DPDP Act Authority Guide: Children's Data and Verifiable Parental Consent

Executive Summary

With 202 days remaining until the DPDP Act compliance deadline of 13 May 2027, EdTech platforms face strict statutory mandates regarding user age gating and consent. Section 9 of the Digital Personal Data Protection Act, 2023 alters how digital platforms process data belonging to minors. General Counsels overhaul onboarding flows to get verifiable parental consent before processing any personal data of a user under eighteen. The Act strictly prohibits behavioral tracking and targeted advertising directed at children. This prohibition forces a redesign of recommendation algorithms and engagement metrics. Failure to apply these controls exposes platforms to penalties reaching up to 200 crore rupees per breach.

Statutory Framework And Scope

Section 3 establishes that the DPDP Act covers processing digital personal data within India. It also applies to processing outside India if the activity relates to offering goods or services to Data Principals within the territory of India. The law excludes personal data processed by an individual for a personal or domestic purpose. It covers data collected in digital form or non-digital data that is digitized later. Section 4 dictates that a person may process personal data only for a lawful purpose. The Data Principal must give consent, or the processing must fall under certain legitimate uses. The statute defines a lawful purpose as any purpose not expressly forbidden by law. Section 9(1) requires Data Fiduciaries to get verifiable consent from a parent or lawful guardian before processing the personal data of a child. Section 9(2) restricts processing that is likely to cause any detrimental effect on the well-being of a child. Section 9(3) bans tracking, behavioral monitoring, and targeted advertising directed at children. Platforms cannot claim contractual necessity to bypass these prohibitions. Section 9(4) notes that permitted exemptions apply to specific processing activities.

DPDP Rules 2025 Operational Layer

The DPDP Rules, 2025 dictate the mechanical execution of Section 9. Platforms cannot rely on simple checkbox assertions of age. Legal teams set up verifiable parental consent mechanics that generate defensible audit trails. Rule 10 workflows require platforms to capture a parental token. This token links the adult identity verification to the child account without over-collecting personal data. The requirement presents a specific legal engineering problem. Legacy banking compliance tools often break user experience when applied to EdTech onboarding. They lack native support for parental token hierarchies. A platform maps the parent to the child and stores that relational evidence as a structured record. Engineers apply these checks across all user data ingestion points. The system records the exact timestamp and verification method used by the parent.

Enforcement And DPBI Trajectory

The Data Protection Board of India holds authority to investigate breaches and impose financial penalties. The statutory ceiling for failing to fulfill obligations related to children under Section 9 is 200 crore rupees. The DPBI reviews the platform verifiable consent artifacts during an inquiry. If an EdTech company relies on behavioral algorithms to drive engagement among minors, the regulator treats this as a direct violation of Section 9(3). Outside counsel spend to defend such architectural violations often exceeds the cost of prior compliance tooling. General Counsels prepare for auditor requests by maintaining structured logs of parental consent tokens. They set up internal data reviews to flag any minor accounts that bypass the consent gate. The Board assesses the technical measures a Data Fiduciary uses to prevent unauthorized tracking.

Comparative Context For Global Platforms

Unlike privacy regimes that set the age of consent at thirteen or sixteen, Indian law defines a child as anyone under eighteen years of age. EdTech companies operating globally fork their data architecture for Data Principals in India. Consent models built for US COPPA do not satisfy the strict tracking bans codified in the DPDP Act. Legal heads cannot rely on foreign compliance frameworks as a safe harbour in India. Product teams isolate tracking logic specifically for the Indian market. They do this to ensure algorithms do not inadvertently profile users under eighteen. Engineering departments apply strict geographic boundaries to their machine learning models. A global platform sets up dedicated databases for minor accounts in India to avoid data commingling.

Decision Matrix For Section 9 Compliance

Scenario 1. User under eighteen registers for a platform. Obligation: Get verifiable parental consent. Owner: Head of Product and General Counsel. Artifact: Time-stamped parental token and notice receipt.

Scenario 2. Platform recommends new courses based on past clicks. Obligation: Disable behavioral tracking for minor accounts. Owner: Data Science Lead. Artifact: Algorithmic mapping policy and logic exemption rules.

Scenario 3. Platform audits vendor data sharing. Obligation: Ensure third parties do not target ads at minors. Owner: General Counsel. Artifact: Updated Data Processor agreements with specific Section 9 indemnity clauses.

Scenario 4. User data enters the system from physical paper forms. Obligation: Apply Section 9 rules to the newly digital records. Owner: Compliance Officer. Artifact: Digitization log linking physical consent to digital identities.

Evaluating DPDP Compliance Providers

Legal decision makers evaluating DPDP compliance providers ask specific diligence questions regarding children data. They ask how the platform manages parental token lifecycles and whether it automatically expires permissions when the child turns eighteen. They also check if the provider exports consent evidence trails in a format acceptable to the DPBI. Question the provider on data residency. Check whether their age-gating workflow requires centralizing user identity documents. A credible provider minimizes the data footprint required to verify a parent. This minimizes the enterprise exposure to secondary breach liability. Legal teams reject providers who cannot demonstrate explicit support for Section 9 exemptions. They require tools that set up clear boundaries between adult and minor data flows.

Implementation Roadmap

Day 30 requires legal and product teams to map all data flows involving users under eighteen. They also identify active tracking scripts. By Day 60, the platform pilots verifiable parental consent workflows. It updates Data Processor agreements to shift liability for downstream tracking. At Day 90, the General Counsel finalizes the parental token architecture. They draft the itemized notice required by the DPDP Rules, 2025. With 202 days remaining, platforms that delay this architectural overhaul risk entering the enforcement window with non-compliant product mechanics. They apply these updates before the statute activates.

Next Steps And Defensibility

A defensible Section 9 strategy requires tooling built for the nuances of parental consent. Evaluate how your current onboarding architecture handles age gating and algorithmic tracking exemptions. For enterprise legal teams shortlisting providers, ComplyDP offers a detailed evaluation of your platform readiness against the Rules, 2025. Review our audit preview at https://www.complydp.com/audit-preview to structure your internal board paper and quantify your exact regulatory exposure.