Context

Aadhaar-based age tokens can solve privacy problem as per experts.

What is Section 9 of Digital Personal Data Protection (DPDP) Act, 2023?

• About: Section 9  imposes an obligation on all data fiduciaries to obtain a parent’s verifiable consent before they process the personal data of a child. 
• Confirmation by Businesses: Before collecting any personal data, businesses will have to ascertain whether the person to whom it relates is a child or not.

Enroll now for UPSC Online Course

Issues with Section 9 of Digital Personal Data Protection (DPDP) Act, 2023

• Verification of Age of Every person: Data fiduciaries will have to verify the age of every person they interact with.
  • In an entirely online world, there is no way to do this without introducing friction and exposing more personal information than is advisable.
• Targeting With Algorithms: Data businesses will get an excuse to legally collect information on us that can, better than anything else, uniquely target us with their algorithms.

Solutions to Protect Privacy

• Zero-knowledge proofs (ZKPs): The use zero-knowledge proofs (ZKPs), which are cryptographic computational techniques that mathematically confirm a given fact without disclosing the personal information will have to be used
• Generating Zero Knowledge Proofs: It will take is for us to generate a digital token that, when processed using a ZKP, will confirm that the person is above the prescribed age without sharing any other personal information
• Protection through Aadhar: The Unique Identification Authority of India (UIDAI) will generate a token for each Aadhaar-holder that could, when passed through a suitable ZKP system, confirm whether or not the possessor of that token is above the prescribed age.