Section 9 of the DPDP Act: Verifiable Parental Consent and EdTech Compliance

Section 9 of the Digital Personal Data Protection Act, 2023 restricts how your EdTech platform handles user data for anyone under 18 years of age. It requires verifiable parental consent before processing begins. It strictly prohibits tracking, behavioral monitoring, and targeted advertising directed at children. For a startup founder, this means recommendation algorithms and gamified onboarding sequences require an overhaul if they rely on user profiling. The law establishes exact boundaries for platform design. You cannot treat a child user the same way you treat an adult. The DPDP Act classifies any person under 18 as a child. This classification applies uniformly across all digital services operating in India. EdTech platforms face immediate exposure because their core product loops often rely on engagement tracking to measure learning outcomes. Investors now place these specific compliance gaps at the top of their due diligence checklists to evaluate enterprise readiness.

Under Section 9(1), a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian before processing the personal data of a child. The statute clarifies that the expression "consent of the parent" includes the consent of a lawful guardian wherever applicable. This rule binds every Data Fiduciary that collects or processes data from users under 18 in India. If your Seed or Series B startup sells to K-12 schools or directly to students, you are fully liable as a Data Fiduciary. You have to secure this consent in such manner as may be prescribed by the government. Implementing this requirement shifts the traditional onboarding funnel. The product team has to build an intercept that stops the child from proceeding until a parent verifies their identity and approves the data processing. Dropping an age gate at the end of the signup process fails the test. The check has to happen before processing begins.

Section 9(2) forbids any processing likely to cause a detrimental effect on a child's well-being. The Act leaves the exact parameters of "detrimental effect" open to regulatory interpretation. Section 9(3) bans tracking, behavioral monitoring, and targeted advertising directed at children. You cannot deploy tracking pixels or behavioral cookies on child accounts. Standard marketing stacks that profile users based on their click paths or session duration directly violate this clause. You have to differentiate between academic progression analytics and behavioral tracking. Storing a record that a student completed a math module is a functional requirement. Analyzing that same student's mouse movements to predict their attention span and serve them a specific intervention ad crosses into behavioral monitoring. The Head of Legal needs to maintain an evidence trail proving these scripts do not load for users under 18.

The law does provide a pathway for exceptions. Section 9(4) states that the provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data by specific classes of Data Fiduciaries or for specific purposes. The Central Government has the authority to notify these exemptions. Until the government publishes a specific notification exempting your exact processing activity or industry sub-class, you operate under the assumption that full compliance is required. You cannot claim an exemption based on industry norms or educational intent. The exemption only exists if the government explicitly writes it into the official gazette. EdTech founders should monitor regulatory updates but plan their engineering sprints around the strict default rules.

Section 9 operates alongside Section 4, which establishes that a person may process personal data only for a lawful purpose. The Data Principal gives consent, or the processing occurs for certain legitimate uses. Consent forms the primary basis for processing children's data under Section 9. It also links heavily to Section 8 general obligations. Section 8 requires you to maintain reasonable security safeguards over the personal data you possess. Collecting verifiable parental consent means you now store records of parent identities and authorization tokens. A data breach exposing these consent logs violates Section 8. If you use a third-party analytics provider to track user engagement, Section 8 holds you responsible for their actions. You have to ensure your contracts prevent the vendor from tracking children on your platform.

Complying with Section 9 requires structural changes to your product workflows. You need to implement these modifications well before regulatory enforcement begins.

1. Implement age-gating at the first point of data entry to separate adults from children. The product owner has to document this logic and test it across all device types.

2. Deploy a verifiable parental consent mechanism for underage users per the DPDP Rules, 2025. Your engineering team needs to build or integrate parental token validation without causing high drop-off rates.

3. Disable behavioral tracking and targeted ad scripts for all authenticated child accounts. You have to block third-party analytics tools from loading on child profiles.

4. Audit your recommendation engine. It needs to operate on non-personal data or generic curriculum progression rather than behavioral profiling.

Failing to secure verifiable parental consent or violating the tracking ban carries severe financial risk. The Schedule to the DPDP Act sets a specific penalty ceiling of up to Rs 200 crore for non-compliance with Section 9 obligations. The Data Protection Board of India will examine the volume of data processed and the duration of the breach when calculating fines. A penalty of this scale acts as a fatal deal blocker for any pending Series A or B funding round. EdTech founders have exactly 217 days remaining until the DPDP compliance deadline of 13 May 2027. Re-engineering product analytics and consent flows takes months of engineering bandwidth. Enterprise school buyers expect your product to show a compliant posture well before the enforcement date. Start reviewing your user onboarding and analytics stack today. Conduct a free gap check at https://www.complydp.com/audit-preview to measure your current exposure against the law.