Examining the Scope of Behaviour Tracking and Targeted Advertisement of Children and Suggesting an Optimum Regulatory Approach

Background and Context

In August 2023, the Indian government enacted the Digital Personal Data Protection Act, 2023, aimed at safeguarding individuals’ digital personal data. Section 9 of the Act deals with the processing of personal data of children under 18 by data fiduciaries, mandating that they refrain from processing data likely to affect the well-being of children and further prohibiting tracking, behavioural monitoring, and targeted advertising directed at children. However, ambiguities in the Act raise concerns about the extent of the restrictions on advertising.

A complete ban on behavioural monitoring could significantly impact essential internet services like personalised content recommendations, adaptive learning platforms, and real-time content filtering. Broad prohibitions may also unintentionally hinder platforms from using data-driven tools to minimise harmful content exposure, prevent online predatory behaviour, address fraud, and improve grievance redressed mechanisms.

However, it also raises ethical and privacy concerns, including potential misuse of data, self-censorship, anxiety, and risks of data breaches impacting children’s digital footprint. Further, the lack of clarity surrounding targeted advertising under sub-section 9(3) necessitates a closer examination of its scope and associated risks.
To address these challenges, CUTS is undertaking a project to assess the scope of sub-section 9(3) across various sectors, focusing on children’s behavioural tracking and targeted advertising.

The project aims to examine how children’s online behavioural monitoring and targeted advertisements are conducted, their role in essential internet services, potential impacts of these services and/or their prohibition, and necessary safeguards to protect children’s privacy, data security, and well-being.