Children's data under DPDP: verifiable parental consent in practice

The Digital Personal Data Protection Act, 2023 treats everyone under 18 as a child. Before processing a child's personal data, an organisation must obtain verifiable consent from a parent or lawful guardian, must not process the data in a way likely to harm the child's well-being, and must not track, behaviourally monitor or target advertising at children. Rule 10 of the DPDP Rules, 2025 sets out how to check that the person consenting is an identifiable adult, and Rule 12 with the Fourth Schedule allows narrow exemptions for health services, schools, child care, school transport and a few specific purposes.

These obligations come into force in May 2027, eighteen months after the Rules were published on 13 November 2025. This guide is for schools, edtech companies, app developers, hospitals and anyone else with users under 18. It is general information, not legal advice.

Who counts as a child under the DPDP Act?

Section 2(f) defines a child as an individual who has not completed eighteen years. There is no lower tier for teenagers: a 17-year-old is treated the same as a seven-year-old. Products built around 13 as the cut-off, the age used by the US children's privacy rule (COPPA), will need a separate path for Indian users aged 13 to 17.

Under Section 2(j), when the data relates to a child, the "Data Principal" includes the parents or lawful guardian. In practice the parent gives consent, receives notices and exercises rights such as access, correction and erasure for the child.

Section 9(5) lets the Central Government notify a lower age for a particular organisation whose processing is "verifiably safe". We have not found any such notification, so plan on 18.

What does Section 9 actually require?

• Verifiable parental consent (Section 9(1)). Before processing any personal data of a child, obtain the verifiable consent of the parent or lawful guardian, in the manner the Rules prescribe.
• No harm to well-being (Section 9(2)). Do not undertake processing likely to cause any detrimental effect on the well-being of a child.
• No tracking or targeted ads (Section 9(3)). Do not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children.

The same consent requirement covers a person with disability who has a lawful guardian; a Removal of Difficulties Order issued on 5 October 2026 corrected the wording of Section 9(1) to make that clear. Rule 11 requires you to check that such a guardian was appointed by a court, a designated authority or a local level committee under the applicable guardianship law.

One point is easy to miss. The exemptions below can switch off Sections 9(1) and 9(3), but nothing switches off Section 9(2). The duty not to harm a child's well-being applies to every organisation, for every purpose.

How does Rule 10 verify a parent's consent?

Rule 10 requires "appropriate technical and organisational measures" so that the parent's verifiable consent is obtained before any processing of the child's data. You must also observe due diligence to check that the person identifying herself as the parent is an identifiable adult, by reference to:

• Reliable details you already hold: identity and age details of that individual already available with you.
• Details the parent provides: identity and age details voluntarily given by the individual.
• A virtual token: a token mapped to identity and age details, issued by an authorised entity. That includes an entity entrusted by law or government with issuing such details, and details or tokens verified by a Digital Locker service provider.

The illustrations to Rule 10 cover four cases: the child starts sign-up and names a parent, or the parent opens the account; and the parent either is or is not an existing user. An existing user is checked against reliable details already held. Anyone else is checked against identity and age details issued by a government-entrusted entity, or a token mapped to them, which the parent may share through a DigiLocker-type service.

What Rule 10 leaves open

Rule 10 checks that the consenting person is an identifiable adult. It does not prescribe how to prove that this adult is the child's parent. CMS IndusLaw reads the Rules as satisfied by consent from an identifiable adult without proof of parental status, and SFLC.in has flagged the lack of clarity on the parent-child relationship. Until the Data Protection Board says more, record a clear declaration of the relationship, keep evidence of the check you ran, and add stronger checks where the risk is higher, such as health data or features that let strangers contact the child.

A single checkbox, ticked on the child's own device, saying "I am over 18" or "my parent agrees" records a claim. It is hard to describe it as due diligence.

Which organisations and purposes are exempt?

Rule 12 and the Fourth Schedule switch off Sections 9(1) and 9(3) for listed classes of organisations (Part A) and listed purposes (Part B), only within the stated conditions.

Two cautions. An exemption covers the stated purpose only: a hospital exempt for treating a child is not exempt when it uses the same records for a promotional campaign. And the rest of the Act still applies, including a lawful basis, proper notice, reasonable security safeguards, retention limits and a working grievance process.

Does the school exemption cover admissions, fees and edtech?

