Verifiable Consent

Verifiable consent is a method of obtaining permission for data processing that includes additional steps to confirm the identity and authority of the person giving consent. It is typically used in the context of children's data protection, requiring the data controller to make a reasonable effort, taking into consideration available technology, to ensure that the consent is authorized by a holder of parental responsibility.

Verifiable consent is required when an organization intends to process the personal data of a child (usually defined as an individual under a specific statutory age, such as 18) or a person with a disability who has a lawful guardian. Privacy regulations mandate this higher threshold to ensure that minors do not unknowingly share sensitive information without adult supervision.

Consent can be verified using various technical measures. Common methods include checking a government-issued form of identification against a database, verifying a credit or debit card transaction, using video conferencing technology to match a face to an ID, or utilizing digital identity tokens and public key infrastructure to validate a digital signature.

Acceptable methods for verifiable parental consent include receiving a signed consent form (eg, via mail or secure electronic signature), verifying a small monetary transaction using a payment card or banking mechanism, using a verified government or third-party identity service, or completing a live video/phone check with trained personnel. The method should be chosen using a risk-based approach and documented so the organization can demonstrate how it confirmed the adult's authority. In WatchDog Security, the Secure File Sharing module can help teams collect signed consent forms or guardian verification artifacts using encrypted, expiring links with role-based access and immutable audit logs for defensible proof of consent.

Generally, a simple email confirmation (or 'email plus') is not considered sufficient for high-risk processing or strictly verifiable consent because it is easily forged by a child. However, some frameworks may allow a 'plus' method where an email is followed by a secondary confirmation step, though robust identity verification (like ID checks) is preferred for full compliance.

No, verifiable consent requirements typically apply only to specific protected categories of data subjects, most notably children. For general adult users, standard consent mechanisms (like clicking 'I Agree' after reviewing a notice) are usually sufficient, provided they meet the criteria of being free, specific, informed, and unambiguous.

If the data controller cannot obtain verifiable consent, they are generally prohibited from processing the child's personal data. Any contact information collected for the purpose of seeking consent must be deleted within a reasonable timeframe if verification fails, to ensure lawful processing and avoid regulatory penalties.

Verification records, or the consent receipt, should be kept for as long as the processing activity continues and for a statutory period thereafter to demonstrate compliance (accountability). However, the specific data used for verification (like a copy of a driver's license) is often required to be deleted immediately after the verification is successfully completed to adhere to data minimization principles.