The rapid growth of digital services for children has made Children's Data Protection an important legal issue for businesses operating in India. Educational platforms, gaming companies, healthcare providers, social platforms, e commerce businesses and family focused applications may collect information from users below eighteen years of age. India’s Digital Personal Data Protection Act, 2023 introduces specific safeguards for such processing, including verifiable parental consent and restrictions on tracking, behavioural monitoring and targeted advertising. The Digital Personal Data Protection Rules, 2025 now provide greater operational clarity, although the substantive children’s data provisions are subject to the Act’s phased commencement framework.

For businesses, the issue extends well beyond publishing a privacy policy. Organisations need to examine their products, consent mechanisms, technology infrastructure, advertising practices, contracts and internal governance before the relevant provisions become operational.

What Does Children’s Data Protection Mean Under the DPDP Act?

The DPDP Act takes a broad approach to the protection of children’s personal data. Section 2(g) defines a child as an individual who has not completed eighteen years of age. This age threshold is important because businesses cannot simply adopt the age threshold used under another country's privacy regime and assume it will satisfy Indian requirements. Section 9 of the Act specifically deals with processing personal data of children. Before processing such data, a Data Fiduciary must obtain verifiable consent from the parent or lawful guardian in the prescribed manner. The provision also requires businesses to ensure their processing does not cause a detrimental effect on the well being of a child. Further, subject to prescribed exemptions, the Act prohibits tracking or behavioural monitoring of children and targeted advertising directed at children. This creates a higher compliance threshold than ordinary personal data processing. A business must therefore understand not only what information it collects, but also how its product uses information after collection. A child’s name, age, photograph, account details, location, educational information or online activity may all form part of a wider data processing ecosystem.

Why the DPDP Act Matters to Businesses?

The DPDP Act establishes a framework for digital personal data processing in India. It places obligations on Data Fiduciaries, meaning organisations which determine the purpose and means of processing personal data. The distinction is commercially significant. A company does not avoid responsibility simply because another company provides the technical infrastructure used for processing. Cloud providers, analytics vendors, software providers and other processors may support the service, but the business still needs to understand its own statutory responsibilities. The Act also creates rights for Data Principals and establishes an enforcement structure through the Data Protection Board of India. The statutory framework therefore moves privacy away from being purely an internal policy issue and towards formal organisational accountability. For businesses dealing with children, this accountability becomes particularly important because the law treats children's data as requiring additional safeguards.

The Current Legal Position and Commencement Timeline

One of the most important points for businesses is the phased implementation of the DPDP framework. The Central Government notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025. The Rules provide for different commencement dates. Rules 1, 2 and 17 to 21 came into force upon publication. Rule 4 is scheduled to commence one year after publication, while Rules 3 and 5 to 16, along with Rules 22 and 23, are scheduled to commence eighteen months after publication. The Act follows a similar phased approach. India Code records Sections 2, 18 to 26, 35 to 43 and specified provisions of Section 44 as commencing on 13 November 2025. Substantive provisions including Sections 3 to 5, Sections 7 to 17 and other specified provisions are scheduled to commence eighteen months from that date. Section 9 falls within this later group. Accordingly, as of August 2026, businesses should distinguish between provisions already operational and provisions scheduled to commence later. This distinction is important for legal accuracy. Businesses should not describe every DPDP obligation as fully enforceable today. At the same time, waiting until the final commencement date would be commercially unwise. Product changes, vendor negotiations, consent architecture and internal governance can take months to implement.

Verifiable Parental Consent Is Central to Compliance

The most visible obligation concerning children's data is parental consent. Section 9 requires verifiable consent from the parent or lawful guardian before processing a child's personal data. The final Rules provide greater detail on how verification is expected to work. Rule 10 requires a Data Fiduciary to adopt appropriate technical and organisational measures and conduct due diligence to establish whether the person presenting themselves as a parent is an identifiable adult. Verification may rely on reliable identity and age information already available to the Data Fiduciary or information voluntarily provided by the individual or through a virtual token issued by an authorised entity. This creates an important design challenge. A business must verify parental authority without creating an unnecessarily intrusive identity collection process. Collecting excessive information from parents can create additional privacy and security risks. The consent mechanism should therefore be designed around necessity, proportionality and security. A simple declaration such as “I am the parent” may not be sufficient where the law requires verifiable consent. Businesses should document the verification methodology and retain appropriate evidence of consent.

The Restrictions on Tracking and Behavioural Monitoring

The DPDP Act takes a particularly cautious approach to children's behavioural data. Section 9 restricts tracking and behavioural monitoring of children, along with targeted advertising directed at children, subject to prescribed exemptions. This can affect technologies businesses commonly use for analytics and personalisation. For example, a platform may use cookies, device identifiers, engagement data, location information or interaction histories to understand user behaviour. For an adult audience, these practices may form part of ordinary analytics. A child focused service requires a much more careful assessment. Businesses should therefore review software development kits, analytics tools, advertising pixels, recommendation systems and third party tracking technologies before deployment. The question should not simply be whether the technology collects personal data. The business should ask whether it tracks or monitors the behaviour of children and whether the proposed activity falls within a permitted exemption.

