Worries of Social Media Cos as Data Protection rules come into force

In August 2024, Digital Personal Data Protection Act was given the assent of the president and was notified in the gazette of india. This act has become a major point of stress to the social media cos in India. The biggest area of concern is that the new act prohibits undoing variable tracking, Verifiable Parental consent and targeted advertisement. Section 9 of the DPDP act disallows behavioural tracking of children which the cos say will have an impact on the effectiveness of their safety features.

“We had made an unequivocal representation to Meity that a wholesale ban on behavioural tracking is counterproductive to the government’s own objectives. We have made that case to the government repeatedly. The caveat for exemptions however leaves room for advocacy,” the official said. They gave the example of the monitoring and tracking e-privacy directive in the European Union which had a similar provision.As part of compliance, companies had to suspend a range of classifiers on the platform and the regulator there had been updated of these suspensions.To which the the regulator said that we will make an exception to let social media cos initiate their classifiers. 

However, the Act gives the government the ability to either exempt certain data fiduciaries or to exempt certain types of data processes from undoing behavioural tracking and this has made companies hopeful.“In future, even after the notification of the rules, it is possible for the government to introduce such exemptions. If not, the safety features will have to be turned off, which happened briefly in Europe,” social media cos said.

Another major issue as mentioned is parental control which is made compulsory as per a clause of Section 9 of DPDP act.  It mentions the need of taking parental consent before processing and collecting child’s data. Companies are at loggerheads on arriving at a mechanism to take this permission and are hoping that the Rules would provide more clarity on the same.They are expecting the government to identify third parties who can do VPC as companies can’t do it completely on their own.

“In the Rules, the government must tell us who those third parties are going to be. Once that is done, we will work closely with those third parties to comply,” the executives from the second company said.