Children's personal data under the DPDP Act
Reviewed against the law as of 28 September 2026
A child is anyone under 18 under the DPDP Act. Verifiable parental consent, the ban on tracking and targeted ads, exemptions and the ₹200 crore penalty.
The DPDP Act sets a high bar for children's data. A child is anyone under eighteen, which is older than the thresholds of 13 to 16 used under GDPR, and brings most teenagers using apps, games, education and e-commerce into scope.
The three duties in section 9
- Verifiable parental consent. Before processing a child's personal data, obtain the verifiable consent of a parent or lawful guardian.
- No detrimental processing. Do not process personal data in a way likely to cause any detrimental effect on a child's well-being.
- No tracking or targeting. Do not undertake tracking or behavioural monitoring of children, or targeted advertising directed at them.
Breaching these obligations can attract a penalty of up to ₹200 crore.
Verifying the parent
The Rules require appropriate technical and organisational measures to make sure the person consenting is the parent and an identifiable adult. Options described include relying on identity and age details you already hold for that adult, details the adult provides, or a virtual token issued by an entity authorised by law, such as a Digital Locker service provider.
Design the flow so that you collect the minimum needed, and keep a record of how verification was done.
Exemptions
The Act allows exemptions, and the Rules exempt certain classes of Data Fiduciaries and purposes from some of these duties, for example healthcare professionals and clinical establishments, educational institutions and child-care providers, for specified activities such as health services, education, safety and tracking location for a child's safety. The PIB summary of the Rules describes consent as not needed where processing relates to essential services such as healthcare, education or real-time safety. Read the exemptions carefully: they are tied to specific purposes.
Persons with disability
Where an adult with a disability cannot take legally binding decisions even with support, consent must come from their lawful guardian, verified under the applicable law.
What to review
- Age assurance. Do you know which users are under eighteen? Many services have no age signal at all.
- Analytics and advertising. Tracking, behavioural profiling and targeted advertising must be switched off for children.
- Recommendations and engagement features. Consider whether they could harm children's well-being.
- Data inventory. Mark datasets that contain children's data and the purposes they serve.
- Vendors. Advertising and analytics SDKs in apps are a common source of tracking.
TrustNiq's control library includes verifiable parental consent and the ban on tracking and targeted advertising for children, with evidence from your inventory and attestations. See all controls in a free trial.
Frequently asked questions
What age counts as a child under the DPDP Act?
Anyone who has not completed eighteen years of age.
How do we verify a parent?
The Rules expect due diligence that the person giving consent is an identifiable adult, using reliable identity or age details you already hold, details provided voluntarily, or a virtual token from an authorised entity such as a DigiLocker-based service.
Are schools and healthcare providers exempt?
The Rules exempt some classes of Data Fiduciaries and purposes, such as clinical establishments, educational institutions and child care for specified purposes, from parts of section 9. Check the exact scope in the Rules before relying on an exemption.
Sources
- Digital Personal Data Protection Act, 2023, section 9meity.gov.in
- Digital Personal Data Protection Rules, 2025meity.gov.in
- PIB: DPDP Rules, 2025 notifiedstatic.pib.gov.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.