Targeted Advertising to Children Requires Particular Caution

Advertising models based on user profiling can create significant legal concerns. A business may collect information about content preferences, browsing behaviour, purchasing patterns or engagement levels and use it to deliver personalised advertisements. Section 9 places a specific restriction on targeted advertising directed at children, subject to prescribed exemptions. This means marketing teams should not treat children's advertising as merely another segmentation exercise. Businesses need to understand how their advertising systems identify audiences and whether child users can enter those audiences. This becomes more complicated for platforms serving both adults and children. Age assurance, account design and advertising controls may therefore need to work together. A company should also examine whether external advertising partners receive information about child users and what contractual restrictions apply to such processing.

Exemptions Under the DPDP Rules

The Rules recognise certain exemptions from specific children's data obligations. The explanatory note published by the Ministry of Electronics and Information Technology identifies specific classes of organisations, including certain healthcare professionals, educational institutions and childcare providers, which may benefit from exemptions for defined purposes. The exemptions are subject to conditions and are not a blanket permission to process children's personal data without safeguards. For example, processing may be permitted for activities connected with healthcare, education, child safety or transportation, depending on the applicable category and conditions. This purpose based approach matters. An educational institution should not assume its entire database is exempt merely because it is an educational institution. The organisation should identify the precise processing activity and establish whether it falls within the relevant statutory exemption. A written exemption assessment can be valuable during internal compliance reviews.

Data Minimisation Should Start at Product Design

Children's privacy cannot be managed effectively if a business collects excessive information from the outset. A useful question is simple: does the service genuinely need every piece of information being collected? An educational application may need a child's name, class and learning records to provide its service. It may not need precise location data, extensive behavioural profiles or unrelated demographic information. Data minimisation reduces both compliance exposure and cybersecurity risk. Product teams should therefore involve privacy considerations before new features are released. A feature which creates a new category of children's data should trigger a review before development is completed. Privacy by design is considerably easier than restructuring a mature product after launch.

Privacy Notices and Consent Records

Businesses should ensure their privacy notices accurately describe their processing activities. The DPDP Rules introduce specific notice requirements, including clear information about the personal data being processed and the purpose for processing. The Government's explanatory note emphasises accessible information and transparency for Data Principals. For children's services, the privacy notice should align with the parental consent process. A common compliance weakness occurs when the privacy notice describes one processing purpose while the product performs additional analytics or marketing activities. The legal document, application interface and internal data practices should therefore remain consistent. Businesses should also maintain reliable records showing how and when consent was obtained. Consent records may become important when responding to complaints, regulatory enquiries or internal audits.

Children's Data and Third Party Vendors

Modern businesses rarely operate entirely within their own technology environment. An application may use external cloud hosting, analytics, customer support software, communication services, payment platforms and advertising networks. Every such relationship should be examined where children's personal data is involved. The business should know what information is shared, why it is shared, where it is stored, how long it is retained and what happens when the relationship ends. Vendor contracts should contain appropriate provisions dealing with confidentiality, security, permitted processing, breach reporting, deletion, subcontracting and assistance with legal obligations. A business should also maintain an up to date inventory of relevant vendors. It is difficult to demonstrate effective privacy governance when the organisation does not know who has access to its data. 

Security Obligations Cannot Be Separated From Children's Privacy

Consent alone does not protect children's information. A business can have a perfectly designed consent mechanism and still face serious exposure if its databases, applications or vendor systems are insecure. The DPDP framework requires Data Fiduciaries to adopt reasonable security safeguards. The statutory penalty framework provides significant financial exposure for specified breaches, including penalties of up to ₹250 crore for failure to take reasonable security safeguards and up to ₹200 crore for breach of obligations relating to children. Security controls should therefore be proportionate to the nature and volume of data handled. Access restrictions, authentication, encryption where appropriate, secure software development, monitoring, vulnerability management and incident response should form part of the wider governance framework. Employee awareness is also important. A child’s information may be exposed through simple operational mistakes such as incorrect email distribution, insecure file sharing or excessive employee access.

What Happens After a Data Breach?

Businesses should have an incident response procedure before an incident occurs. The response should establish who investigates the breach, who makes legal decisions, who communicates with affected parties and who manages regulatory engagement where required. Children's information can present distinctive risks. A breach involving a child's location, photograph, school details or behavioural information may create consequences beyond ordinary commercial inconvenience. Incident response should therefore consider the nature of the affected information and the potential impact on children. The DPDP framework contains specific requirements concerning personal data breaches, while the Rules provide operational detail for breach intimation. Businesses should ensure their technical and legal teams understand the applicable requirements before an incident occurs.

Artificial Intelligence Creates New Children's Data Questions

AI based products create another layer of complexity. A business may use children's data to personalise educational content, generate recommendations, analyse performance or develop machine learning systems. Before using information for a new purpose, the organisation should examine whether the proposed processing is consistent with the original purpose, notice and applicable consent framework. A company should not assume data collected for one service can automatically be reused to train a commercial AI system. AI governance should therefore be integrated into children's data governance. Product teams should identify whether AI tools receive personal data, whether external providers process it and whether the proposed use is necessary for the service.