The Fourth Schedule defines an educational institution as "an institution of learning that imparts education, including vocational education", and restricts its exemption to tracking and behavioural monitoring for educational activities or the safety of enrolled children. Attendance, classroom assessment and campus CCTV for safety are the kind of activities it appears designed for. Admission forms, fee records, student photos on social media and sharing data with marketing partners are not. S.S. Rana & Co. describes the schools exemption as limited and treats sharing admission data with edtech or marketing companies without consent as a compliance gap.

Edtech is less settled. A LiveLaw analysis published on 20 October 2026 argues that consumer platforms selling directly to families cannot rely on the education exemption and must verify parental consent for every minor user. A vendor running a learning management system on a school's instructions is a Data Processor; the school remains responsible for consent and for staying within the exemption, and Section 8(2) requires a valid contract confining the vendor to the school's purposes. Once the vendor uses student activity for its own analytics or marketing, it needs its own basis, including verifiable parental consent. Targeted advertising directed at children stays barred either way.

Neither MeitY nor the Board has issued guidance on these edges. Until one does, plan on the narrow reading.

What does verifiable parental consent look like in practice?

These workflows are illustrations, not prescribed procedures. Adapt them with your legal adviser.

Workflow 1: a new school admission

1. Give the parent a standalone privacy notice with the form. Rule 3 requires it to be understandable on its own, itemise the data and purposes, and explain how to withdraw consent, exercise rights and complain to the Board.
2. Verify the parent at the counter: sight an original identity document showing age, note who checked it and how, and avoid photocopying it unless another law requires a copy.
3. Take consent for admission separately from optional uses such as photos on the website and social media, or sharing contact details with third parties. Do not make admission conditional on the optional items.
4. Record the date, notice version and verifying staff member. Make withdrawal as easy as giving consent, as Section 6(4) requires.

Workflow 2: sign-up on an app or learning platform

1. Ask for date of birth on a neutral screen that does not hint at the answer that unlocks the product. The Fourth Schedule permits processing to confirm a user is not a child, limited to what that check needs.
2. If the user is under 18, pause sign-up and collect only the parent's mobile number or email, as in the Rule 10 illustration where the child names her parent.
3. The parent verifies with a token from an authorised entity, such as a DigiLocker-type service, or by providing identity and age details through a secure step.
4. The parent reads the notice and consents. The child's account starts with children's defaults: no personalised ads, no behavioural analytics, no third-party advertising or tracking SDKs.
5. If verification is not completed within a short, defined window, delete what the child entered.

Workflow 3: a parent with an existing verified account

A bank, telecom operator or health platform may already hold verified identity and age details for the parent. The parent logs in, adds a child profile and consents, and your system checks that the details held are reliable and show an adult. "Reliable" matters: a birth year typed into a profile years ago is weaker evidence than a KYC-verified record. Document which account types you treat as reliable, and why.

What mistakes should you avoid?

• Posting class results and photos in large or public groups. Rank lists, marks with names or student photos in parent WhatsApp groups or on public pages go beyond what most parents agreed to and can embarrass or expose a child. Ask the Section 9(2) question, and share individual results individually.
• Leaving ad and analytics SDKs in children's apps. Many free SDKs build advertising profiles by default. In a product used by children that is likely to be tracking, behavioural monitoring or targeted advertising, which Section 9(3) bars. Audit every SDK and switch off ad personalisation for under-18 users.
• Treating the admission form as blanket consent. Section 6(1) requires consent to be specific and limited to the data needed for the stated purpose. One signature for "all purposes" is unlikely to meet that standard.
• Stretching the location exemptions. School transport may track a child's location during the journey, for safety. Using that history for marketing or unrelated analytics falls outside the condition.
• Forgetting the eighteenth birthday. The Act does not say what happens when a child turns 18. Plan to tell the new adult user and let them review the consents given on their behalf.

What is the penalty for breaching the children's obligations?

The Schedule to the Act sets a penalty of up to ₹200 crore for breach of the additional obligations relating to children under Section 9. Under Section 33, the Data Protection Board fixes the amount after considering the nature, gravity and duration of the breach, the type of data affected, repetition and any mitigation. A children's data incident can engage other heads too: failing to take reasonable security safeguards can attract up to ₹250 crore.

Where does staff training fit?

Most failures with children's data come from ordinary work: a class teacher posting results to a group, an admissions clerk photocopying every document, a developer adding an SDK to ship faster. Policies matter, but the people handling the data need to recognise these moments.

AuditDPDP runs DPDP awareness sessions for teachers, admissions and front-office staff, and product teams. See our notes on education, learning management systems and mobile and web apps, or get in touch. AuditDPDP is an independent training provider, not affiliated with MeitY or the Data Protection Board, and our training is not an official certification.