Children's Data Under the DPDP Act: Age Verification and Parental Consent in Practice

Hero Summary

Under India's Digital Personal Data Protection (DPDP) Act, 2023, a "child" is anyone under eighteen. A data fiduciary must obtain verifiable consent from a parent or lawful guardian before processing a child's personal data, must not process it in a way that is detrimental to the child's well-being, and must not track or monitor a child's behaviour or direct targeted advertising at children. The Government of India's explainer on the DPDP Rules adds that parental consent is required unless the processing relates to essential services such as healthcare, education, or real-time safety. Violations relating to children can attract penalties of up to ₹200 crore.

Executive Summary

Children's data is one of the most heavily protected categories in the DPDP framework, and the age threshold — eighteen — is higher than in many other countries' laws. Any organization with an app, website, school or tutoring service, game, health service, or product that minors may use needs to decide how it will know who is a child and how it will obtain and prove parental consent. This guide explains the legal requirements, what "verifiable" consent means in practice, the exemptions, how to design age assurance and consent flows with minimal data collection, and common pitfalls. Details of exemptions and verification methods are set out in the Rules; confirm them in the official text.

What the Act says {#act}

Section 9 of the DPDP Act sets special rules for children's personal data. In summary, a data fiduciary must:

• obtain verifiable consent of the parent or lawful guardian before processing a child's personal data;
• not undertake processing that is likely to cause a detrimental effect on the well-being of a child; and
• not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children.

The Act allows the Government to exempt certain classes of data fiduciaries or certain purposes from some of these requirements, subject to conditions set out in the Rules.

Who counts as a child {#child}

For the purposes of the Act, a child is an individual who has not completed eighteen years of age. This means a service used by teenagers is in scope. When a data fiduciary deals with a child, the "data principal" — the person whose data it is — includes the child's parent or lawful guardian for the purpose of exercising rights.

Verifiable parental consent {#vpc}

The Government of India's explainer on the Rules states that when a child's personal data is involved, verifiable consent from a parent or guardian is required. "Verifiable" means the organization must be able to take reasonable steps to confirm that the person giving consent is an adult and is the child's parent or lawful guardian, and must be able to show that this was done. The Rules set out how this should be done; confirm the current requirements in the Gazette text rather than relying on summaries.

A consent notice for a child's data should be written so a parent can understand it, and should explain the specific purpose for which data will be processed. Because consent must be specific, a blanket consent covering unrelated purposes is not sufficient.

Prohibited processing {#prohibited}

Even with parental consent, the Act prohibits certain practices for children's data:

• Tracking and behavioural monitoring — building profiles of a child's behaviour.
• Targeted advertising directed at children.
• Any processing likely to harm the child's well-being.

For products with advertising or personalization, this typically means turning off behavioural tracking and ad targeting for accounts identified as belonging to minors, and reviewing analytics and third-party tools that collect data by default.

Exemptions {#exemptions}

According to the Government's explainer, parental consent is required unless the processing relates to essential services such as healthcare, education, or real-time safety. The Act and the Rules provide for specified exemptions for certain classes of fiduciaries and purposes. Whether an exemption applies depends on the facts and on the exact wording in the Rules, so organizations should check the official text and take advice before relying on one.

Persons with disabilities {#disabilities}

The Government's explainer also states that if a person with a disability cannot make legal decisions even with support, their lawful guardian must give consent, and that the guardian must be verified under the relevant laws.

Designing age assurance and consent {#design}

1. Decide whether you can have child users at all. If your service is not meant for minors, say so, and design sign-up to reduce the chance they register. If it is for minors, or may be used by them, plan for the full consent process.
2. Use age assurance proportionate to the risk. Collect the minimum data needed to decide whether a user is a child. Avoid collecting identity documents when a simpler check will do.
3. Collect parental consent through a separate, clear flow that identifies the child's account and the specific purposes, and that makes it easy for the parent to decline or withdraw later.
4. Verify the parent or guardian using a method suited to the sensitivity of the data and document how it works.
5. Keep records of the consent, who gave it, when, how they were verified, and for what purpose, so you can show it if questioned.
6. Switch off prohibited features — behavioural tracking and targeted advertising — for child accounts and review third-party SDKs and analytics.
7. Minimize and limit retention. Do not keep verification data longer than necessary; see DPDP Data Retention and Erasure.
8. Provide a route for parents to access, correct, and request erasure of the child's data, and to withdraw consent.

Common problems {#problems}

• Assuming users are adults because nobody asked.
• Collecting more data than needed to verify age, creating a new privacy risk.
• Reusing an adult consent flow for children, with the same pre-checked boxes and bundled purposes.
• Third-party advertising and analytics tools that track users by default and are never switched off for minors.
• No record of how consent was verified, so the organization cannot demonstrate it.

Penalties {#penalties}

According to the Government of India, violations of obligations relating to children can attract penalties of up to ₹200 crore, set by the Data Protection Board after an inquiry.

How Threat ResQ fits {#threat-resq-fit}

PrivacyIQ, Threat ResQ's privacy management platform, provides a data inventory and technical discovery that can help organizations find where personal data and third-party trackers are present on their web properties, plus a technical DPDP readiness view. It is a platform that supports a privacy programme: it is not a certifying authority, does not grant or imply a "DPDP compliant" status, and does not manage consent. Threat ResQ's Compliance Consulting service supports regulatory readiness.

FAQ {#faq}

Who is a child under the DPDP Act? Anyone under eighteen years of age.

Do I need parental consent to process a child's data? Yes, verifiable consent of a parent or lawful guardian is required before processing a child's personal data, subject to exemptions the Act and Rules provide — the Government's explainer notes that processing related to essential services such as healthcare, education, or real-time safety is treated differently.

Can I show targeted ads to children? No. The Act prohibits tracking or behavioural monitoring of children and targeted advertising directed at children.

What does "verifiable" parental consent mean? That the organization can take reasonable steps to confirm that the person consenting is an adult and the child's parent or lawful guardian, and can show that it did so. The Rules set out the detail.

What is the penalty for violating the children's data rules? Up to ₹200 crore, according to the Government of India's summary of the Act's penalties.