What the DPDP Act requires for children's data
Section 9 of the Act sets out the obligations for children's data. Failing to meet them can attract a penalty of up to ₹200 crore.
- A child is any individual under 18 years of age.
- You must obtain verifiable consent from a parent or lawful guardian before processing a child's personal data.
- You must not process personal data in a way that is likely to have a detrimental effect on a child's well-being.
- You must not track or behaviourally monitor children, or direct targeted advertising at them.
- Similar consent rules apply to persons with disabilities who have a lawful guardian.
How verification works under the DPDP Rules
Rule 10 of the DPDP Rules expects a Data Fiduciary to take appropriate technical and organisational measures to check that the person giving consent is an identifiable adult. It describes two main ways to do this:
- Using reliable identity and age details of the parent that the business already holds, for example from an existing verified account.
- Using identity and age details provided by the parent, or a virtual token mapped to them, issued by an entity authorised by law or the Government, such as a Digital Locker service.
- A simple unverified checkbox saying "I am the parent" may not meet the requirement.
- Collecting copies of sensitive identity documents without a clear need creates avoidable privacy and security risks.
Who may be exempt
The Rules exempt certain organisations and purposes from some of the children's data obligations, such as healthcare providers, educational institutions and childcare providers processing data for education, health or safety, and processing needed to check age or to keep children safe. These exemptions are limited to specific purposes, so check them carefully against how you actually use the data rather than assuming your sector is covered.
For edtech, the exemptions for specific educational activities sit in Rule 12 and the Fourth Schedule. They do not create a blanket exclusion for every edtech company or every processing purpose.
What this means for edtech
- List the data you hold, such as student profiles, lessons, assessment results, attendance and messages, and identify which processing is necessary for the educational service.
- Ask for age at sign-up, and route under-18 learners to a parent consent flow before creating a full account.
- Separate learning analytics needed for the course from marketing and engagement tracking.
- Review in-app notifications and recommendations to make sure they do not amount to behavioural monitoring.
- Control how data is shared among teachers, administrators, vendors and external services.
- Give parents a dashboard to see and withdraw consent.
What this means for gaming
- Build an age gate that cannot be bypassed with a single tap.
- Turn off targeted advertising and behaviour-based personalisation for child accounts.
- Review device identifiers, activity histories, purchase data and third-party analytics SDKs that may receive children's data.
- Review chat, leaderboards and in-game purchases for risks to children's well-being.
- Link child accounts to a verified parent account where possible.
- Do not infer an exemption from the nature of the game; any exemption must be legally established.
What this means for e-commerce
Selling products for children does not necessarily mean a store processes children's personal data. A parent buying a school bag is different from a child creating a tracked shopping profile. Look at who provides the information, whose information it is, and why it is processed.
- Identify product categories and journeys that attract under-18 users, such as toys, books, gaming and fashion.
- Review account creation, family profiles and loyalty programmes that may hold children's data.
- Make sure recommendation engines, marketing scripts and retargeting do not profile known child users.
- Use an existing verified adult account as the basis for parental consent where the parent is already a customer.
Designing a parental consent flow
This is a practical implementation framework, not an official sequence prescribed by the Government.
- 1Collect the age or date of birth up front, in a neutral way that does not encourage false answers.
- 2Identify the processing purposes and check whether any exemptions apply.
- 3If the user is under 18 and no exemption applies, pause processing and ask for a parent's details.
- 4Verify the parent as an identifiable adult using one of the methods in the Rules.
- 5Show the parent a clear, purpose-specific notice and capture their consent.
- 6Store a record linking the child, the parent, the verification method, the notice version and the time, and make sure connected systems respect the outcome.
- 7Let the parent review and withdraw consent at any time, and stop processing when they do. Provide rights and grievance channels too.
Common challenges
- Privacy-preserving verification: establish the facts you need without collecting or storing excess identity data. Token-based approaches can reduce retention in suitable cases.
- Multi-device accounts: parents and children often use different devices. Link verification to the correct account and prevent it being reused for unrelated users.
- Third-party processing: analytics, messaging and marketing tools can receive children's data. Identify them and apply the same restrictions and withdrawals.
- Evidence and ongoing change: the workflow should handle revised notices, updated permissions and requests without relying on manual email exchanges.
How ConvergeDPDP supports parental consent
ConvergeDPDP includes verifiable parental consent workflows alongside purpose-based consent capture, a preference centre and a tamper-evident audit trail. Web and mobile SDKs let you add the flow to your app or website, and each parental consent is stored with its verification details for audit.
Confirm the exact parental verification method and integrations for your use case before deployment.
Conclusion
Verifiable parental consent needs more than age declarations and checkboxes. For edtech, gaming and e-commerce, readiness starts with identifying children's data, testing exemption criteria, using appropriate adult verification and building safeguards across connected systems. Combine technical controls with a legal review of your specific processing activities.