DPDP and children's data: get a parent's permission first

If your app, coaching centre, gaming platform or school deals with anyone under 18, Section 9 of the DPDP Act is the part to read first. The main duties start on 13 May 2027.

Who is a child

Under the Act, a child is anyone below 18. The same protection covers a person with a disability who has a lawful guardian.

Parent's permission, properly checked

Before you process a child's personal data, even a name or a login email, you need the verifiable consent of a parent or lawful guardian. The Rules expect you to check that the person giving permission is an identifiable adult. A button that says "I am over 18" is unlikely to be enough on its own.

Two bans that apply once you have permission

• No tracking or targeted advertising. You may not monitor a child's behaviour online or aim advertising at them.
• No harmful processing. You may not use their data in a way that is likely to harm their well-being.

Breaking the children's-data rules can carry a penalty of up to ₹200 crore.

Exemptions exist, but check yours

The Rules give limited exemptions for some uses, such as certain health and education services. Do not assume you are covered. Check your exact case.

What to do

• Turn off advertising and tracking tools on any account that could belong to a minor.
• Decide how you will check a parent's identity, and keep a record of the permission.
• As good practice (the Act does not require it), make it easy for parents to review and manage a child's account.

Simple rule: never track minors or show them targeted ads, and always get real parent approval first.

Take the free DPDP check: the children's-data questions only apply to you if you serve young users, and you can mark them "not applicable".

General information, not legal advice. Check the Act and Rules before relying on it.