Meta’s WhatsApp age-check trial faces challenge from India’s digital ID plans

Meta is testing age confirmation on WhatsApp ahead of India’s Digital Personal Data Protection (DPDP) Act, but draft implementation rules suggest social media platforms may ultimately have to rely on Aadhaar-linked identity infrastructure instead of self-declared age.

India’s law – part of a cascade of global age assurance legislation that has followed Australia’s passage of the Social Media Minimum Age act – does not require platforms like WhatsApp to collect its users’ date of birth. However, since the platform needs to know who’s a child and who’s an adult, age verification is necessary. An analysis by Tech Trace breaks down the legal details, and says that, as far as options for age assurance go, WhatsApp, “for the time being, is resorting to self-declaration where users can easily fib.”

Meta told Bloomberg: “to comply with upcoming laws in India like the Digital Personal Data Protection Act (DPDP), we are testing privacy-protective ways for people to confirm their age.”

“We understand that information about someone’s age is private and it won’t be shared with other WhatsApp users.”

Draft rules point to Aadhaar

With more than 600 million users, India is WhatsApp’s largest market. That means any legal change to regulations in the country is a high-stakes affair. An article in AEI, written by Bronwyn Howell, notes that Meta has been on the Indian government’s bad side over a few recent incidents, including AI deepfakes and the introduction of WhatsApp usernames, which have raised concerns about impersonation and digital fraud.

On the other hand, Howell writes, “India has a significant apparent advantage in identity verification, with its sophisticated biometric identity system, Aadhaar.” The national digital identity system, she says, “enables governments, businesses, and other parties to trust that the person they are transacting with is truly who they claim to be. Basic information about a person is collected, providing multiple channels for authentication using biometrics such as fingerprints and iris scans.”

She points to draft DPDP rules which propose two means of verifying children’s ages on social media platforms: “an Aadhaar-linked DigiLocker system, in which a parent’s Aadhaar credentials are associated with their child’s account so that platforms can send a yes-or-no age query, or an electronic token system in which a government ID is converted into an encrypted credential that shares only name and age.”

Privacy concerns remain

Doing age verification in India, Howell says, “effectively means using the Aadhaar system.” The catch is that comes with privacy issues: “a platform that pings DigiLocker about a user’s age now has a record that it queried India’s national identity infrastructure on behalf of that user, at that time, on that platform. At population scale – 1 billion internet users – that query log is a surveillance database even if no individual Aadhaar number is stored by the platform.”

Meta’s self-declaration trial may ultimately prove insufficient if India’s final DPDP rules require platforms to rely on Aadhaar-linked identity infrastructure or government-backed digital credentials for age verification. As Howell argues, India’s experience may become an important test of whether governments are prepared to rely on state-backed digital identity systems to enforce child online safety despite the privacy tradeoffs they create.

Provisions related to verifiable parental consent are set to come into effect in May 2027.

Article Topics

Aadhaar  |  age verification  |  digital ID  |  Digital Personal Data Protection (DPDP) Act  |  India  |  Meta  |  social media  |  WhatsApp