Aadhaar-based age tokens can solve a privacy problem
Among the more worrisome provisions of India’s new Digital Personal Data Protection (DPDP) Act, 2023, is Section 9 that imposes an obligation on all data fiduciaries to obtain a parent’s verifiable consent before they process the personal data of a child. What this means is that, before collecting any personal data, businesses will have to ascertain whether the person to whom it relates is a child or not. This, if you think about it, is an onerous obligation that will likely have far greater consequences than legislators intended.
In order to know whether or not the personal data they are processing pertains to a child, data fiduciaries will have to verify the age of every person they interact with. In an entirely online world, there is no way to do this without introducing friction and exposing more personal information than is advisable. The best way to assure oneself of the age of the person is by validating it using some form of reliable identity documentation—ideally a document that has been issued by the government.
Which seems to suggests that in order to comply with their obligations under the DPDP Act, online services will have to ask everyone who uses their services to first produce identity documents before they can proceed. This, as you can imagine, will break the internet as we know it. Today, we think nothing of flitting from one website to another by simply clicking on hyperlinks that allow us to navigate wherever our fancy takes us.
Read more on livemint.com
