Data processing systems for validating authorization for personal data collection, storage, and processing

Abstract

In particular embodiments, a data processing consent management system may be configured to utilize one or more age verification techniques to at least partially authenticate the data subject's ability to provide valid consent (e.g., under one or more prevailing legal requirements) in order to collect, store, and or process the subject's personal data. For example, according to one or more particular legal or industry requirements, an individual (e.g., data subject) may need to be at least a particular age (e.g., an age of majority, an adult, over 18, over 21, over 13, or any other suitable age) in order to provide valid consent. Data processing systems may generate and store one or more consent records memorializing valid consent for data processing from data subjects in response to confirming that the data subject is old enough to provide such consent.

What is claimed is: 
     
         1 . A method comprising:
 responsive to a request to initiate a transaction between an entity and a data subject, generating, by computing hardware, a consent receipt set comprising a consent receipt identifier, a transaction identifier based on the transaction, and a subject identifier based on the data subject;   prompting, by the computing hardware, the data subject to provide a at least one piece of data;   receiving, by the computing hardware, the at least one piece of data from the data subject;   data subject;   using, by the computing hardware, the at least one piece of data to determine whether the data subject meets one or more age criteria for processing personal data under the transaction; and   in response to determining the data subject does not meet the one or more age criteria for the processing of personal data under the transaction, modifying, by the computing hardware, the consent receipt set to prevent a computing system from providing the data subject with access to functionality requiring valid consent.   
     
     
         2 . The method of  claim 1 , wherein the at least one piece of data comprises at least one of:
 a response to a challenge question;   an image of the data subject; or   a piece of identifying information associated with the data subject.   
     
     
         3 . The method of  claim 1 , wherein:
 prompting the data subject to provide the at least one piece of data comprises generating a challenge question and prompting the data subject for a response to the challenge question;   receiving the at least one piece of data comprises receiving the response; and   using the at least one piece of data to determine whether the data subject meets the one or more age criteria comprises determining an accuracy of the response.   
     
     
         4 . The method of  claim 3 , wherein generating the challenge question comprises customizing the challenge question based on the data subject. 
     
     
         5 . The method of  claim 1 , further comprising:
 responsive to determining the data subject does not meet the one or more age criteria for the processing of personal data under the transaction, identifying, by the computing hardware, a guardian associated with the data subject;   receiving, by the computing hardware, valid consent from the guardian to the processing of the personal data as part of the transaction;   responsive to receiving the valid consent from the guardian, modifying, by the computing hardware, the consent receipt set to allow the computing system to provide the data subject with access to functionality requiring the valid consent.   
     
     
         6 . The method of  claim 1 , wherein:
 the at least one piece of data comprises an image of the data subject;   using the at least one piece of data to determine whether the data subject meets the one or more age criteria comprises:
 causing an artificial intelligence image system to generate a prediction usable for determining the age of the data subject by providing the image of the data subject to the artificial intelligence image system for analysis; 
 receiving, from the artificial intelligence image system, the prediction; and 
 determining, based on the prediction, whether the data subject meets the one or more age criteria. 
   
     
     
         7 . A system comprising:
 a non-transitory computer-readable medium storing instructions; and   processing hardware communicatively coupled to the non-transitory computer-readable medium, wherein the processing hardware is configured to execute the instructions and thereby perform operations comprising:
 receiving, from a computing device, a request to initiate a transaction, the request comprising a transaction parameter and a consent parameter indicating consent by a data subject to processing of personal data received via a computer network; 
 configuring a graphical user interface including a prompt soliciting a response to a challenge question and an input element configured to receive the response; 
 transmitting an instruction to the computing device to display the graphical user interface; 
 receiving, from the computing device via the input element, the response; 
 determining that the data subject does not meet an age criterion for the processing of the personal data under the transaction based on an accuracy of the response; 
 responsive to determining that the data subject does not meet the age criterion, modifying the consent parameter to reflect an invalid consent status for the transaction; 
 generating a consent receipt set indicating a lack of consent to the processing of the personal data, wherein the consent receipt set comprises a consent receipt identifier, a transaction identifier based on the transaction parameter, the invalid consent status, and a subject identifier based on the data subject parameter; and 
 preventing access by the computing device to computer-specific functionality requiring valid consent based on the invalid consent status. 
   