What Businesses Should Do Before Section 9 Becomes Operational?

Businesses handling children's data should use the transition period to conduct a detailed privacy readiness assessment. The first stage should be data mapping. Identify where children's information enters the organisation, what categories are collected, where the information is stored and which internal teams and external vendors can access it. The second stage should involve an age and consent assessment. Determine how the business will identify child users and how it will obtain and verify parental consent where required. The third stage should focus on product design. Review analytics, behavioural monitoring, recommendation engines, advertising systems and location features. The fourth stage should involve contractual review. Vendor and partner agreements should reflect the organisation's actual data processing arrangements. The final stage should involve governance. Assign responsibility for privacy compliance, consent records, data inventories, incident response and regulatory developments. Businesses can consult the official Digital Personal Data Protection Rules, 2025 published by MeitY for the notified regulatory text and commencement information.

Why Businesses Should Prepare Before the Legal Deadline?

The transition period should not be viewed as a reason to postpone compliance. A privacy programme may require changes to software architecture, account creation, consent flows, databases, advertising technology and contracts. These changes cannot always be completed immediately. Early preparation also gives businesses an opportunity to identify commercially unnecessary data collection. For example, a company may discover it has been collecting precise location information simply because an analytics tool automatically captures it. Removing unnecessary collection may be easier than creating a complex legal justification for retaining it. The objective should be to build a product where privacy safeguards support the business model rather than obstruct it.

The Role of Legal Advisers in Children's Data Compliance

Children's data compliance involves several disciplines. Technology teams understand the systems. Product teams understand the user journey. Marketing teams understand advertising practices. Security teams understand infrastructure. Legal professionals connect these activities with statutory requirements. Businesses may therefore benefit from involving data privacy law firms when reviewing complex children's data processing arrangements, particularly where the service involves large scale processing, behavioural technology, international vendors or sensitive categories of information. A legal review should examine the actual product rather than only the privacy policy. 

The right questions include whether parental consent is genuinely verifiable, whether the business collects more information than necessary, whether tracking technologies operate on child accounts, whether vendors receive children's data and whether the business can demonstrate compliance through reliable records. The objective is practical risk management, not paperwork for its own sake. Where the organisation has wider corporate governance or commercial contracting concerns, a corporate lawyer can also help connect privacy requirements with shareholder arrangements, technology contracts, vendor agreements and business operations.

Conclusion

India's DPDP framework represents a significant shift in how businesses must approach children's personal data. Section 9 places specific emphasis on verifiable parental consent, child well being and restrictions on behavioural monitoring, tracking and targeted advertising. The DPDP Rules, 2025 provide additional operational detail and introduce specified exemptions for certain organisations and purposes. For businesses, the strongest response is early preparation. Children's privacy should be considered during product development, vendor selection, marketing planning and technology design rather than being addressed only when a regulatory deadline approaches. A defensible compliance framework should allow the organisation to answer five basic questions clearly: What children's data do we collect? Why do we need it? Who can access it? How do we obtain and record consent? When do we delete it? Businesses able to answer these questions with evidence will be better placed to manage the legal, operational and reputational risks associated with children's personal data.

Frequently Asked Questions (FAQs)

Q1. What is Children's Data Protection under the DPDP Act?

It refers to the additional legal safeguards applicable to processing personal data belonging to individuals who have not completed eighteen years of age. Section 9 of the DPDP Act specifically addresses children's personal data.

Q2. What age is considered a child under India's DPDP Act?

A child is an individual who has not completed eighteen years of age.

Q3. Is parental consent mandatory for children's data?

Section 9 requires verifiable consent from the parent or lawful guardian before processing a child's personal data, subject to prescribed exemptions.

Q4. Can businesses track children online?

Section 9 restricts tracking and behavioural monitoring of children, subject to prescribed exemptions. Businesses should therefore review analytics, advertising and profiling technologies used on child facing services.

Q5. Can businesses show targeted advertisements to children?

Targeted advertising directed at children is restricted under Section 9, subject to prescribed exemptions.

Q6. Does the DPDP Act apply only to children's apps?

No. The relevant obligations can affect any Data Fiduciary processing personal data of children. This can include education, healthcare, gaming, retail, entertainment and other digital services.

Q7. Are schools exempt from children's data requirements?

The Rules provide specific exemptions for certain educational institutions and specified purposes. These exemptions are conditional and should not be interpreted as a general exemption from all DPDP obligations.

Q8. When will Section 9 become applicable?

Section 9 is scheduled to commence eighteen months after 13 November 2025, alongside other substantive provisions listed in the commencement notification. This places the scheduled commencement date at 13 May 2027, subject to any subsequent notification or amendment.

Q9. What penalties can apply for children's data violations?

The DPDP Act's Schedule provides for a penalty of up to ₹200 crore for breach of the additional obligations relating to children. Other contraventions carry different maximum penalties.

Q10. Is a privacy policy enough for compliance?

No. Businesses need a broader framework covering data mapping, consent management, security safeguards, vendor governance, retention, rights management, incident response and internal accountability.

This update was released on 19 Aug 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.