The rules have spelled out a mechanism for obtaining explicit consent from individuals and mandate parental consent for children to use their data in any form.