1. Verifiable Consent Requirement

• The Data Fiduciary must obtain verifiable consent from the parent of a child before processing the child’s personal data.
• In the case of a person with a disability who has a lawful guardian, similar verifiable consent is implied.

2. Due Diligence by the Data Fiduciary

• The entity must exercise due diligence to ensure that the person claiming to be a parent or guardian is:
  • An adult, and
  • Identifiable, if required, for legal compliance.

3. Methods to Verify Identity and Age

Verification can be done using either of the following:

• (a) Reliable details already available:
  • The Data Fiduciary may use reliable identity and age details already in its possession.
• (b) Voluntarily provided and legally verified details:
  • Details of identity and age or a virtual token mapped to such details,
  • Issued by an entity:
    • Entrusted by law, or
    • Entrusted by the Central/State Government,
    • Or by a person appointed/permitted by such an entity,
  • Examples include:
    • Aadhaar-based verification,
    • Tokens from authorized identity providers,
    • Digital Locker-verified details.

Practical Implications:

• Websites, apps, or services collecting personal data from children (likely below 18 years) or legally incapacitated individuals must:
  • Build systems to collect parental consent.
  • Integrate verification processes using government-issued IDs, Digital Locker, or other validated sources.
  • This is particularly critical for platforms in education, gaming, health, or social media that cater to or collect data from minors.