Module 8 of 9Section 96 min including the detail
Children's data
A person under eighteen. Not thirteen, not sixteen. This single definition makes India's rule stricter in practice than most regimes an international team will have implemented before.
Verifiable parental consent, before processing
A child is anyone under eighteen. That single number makes India stricter in practice than most regimes your team has implemented.
the age below which a person is a child under this Act
Compare thirteen under COPPA and, commonly, sixteen in Europe. Any service used by school or college students is in scope.
The detail, if you want it
For a child, and for a person with a disability who has a lawful guardian, you must obtain verifiable consent from the parent or guardian before processing. Verifiable is the load-bearing word: a tick box declaring I am over eighteen is not verification of anything.
Because a child is anyone under eighteen, a service used by school and college students is squarely in scope, and so is any consumer service with no age gate at all, because not knowing is not a defence.
Two absolute prohibitions
These are not consent-gated. No parent, and no child, can authorise either of them.
Prohibited outright
- Detrimental processinganything likely to harm the wellbeing of a child
- Tracking and targetingbehavioural monitoring or advertising directed at children
The detail, if you want it
You must not undertake processing likely to cause any detrimental effect on the wellbeing of a child. And you must not undertake tracking, behavioural monitoring, or targeted advertising directed at children.
These are prohibitions rather than balancing tests. There is no consent that makes targeted advertising to a child lawful. A parent cannot authorise it either. Breach carries up to ₹200 crore.
The exemption is narrow and conditional
The Government may relax some of this by notification for classes of Fiduciary. That is not a self-assessment you may perform.
The detail, if you want it
The Act allows certain of these obligations to be relaxed for classes of Data Fiduciary or for specified purposes, where processing is verifiably safe. That is a route the Government may open by notification, not a self-assessment you may perform. Until such a notification applies to you, assume the full obligations.
The three things to remember
- A child is anyone under eighteen. Not thirteen, not sixteen.
- Parental consent must be verifiable. An age declaration verifies nothing.
- Tracking and targeted advertising to children are prohibited outright, and no consent cures them.
What good looks like
Evidence you could put in front of an auditor, not a policy statement.
- A documented decision on whether children can reach your service, with the evidence behind it.
- A verifiable parental consent mechanism, if they can, that verifies something.
- A technical control that disables tracking and ad targeting for any account known or suspected to be a child, and a test proving it.
Check what you took in
2 questions, and getting both right completes the module. Nothing is sent to us.
Educational, not legal advice. This module describes what the Act requires of organisations generally; it does not advise on your own circumstances. DPDP Act, 2023: a working foundation.