Obligation
Verifiable consent is the parental or guardian consent a Data Fiduciary must obtain, in a verifiable way, before processing a child's or protected person's data.
The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.
For children and for persons with disability who have a lawful guardian, ordinary consent is not enough. The fiduciary must obtain verifiable consent from the parent or guardian.
The Rules set out how that verification must work in practice, so a service cannot simply take a self-declared age at face value.
Before a gaming app processes a 12-year-old's data, it must obtain and verify a parent's consent.
Whose consent is needed for a child?
The parent's, or the lawful guardian's, obtained in a verifiable manner.
Does self-declared age satisfy the Act?
No. The consent must be verifiable, as prescribed in the Rules.