How Much Parental Consent Verification Costs Under DPDP Act?

Obtaining verifiable parental consent through government-issued IDs can cost platforms $176,471(Rs 1,50,00,000) per 1 million annual verifications on average, according to a Consumer Unity and Trust Society (CUTS) International report. Government ID-based verification can vary from systems that cross-verify birth date to integrated biometric analysis comparing real-time selfies with government ID photographs. The report, titled “Economic Analysis of Verifiable Parental Consent Mechanisms,” looks at the financial considerations in implementing the verification requirements set under the Digital Personal Data Protection Act (DPDP Act, 2023) and the Draft Rules (DPDP Rules) that the government released earlier this year.

The report points out that using DigiLocker for parental consent could cost platforms $35,176 (roughly Rs 29,90,000) per 1 million annual verifications. Besides the costs of these methods, they also have scalability, convenience, and privacy challenges, CUTS argues. Government IDs and DigiLocker both run the risk of exposing other details about the user. Further, there are concerns about obtaining parental consent from users who lack official IDs and also about the limited penetration of Digilocker. Digilocker may also not work as a solution to figuring out relationships in cases where a guardian instead of a parent is giving consent. 

Requirements under India’s data protection regime:

The DPDP Act states that companies have to obtain verifiable parental consent before processing the data of anyone under the age of 18. Further, the rules elaborate that when obtaining parental consent, platforms have to verify the age and identity of the parent. They have two methods of doing so:

• Relying on their existing database if the parent already uses the platform.
• Using a legally authorised entity, a government body, or a virtual token mapped to the voluntarily provided age and identity of the parent, made available by a Digital Locker Service.

Why it matters:

The CUTS report indicates that the financial burden platforms may face when obtaining verifiable parental consent will eventually trickle down to the customer. It could also reduce access to affordable digital services. Further, there is concern that the compliance burden of parental consent requirements could disproportionately affect startups, which run on limited resources. These businesses will have to absorb both implementation costs for parental consent solutions as well as the indirect effects of these solutions on user acquisition and retention.   

Digilocker and its interconnection with Aadhaar:

 The Unique Identification Authority of India (UIDAI) has previously clarified that Aadhaar cannot be used as proof of date of birth. “Many platforms, including DigiLocker, rely heavily on Aadhaar for identity verification and age assurance. The lack of conclusive date-of birth verification through Aadhaar could complicate the age verification process, creating gaps in compliance with age-related regulations,” CUTS argues.

How much will parental consent and age verification cost?

CUTS divides the cost of verifiable parental consent into the following parts—

• Software: The cost of the software depends upon its features and level of security. Basic age assurance solutions tend to have a one-time fee of around $200. However, advanced systems with features like facial recognition or biometric authentication can cost up to $5,000. 
• Application programming interface (API): This acts as a bridge allowing different software systems to communicate with each other. API for parental consent will allow websites or apps to connect with a verified parental consent service. When a child tries to register for a platform, the API sends a request to the consent service which in turn triggers notifications to the parent for consent. Initial API integrations can cost $1000-$5000. One age assurance provider told CUTS that system integration costs for age assurance can be around $10,000.
• Operational costs: These are ongoing expenses that companies need to make to maintain a consent system. This includes subscription costs with monthly fees typically ranging from $50 to $500. For low-cost solutions, these figures range from $50-$100. Besides subscriptions, companies also incur costs in storing the documents needed for obtaining consent, which can come to $213.75-$267.19 per year. Video consent, which takes up more space, can cost between $21,209.06 and $26,494.29 annually.

How do costs vary across methods?

Depending on the method for age verification that platforms employ, costs can drastically vary. The previously mentioned costs of government ID verification and DigiLocker fall in the medium and low ranges, respectively. Costs for the other key consent mechanisms are as follows:

Zero-knowledge proof:

This is a cryptographic approach that verifies the parent’s consent without collecting any personal details. “The output of this process is a hashed value, referred to as a “proof statement,” which serves as verification without disclosing any actual personal details,” CUTS explains. It suggests that the UIDAI could implement an age verification system by generating tokens for Aadhaar holders that verify that they meet age requirements. Hardware costs for zero knowledge proof would be $15,640 including processing power, memory, hardware, and installation expenses. Overall, this method would cost $26,588 (Rs 22,60,000) for a million verifications annually. The cost of developing and implementing such solutions are financial barriers for startups.

Self-declaration: 

These are the tick-boxes platforms require their users to check off whenever someone registers for their services. Some platforms may ask users to enter their date of birth instead of the check box. Self-declaration may not cost platforms much, with average total cost per million verifications annually being $11,167 (Rs 9,76,783) on an average.

