Children's personal data under the DPDP Act

Who is a child

A child is an individual who has not completed 18 years. That is older than many app age gates, which often stop at 13. A Class 11 student signing up for coaching classes is a child under the Act, and so is a 17 year old customer of a fashion brand.

Verifiable consent of a parent or guardian

You must obtain verifiable consent of a parent or lawful guardian before processing a child's data. The Rules describe how to check that the person giving consent is an identifiable adult, for example using reliable details you already hold, or details or a virtual token issued by an authorised entity.

A tick box saying "I am the parent" is unlikely to be enough on its own. You need a method that suits the risk and a record of how consent was checked.

What you must not do

You must not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children. You also must not process a child's data in a way likely to cause a detrimental effect on their well-being.

For an edtech platform, that means looking hard at engagement analytics, "students like you also bought" offers and retargeting ads. Some of it may need to stop for under 18 users. Disclosing it in the notice does not make it allowed.

Exemptions in the Rules

The Rules list certain classes of Data Fiduciaries and purposes that are exempt from some of these duties, subject to conditions. Whether an exemption covers your service is a narrow legal question, and the conditions matter. Confirm it with counsel before you rely on it.

Timing and penalties

The children's data duties apply in Phase 3, around 13 May 2027 as notified, unless amended. A breach of the additional duties for children's data can attract a penalty of up to 200 crore rupees.

Putting it into practice with TrustOS

TrustOS lets you flag purposes and data sets that involve children, record the parental consent method used for each, and keep that consent with the notice version shown. Marketing and analytics purposes can be marked as not permitted for child users, so the restriction shows up in your inventory and processor reviews. It does not verify identity itself; that depends on the method you choose and the systems you connect. Nor does it replace legal advice on exemptions.