. Their Data Protection Awareness Program (DPAP) enables regular and mandatory awareness sessions, followed by assessments, ensuring every employee understands the DPDP Act and the repercussions of non-compliance.

Learn More About Children's Privacy with DPDP Consultants!

Ensuring the privacy of children's data under DPDPA requires diligence, but with the right approach and resources, it is possible. Let DPDP Consultants assist you every step of the way.

For News updates, expert insights, and practical tips on DPDP compliance and personal data security please subscribe to our newsletter Privacy Talks.