Children's data under DPDP: meaning, how it works in India

The Digital Personal Data Protection Act, 2023 sets a stricter standard for children than for adults. Section 9 defines a child as a person below 18 years. Before a company, called a data fiduciary in the law, processes a child's personal data, it must obtain verifiable consent from the child's parent or lawful guardian.

The same section adds two bans. A company may not process a child's data in a way that is likely to harm the child's well-being. It also may not track or monitor a child's behaviour, or show advertising aimed at children. The government can relax these limits for specific classes of companies or specific purposes by notification, and the DPDP Rules use that power.

Verifiable means the company can show that the person giving consent is an adult and is the parent or guardian of the child. A tick box that says 'I am over 18' does not meet this idea on its own. The DPDP Rules, notified on 13 November 2025, ask the company to take due care to check this before it processes the data.

According to law-firm summaries of the Rules, a company can rely on identity and age details it already holds about the parent, or on a virtual token issued by a government-backed service or an authorised entity, such as a digital locker. Consent managers, a new kind of registered intermediary under the Act, may also play a role. The parent must also be an identifiable adult, and the company should keep a record of how the check was done.

• Child: anyone below 18 years, with no lower age for a general app.
• Consent: given by the parent or lawful guardian, not by the child.
• Check: the company must verify that the person is an adult and is the parent.
• Record: the company should be able to prove later how consent was obtained.

The DPDP Rules carry a schedule of exemptions, often called the Fourth Schedule. Law-firm notes describe two groups. The first covers certain kinds of organisations, such as clinical establishments and healthcare professionals, schools and other educational institutions, crèches and day-care centres, and transport services for children. These bodies may process children's data without parental consent, but only as far as needed for health services, education or safety.

The second group covers specific purposes, for example emergency medical care, delivering a subsidy or benefit from the government, legal compliance, or confirming that a user is a child so the company can apply the child rules. These exemptions are narrow. A company that qualifies for one purpose cannot use the same data for something else, such as marketing. Sources differ on the exact wording and numbering, so the notified text is the place to check.

Most consumer apps do not know a user's age today. To follow the law they need an age gate at sign-up, a way to bring in a parent, and a record of the parent's consent. Where a child signs up on a phone, the app may need to send a request to the parent and wait for the answer before it collects anything beyond what the exemptions allow.

Edtech apps sit in an unusual spot. A school or a recognised institution may fall within the educational exemption for what it needs to teach and look after students. A direct-to-consumer tutoring app is a company, not an institution, so it should expect to ask for parental consent for under-18 users. Games and social apps face the same question, along with the ban on tracking and targeted advertising, which removes a common way of earning from young users.

Many consumer startups earn from advertising, personalised offers or data-driven upsells. The child rules cut across that. If a teenager is a large share of the user base, the company must either verify each parent or avoid collecting and profiling data from under-18 users.

There is also a cost side. Building age checks and consent flows takes engineering time and may add friction at sign-up, which can lower conversion. Some companies may respond by restricting under-18 access altogether. Investors can be expected to ask about this during due diligence for any startup with young users.

The Act sets a schedule of monetary penalties, and the highest amounts apply to failing to meet the duties around children's data, reported as up to ₹200 crore for a breach. The Data Protection Board of India decides cases. Penalties depend on the nature and size of the breach.

The DPDP Rules came into force in phases after notification on 13 November 2025, over about 18 months, so most company duties, including the children's consent rule, are expected to apply by around May 2027. As of November 2026, companies are preparing rather than being penalised.

• Notification of the Rules: 13 November 2025.
• Full company duties: expected around May 2027, in phases.
• Maximum penalty for a children's data breach: up to ₹200 crore, per the Act's schedule.
• Regulator: the Data Protection Board of India.

Other countries use lower ages. The United States sets 13 for its main children's privacy law, and the European Union lets member states pick an age between 13 and 16. India uses 18 across the board, which is higher than most. An Indian app with a global user base may need a separate flow for Indian users, or one flow set to the strictest standard.

The Indian law also pairs the consent duty with the ban on tracking and targeted advertising, so it reaches business models, not only paperwork. A parent's consent does not switch off the ban on tracking unless an exemption applies, as the law is usually read in law-firm summaries.

A startup with young users can start by finding out how many of them are under 18 and what data it collects from them. It can then decide whether to build parental consent, restrict access or change features. Logging each consent, and how it was checked, is the safest habit, since the company carries the burden of proof.

• Map which products reach users under 18.
• List the data collected and why.
• Choose a method to verify the parent.
• Turn off tracking and targeted ads for child accounts.
• Review contracts with processors, such as analytics or ad vendors.

A headline about a 'children's data fine' or a 'parental consent deadline' usually refers to the phased timeline, so check whether the duty has started. A story about an app 'banning under-18 users' may be a way to avoid the consent step rather than a legal requirement.

Also check who is exempt. A school app, a hospital app and a general consumer app can be treated very differently. This page is general information and not legal advice, so companies and parents with a specific question should check with a qualified professional.