CUTS suggests that more truthful reporting platforms can prompt users to re-verify their date of birth later as well, such as when a user logs into a service. In case of discrepancies, a moderator can ask for additional proof of age. The report suggests that self-declaration is suitable for platforms that have low-risk uses.

Age estimation: 

The rules do not clarify how platforms will know who is a child and who is not. They factor in only two situations when discussing verifiable parental consent— when the child declares themselves, and when a parent comes forward to give consent. As such, companies may have to verify the age of all its users to identify which users are under 18. One of the methods they could rely on for this is age estimation. 

Age estimation techniques use people’s behaviour to determine their age. Examples of this include features like facial structure, voice, gait, and keystroke dynamics, which are analysed through facial scanning and behavioural analysis methods. Age estimation requires significant infrastructure investments, including for data collection, storage, and analysis. 

CUTS argues that this solution is viable only for large-scale platforms. On average, age estimation (using artificial intelligence or machine learning) can cost platforms $494,118 (Rs 4,20,00,000) per million verifications per year. The total cost for a normal system, including API integration, average subscription fees of US$500, and per verification cost, would be US$502,418 (Rs 4,39,46,778).

Besides the prohibitive costs, the method also poses privacy concerns because of excessive data collection, surveillance, and the risk that the platform will only identify the underage users after they have already accessed inappropriate content. 

Advertisements

Third-party verification:

In this approach, users submit verification requests to an intermediary service and provide this third party with identity documents (like passport scans) and facial images for initial verification. Then, the system enables verification without the need to submit documents across different platforms. Third-party verification can cost $245,554 (Rs 2,14,78,743) annually per million verifications. Platforms suggest that these costs will decrease as the user base for the third-party verification service grows. 

CUTS suggests that while these solutions give users more control over their identity data, they also reveal more information than necessary to prove age. For instance, a user who uploads their passport scan on a third-party verification service may not know that the service is analysing, or sharing this data. Further, there are challenges with scaling these solutions, “primarily because no integrated API exists across providers”. 

Knowledge-based assessment:

In this method, platforms ask users questions that they can only answer based on personal information or knowledge. “For example, a platform may ask a set of KBA [knowledge-based assessment] questions that pertain to personal information the parent has shared, such as their childhood name or the parent’s own past contact details. This helps confirm that the user is over 18,” CUTS explains.

Software for knowledge-based assessment needs to create personalised questions for each parent, and as such it could cost $800,000 (Rs 6,99,76,440) per year. This cost may decrease significantly when distributed across a wide user base. CUTS also points out that 30% of users struggle with KBA questions, posing operational challenges with this verification method.

Credit card-based verification:

Here, the parent provides the child’s information and then provides consent via credit card. This method can cost US$5,294 (Rs 4,50,000) per million transactions annually. While this method is relatively cheaper for platforms to adopt, using this method could disadvantage those who do not have credit cards.

Video-based verification:

This method would require the parent to create a video statement stating their name and their child’s name (along with a valid ID), adding that they are consenting to the data processing. The cost for a million can vary between $1,294 and $67,059 (Rs 1,10,000 and Rs 57,00,000). This method gives platforms access to personally identifiable information such as facial data, raising privacy concerns. It is also time-intensive, and resource-intensive, limiting feasibility for widespread adoption. 

SMS based verification:

Here, the platform sends an OTP to the parent’s phone to provide consent if the parent is already a user of the platform. The parent must enter this OTP on the platform within 1-2 minutes. This method would cost US$1,941 (Rs 1,65,000) per million verifications annually. Children can easily bypass this by accessing the parent’s phone. CUTS suggests that platforms can bypass this by dual-factor authentication, combining SMS with some other verification method. 

Key recommendations:

CUTS suggests that it is important the rules allow companies to innovate and implement solutions that reduce costs and increase efficiency instead of a one-size-fits-all solution. It also suggests that the government could consider allowing platforms to establish protocols to share consent. This means that if a child wants to sign up for a platform that the parent does not use, the child should be able to direct a platform that the parent uses to obtain their consent.

“This would enable seamless communication between platforms, simplifying verification. Parents would only need to verify once, reducing barriers to digital participation, especially in regions with limited access to government ID services, digital infrastructure, or digital literacy,” CUTS says.

Also read:

Note: An addition was made in the first paragraph at 12:30 PM on March 3rd for more clarity.

Support our journalism:

For You

_{Images are for reference only.Images and contents gathered automatic from google or 3rd party sources.All rights on the images and contents are with their legal original owners.}