Meta preps compliance with India’s privacy law, but has child safety concerns

Speaking with Mint, Rob Sherman, vice-president of policy and deputy chief privacy officer at Meta, said that the company does not expect its India operations to be hindered due to the upcoming law.

Also Read | Zuckerberg tries to enlist Trump in fight against Meta EU ruling

“There are unique requirements in different laws around the world. We’ve built an internal process called regulatory readiness, which internalizes laws to make choices and differences to our products globally. In this case, the DPDP Act will require a specific consent experience that we’re building for India. It’s a complex process, but differentiates the way one platform works differently across various regions,” Sherman said.

As part of this effort, Sherman said that the current definition of protection of the online behaviour of underage users “is a gap that is important to fill”.

Also Read | Meta’s AI-powered Ray-Bans are life-enhancing for the blind

“In theory this makes good sense, but in reality there are ambiguities. For instance, we have systems that monitor for abusive activity, or identify people intending to harm themselves. These things look at people’s behaviour, and while we share India’s goal of keeping people safe online, this bit has not been anticipated by the law,” he added.

On 5 March, Mint reported that Meta had submitted its feedback to the rules that will enforce the DPDP Act, 2023. As part of its feedback, Meta had raised concerns with Ministry of Electronics and Information Technology (Meity) around blanket restrictions in tracking the internet usage of users.

Also Read | Microsoft, Meta talk up their big AI ambitions and spending plans

At the time, a senior government official with direct knowledge of the matter had said that the Meity is evaluating the feedback, and a period of “two to three months” was anticipated before the law was enforced.

Compliance for the law can be “meaningful and complex,” said Sherman, who has been a part of Meta’s representation to consultations on the law by Meity over the years.

“There are significant areas of the DPDP Act that will have to be interpreted in its Rules. This will impact whether things are achievable. Beyond underage user tracking and profiling, there are many other key areas of compliance—for instance, the process of age verification has remained an open question. Each area has a dedicated global team within our ‘regulatory readiness’ unit, which is working on making our apps compliant with India,” Sherman added.

Lawyers and policy experts in India have largely agreed with Meta’s assessment of the law. Dhruv Garg, partner at public policy think-tank India Governance and Policy Project (I-Gap), said, “The blanket definition of behaviour tracking’s ‘detrimental effect on the well-being of a child’ statement, under Section 9(2) of the DPDP Act, 2023, lacks clarity.”

Beyond this, Sherman further said, Meta continues to “have discussions with the government detailing the compliance plan to address specific areas of the law.”

“This helps us develop a compliance plan, which will develop over a period of many months. Areas such as data localization and verifiable consent have a high amount of variability. But India’s approach is aligned with what’s emerging as a global consensus—based on voluntary disclosure of age and applying subsequently requisite protections. We have further levels of challenges that we enforce across geographies if we suspect anyone to be misleading about their age, but the basic structure is already in place,” he said.

The executive also underlined that privacy regulations may not work as a template to enforce copyright checks and queries in artificial intelligence (AI) models, such as Meta’s own ‘Llama’ family.

“We’re building one set of models for global usage, so unlike our platforms, we don’t quite have the luxury of saying that the experience of using Llama in India could be different from another country. On this note, we’re optimistic about the global AI partnerships and summits, and the collaborative work that governments have started doing. This bodes well for us,” Sherman said.

India currently does not have a law governing AI. While a previous set of proposed regulations had suggested an approach to impose guardrails preventing cases of harm and bias in AI models, a senior government official said that India has “enough existing regulations” to handle such cases—and a dedicated law for AI is “not imminent.”

“It’s important to not over-regulate technology. We’re first going to see how the DPDP Act is complied with by most technology companies including Big Tech, and in the long run, assess what we further need,” the official said—in line with Sherman and Meta’s expectations of technology policy in India.