If your app, game, or platform has users under 18, the DPDP Act treats their data as a special category with some of the strictest rules — and some of the heaviest penalties — in the whole law. You cannot collect a child's data on the child's own say-so. You need verifiable consent from a parent or guardian, you're barred from tracking or advertising to them, and getting it wrong can cost up to ₹200 crore. For ed-tech, gaming, and social platforms, this is the provision most likely to reshape the product.
Here's who counts as a child under Indian law, what "verifiable parental consent" actually means in practice, what processing is flatly prohibited, and how to build an age-gate that holds up.
Quick answer: Under the DPDP Act, a child is anyone under 18. Before processing a child's personal data you must obtain verifiable consent from a parent or lawful guardian, using approved methods (including identity verification via DigiLocker). You are prohibited from tracking, monitoring, behaviourally profiling, or running targeted advertising directed at children. Violations carry penalties up to ₹200 crore. Limited exemptions for sectors like healthcare and education are expected to be notified.
Who is a "child" under the DPDP Act?
A child is any individual who has not completed 18 years of age. That's higher than the 13 or 16 thresholds common in other jurisdictions, so a teenager who'd be treated as an adult user under US COPPA or parts of GDPR is still a child here. If your platform serves anyone in the 13–17 band — which most gaming, social, and ed-tech products do — these rules apply to a large slice of your users.
The same heightened protection extends to persons with disabilities who have a lawful guardian.
What verifiable parental consent means
For a child, consent doesn't come from the child. Before processing their personal data, you must obtain verifiable consent from a parent or lawful guardian — and "verifiable" is the operative word. It isn't enough to show a checkbox that says "I am a parent." You have to take reasonable steps to confirm that the person consenting really is an adult and really is the child's parent or guardian.
How to actually verify a parent
The Rules specify approved verification approaches, built around reliable identity signals rather than self-declaration. In practice this includes:
- verifying the parent's identity and age against reliable identity details or a virtual token mapped to them; and
- integration with DigiLocker, India's government-backed digital document wallet, to confirm the parent's identity and establish the parent–child relationship.
The design goal is a verification step that a child cannot simply click through by pretending to be an adult. That's a real product and engineering task, not a legal checkbox.
Processing that is flatly prohibited
Even with parental consent, some processing of children's data is banned outright. You must not:
- track, monitor, or behaviourally profile children; or
- direct targeted advertising at children.
This is the provision that bites hardest for ad-funded and engagement-optimised products. A model built on profiling young users to serve personalised ads or maximise screen time runs directly into this prohibition. For many ed-tech and gaming businesses, complying means rethinking the monetisation model, not just the consent screen.
Age-gating: detecting child users
To apply parental consent only where it's needed, you first have to know who's a child. That means building age-gating — technical measures to detect, or reasonably establish, whether a user is under 18, and to prevent processing a child's data without verified parental consent. A naive "enter your date of birth" field that any 12-year-old can lie past won't satisfy a regulator looking at how seriously you took the obligation. Expect age assurance to be an area of growing enforcement scrutiny.
The exemptions
The framework anticipates that blanket parental-consent and no-tracking rules would break legitimate services, so limited exemptions are expected to be notified for certain classes of Data Fiduciary and purposes — for example, healthcare providers, educational institutions, and child-transport/child-safety services, where some processing of a child's data is inherent to the service. Until these exemptions are formally notified and their boundaries are clear, treat them as narrow and design for the default rule.
The penalties
Failing to protect children's data — processing without verifiable parental consent, or tracking and targeting children — sits in the ₹200 crore penalty tier, the same severe band as failing to report a breach. Penalties apply per contravention, and the Board can publish the violation, which for a product aimed at families is reputationally devastating.
Worked example: an ed-tech sign-up
A learning app for school students currently lets a child sign up with a name, email, and self-entered age, then personalises content and shows ads.
What has to change:
- Age detection first — establish whether the user is under 18 before processing.
- Route children to parental consent — collect verifiable consent from a parent via DigiLocker-based verification, not a self-declared checkbox.
- Switch off profiling and targeted ads for child accounts entirely.
- Limit data to what the educational service genuinely needs.
- Keep records showing how parental consent was verified.
If the app later relies on a notified education exemption, it still has to stay within that exemption's exact scope — not treat it as a free pass.
Common mistakes
- Treating "child" as under 13 or 16. It's under 18 in India.
- A self-declared "I'm a parent" checkbox. Consent must be verifiable, not asserted.
- Profiling or advertising to children despite consent. That's prohibited regardless of consent.
- A trivially bypassed age gate. Weak age assurance won't satisfy the Board.
- Assuming an exemption applies. Exemptions are narrow and some are still pending notification.
Checklist
- Set your age threshold at 18.
- Build age-gating to detect child users before processing.
- Implement verifiable parental consent (e.g., DigiLocker-based).
- Disable tracking, profiling, and targeted ads for child accounts.
- Minimise the data you collect from children.
- Keep records of how parental consent was verified.
- Confirm whether any notified exemption applies — and stay within it.
Frequently asked questions
What age is a "child" under the DPDP Act? Anyone under 18 years of age.
What is verifiable parental consent? Consent from a parent or lawful guardian, obtained using approved methods that confirm the adult's identity and their relationship to the child — including DigiLocker-based verification — not a self-declared checkbox.
Can I show targeted ads to children if a parent consents? No. Tracking, behavioural profiling, and targeted advertising directed at children are prohibited regardless of consent.
What is the penalty for mishandling children's data? Up to ₹200 crore per contravention.
Are there any exemptions? Limited exemptions are expected for sectors like healthcare and education, but they are narrow and some are still to be notified.
This article is for legal awareness and education only and is not legal advice. Children's-data rules and exemptions are still being operationalised; confirm the current position and consult a qualified professional before building age-verification or consent systems.