Instagram has announced that it will start asking new users for their date of birth. Their reasoning is that this will allow them to help keep younger people safer on the site. Commentators have pointed out that this will also allow them to avoid targeting age-related advertising such as alcohol, to younger users. The implicit criticism here is that at present they have to be very cautious about the deployment of such Ads because they don’t know who their younger users are. It has also been pointed out that people might not tell the truth (shock horror), so they’re not really any better off.
However, I think there is another issue in relation to their data protection responsibilities under GDPR. Is this really data minimisation? Do they actually need date of birth? Surely they just need an age or more accurately an age category -under 18; 18-25; over 25 for example. This would allow them to achieve the stated aim of supporting young people and the delivery of age appropriate adverts, without the intrusion of the full date of birth. It might also be easier to create a test that has a reasonable chance of catching people trying to claim membership of an age group they don’t belong to. Questions about “The Monkeys” anyone?
Whether it is more effective at categorising or not, at least you are still not over-collecting personal data. But then maybe that wasn’t the point?
"Asking for this information will help prevent underage people from joining Instagram, help us keep young people safer and enable more age-appropriate experiences overall," the company said in a blog post. "We will use the birthday information you share with us to create more tailored experiences, such as education around account controls and recommended privacy settings for young people."