Children’s Personal Data Under the DPDP Act: Verifiable Parental Consent
· Sri Tulasi Tech Labs
The DPDP Act gives special protection to children. Any organisation whose services are used by people under 18 — schools, edtech platforms, gaming and social apps, healthcare providers — needs to look closely at these rules.
Who is a child?
Under the Act, a child is anyone who has not completed 18 years of age. This is higher than in many other countries, so many services used by teenagers are affected.
Verifiable consent of a parent or guardian
Before processing a child’s personal data, a Data Fiduciary must obtain the verifiable consent of the parent or lawful guardian. The DPDP Rules, 2025 expect organisations to adopt appropriate technical and organisational measures to check that the person giving consent is an identifiable adult — for example, by relying on reliable identity and age details already held, or on a virtual token issued by an authorised entity, such as through a digital locker service.
The same approach applies to persons with disabilities who have a lawful guardian.
Prohibited processing
A Data Fiduciary must not:
- process personal data in a way likely to cause any detrimental effect on the well-being of a child;
- undertake tracking or behavioural monitoring of children;
- direct targeted advertising at children.
Exemptions
The Rules exempt certain classes of Data Fiduciaries and purposes from some of these conditions where processing is needed in the child’s interest — for example, healthcare professionals, educational institutions and child-care providers for specific activities such as safety, tracking location during school transport, or tracking educational activities. Each exemption is limited to its stated purpose.
The penalty
Breaching the obligations for children’s data can attract a penalty of up to ₹200 crore.
Steps to take
- Find out whether people under 18 use your service.
- Add age checks and a verifiable parental consent flow where needed.
- Switch off behavioural tracking and targeted advertising for children.
- Check whether an exemption applies, and document why.
- Review the design of features for children’s well-being.
Check where your organisation stands
The DPDP Compliance Hub readiness assessment walks your team through these requirements with plain-language questions and gives you a readiness score and a gap report.
Note: This article gives general information about the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is not legal advice. Obligations depend on your organisation, the applicable provisions and their commencement dates.