     
     
         8 . The system of  claim 7 , wherein the challenge question comprises at least one of a logic problem, a math problem, and a reading comprehension problem. 
     
     
         9 . The system of  claim 8 , wherein the operations further comprise generating the challenge question by at least one of randomly selecting the challenge question or selecting a particular challenge question for the data subject. 
     
     
         10 . The system of  claim 7 , wherein the operations further comprise:
 responsive to determining that the data subject does not meet the age criterion, identifying a guardian associated with the data subject;   receiving the valid consent from the guardian to the processing of the personal data as part of the transaction;   modifying the consent parameter to reflect the valid consent from the guardian; and   initiating the transaction based on the consent receipt set, wherein initiating the transaction enables access to the computer-specific functionality by the computing device.   
     
     
         11 . The system of  claim 10 , wherein identifying the guardian associated with the data subject comprises:
 identifying a prior transaction involving the data subject based on the data subject parameter;   determining an individual that provided consent on behalf of the data subject for the prior transaction; and   identifying the guardian as the individual.   
     
     
         12 . The system of  claim 10 , wherein identifying the guardian associated with the data subject comprises accessing an electronic guardian registry and identifying the guardian in the electronic guardian registry based on the data subject parameter. 
     
     
         13 . The system of  claim 7 , wherein the operations further comprise:
 initiating electronic communication with the guardian; and   modifying the consent parameter based on the electronic communication.   
     
     
         14 . The system of  claim 13 , wherein:
 the electronic communication comprises a unique code; and   receiving the valid consent from the guardian comprises receiving the unique code from the computing device.   
     
     
         15 . A non-transitory computer-readable medium storing computer-executable instructions that, when executed by processing hardware, configure the processing hardware to perform operations comprising:
 responsive to a request to initiate a transaction between an entity and a data subject, generating a consent receipt set comprising a consent receipt identifier, a transaction identifier based on the transaction, and a subject identifier based on the data subject;   prompting the data subject to provide a at least one piece of data;   receiving the at least one piece of data from the data subject; data subject;   determining, based on the at least one piece of data, whether the data subject meets one or more age criteria for processing personal data under the transaction; and   in response to determining the data subject does not meet the one or more age criteria for the processing of personal data under the transaction, modifying the consent receipt set to prevent a computing system from providing the data subject with access to functionality requiring valid consent.   
     
     
         16 . The non-transitory computer-readable medium of  claim 15 , wherein the at least one piece of data comprises at least one of:
 a response to a challenge question;   an image of the data subject;   a selection of a plurality selectable objects; or   a piece of identifying information associated with the data subject.   
     
     
         17 . The non-transitory computer-readable medium of  claim 15 , wherein:
 prompting the data subject to provide the at least one piece of data comprises generating a challenge question and prompting the data subject for a response to the challenge question;   receiving the at least one piece of data comprises receiving the response; and   determining whether the data subject meets the one or more age criteria comprises determining an accuracy of the response.   
     
     
         18 . The non-transitory computer-readable medium of  claim 15 , the operations further comprising:
 responsive to determining the data subject does not meet the one or more age criteria for the processing of personal data under the transaction, identifying a guardian associated with the data subject;   receiving, by the computing hardware, valid consent from the guardian to the processing of the personal data as part of the transaction;   responsive to receiving the valid consent from the guardian, modifying, by the computing hardware, the consent receipt set to allow the computing system to provide the data subject with access to functionality requiring the valid consent.   
     
     
         19 . The non-transitory computer-readable medium of  claim 18 , wherein identifying the guardian associated with the data subject comprises at least one of:
 identifying a prior transaction involving the data subject based on the data subject parameter, determining an individual that provided consent on behalf of the data subject for the prior transaction, and identifying the guardian as the individual; or accessing an electronic guardian registry and identifying the guardian in the electronic guardian registry based on the data subject parameter.   
     
     
         20 . The non-transitory computer-readable medium of  claim 15 , wherein:
 the at least one piece of data comprises an image of the data subject;   determining whether the data subject meets the one or more age criteria comprises:
 causing an artificial intelligence image system to generate a prediction usable for determining the age of the data subject by providing the image of the data subject to the artificial intelligence image system for analysis; 
 receiving, from the artificial intelligence image system, the prediction; and 
 determining, based on the prediction, whether the data subject meets the one or more age criteria.