Businesses increasingly collect information from children through educational platforms, gaming applications, social networks, healthcare services, e commerce platforms and other digital products. As this activity grows, Children's Data Consent has become a significant legal and compliance issue in India. Under the Digital Personal Data Protection Act, 2023, businesses processing a child's personal data must obtain verifiable consent from a parent or lawful guardian before processing, subject to prescribed exemptions. The law also imposes separate restrictions on tracking, behavioural monitoring and targeted advertising directed at children.For businesses, the issue is not simply whether a consent box exists. The real question is whether consent was obtained from the right person, in a verifiable manner, before processing began, and whether the organisation's subsequent activities remain within the permitted legal framework.

Top Four Search Results for “Children's Data Consent”

Search results for this emerging legal topic vary considerably because the Indian DPDP framework is still being implemented. The most relevant results identified during the research include specialist explanations of Section 9 and the parental consent mechanism, alongside academic and professional commentary.

• DPDP Act India: Section 9, Processing of Children's Data
• DPDP Reference Hub: Children's Data and Verifiable Consent
• NMIMS Law Review: Parental Consent and the DPDP Rules
• CheckDPDP: Verifiable Parental Consent under the DPDP Act

The stronger content opportunity lies in moving beyond a simple explanation of parental consent. Businesses also need to understand the consequences of invalid consent, the distinction between consent and permission for specific processing activities, vendor exposure, security obligations, retention issues and the interaction between the Act and the notified Rules.

What the DPDP Act Requires When Businesses Process Children's Data?

Section 9 of the DPDP Act creates a special framework for processing personal data belonging to children. The Act defines a child as an individual who has not completed eighteen years of age. This threshold is important for Indian businesses because it is broader than the age threshold used in some other major privacy regimes. Before processing a child's personal data, the Data Fiduciary must obtain verifiable consent from the child's parent or lawful guardian. The requirement is not limited to particularly sensitive information. It applies to personal data of a child, subject to the exemptions created under the statutory framework. Section 9 also contains two important restrictions beyond consent. A Data Fiduciary must not process children's personal data in a manner likely to cause a detrimental effect on the child's well being. It must also not undertake tracking or behavioural monitoring of children or targeted advertising directed at children, subject to prescribed exemptions. This means parental consent should never be treated as a universal permission slip. A parent providing consent does not automatically authorise every form of data use.

Why Invalid Children's Data Consent Creates Legal Exposure?

The first risk arises when a business processes children's personal data without obtaining the required parental consent. Consider a learning application which allows a child to create an account independently. If the application begins collecting identifiable information before the required consent process is completed, the business may have difficulty demonstrating compliance with Section 9. The problem can become more serious where the business has no reliable record of how consent was obtained. A database entry stating "parent consent received" may not be sufficient if the organisation cannot demonstrate the verification process, date, relevant account and scope of the consent. A defensible consent system therefore requires more than an affirmative action by a user. It requires an auditable process.

Verifiable Parental Consent Is Different from Ordinary Consent

The DPDP Rules, 2025 provide the mechanism for verifiable parental consent. Rule 10 requires a Data Fiduciary to adopt appropriate technical and organisational measures to obtain verifiable consent from the parent before processing a child's personal data. The business must also exercise due diligence to establish whether the person identifying themselves as the parent is an identifiable adult. Rule 10 permits verification by reference to reliable identity and age information already available with the Data Fiduciary, or information voluntarily provided by the individual, including information made available through a virtual token issued by an authorised entity. This approach creates an important compliance distinction. A business cannot simply assume a person is a parent because the person has clicked "I am the parent". The organisation needs a reasonable and documented method for satisfying the statutory verification requirement. At the same time, the Rules do not require businesses to collect every conceivable identity document. A proportionate system should be designed around the statutory requirements, the nature of the service and the information already available to the organisation.

Consent Does Not Permit Behavioural Tracking of Children

One of the most important legal risks arises when businesses assume parental consent permits behavioural monitoring. Section 9 separately restricts tracking and behavioural monitoring of children. This means a business cannot necessarily justify behavioural profiling merely because a parent has approved the child's account. For example, an application might collect information about how long a child watches particular videos, which games they play, what educational content they select and how frequently they return. If this information is used to construct behavioural profiles, the business needs to assess whether the activity falls within the statutory prohibition or an applicable exemption. This is particularly relevant for advertising technology and recommendation systems. Product teams should therefore review analytics software, cookies, software development kits, pixels and similar technologies rather than focusing only on information deliberately collected through registration forms.

Targeted Advertising Creates a Separate Compliance Risk

Section 9 also restricts targeted advertising directed at children. The restriction matters because many digital businesses depend upon advertising systems operated by third party platforms. A business may not directly select an advertisement for a particular child. Its application may instead send user information to an advertising network which determines the advertisements displayed. From a compliance perspective, the technical architecture still needs careful examination. Businesses should understand what information is transferred to advertising providers, whether a child can be identified, whether the system creates profiles and whether advertising technology can distinguish children from adult users. The commercial arrangement with the advertising provider should also be reviewed alongside the technical configuration.

Processing Without Consent Can Create Contractual and Commercial Problems

Privacy non compliance is not confined to regulatory exposure. Businesses increasingly make representations about data protection in investment documents, customer contracts, vendor agreements and enterprise procurement questionnaires. A material privacy failure may therefore create contractual concerns if the organisation has represented compliance with applicable law. Investor due diligence can also expose weaknesses in children's data practices. An investor examining an education technology company, gaming platform or children's application may ask how age verification works, whether parental consent is documented, which vendors process children's data and whether the organisation has experienced privacy incidents. Poor documentation can therefore affect the commercial value of a business even before a regulatory authority becomes involved.

Third Party Vendors Can Multiply the Risk

Many businesses do not process children's data entirely within their own systems. Cloud infrastructure providers, analytics companies, customer relationship management platforms, messaging providers, advertising networks and outsourced support teams may all receive personal information. A business remains responsible for understanding these data flows.Suppose an application has a compliant parental consent mechanism but an analytics tool begins collecting information before consent is recorded. The organisation may still face a compliance problem. This is why vendor due diligence should form part of children's privacy governance. Contracts should address permitted processing, security safeguards, confidentiality, incident reporting, assistance with regulatory obligations and deletion or return of information where appropriate. Businesses reviewing their broader privacy and data protection laws framework should also map every third party receiving children's personal data.

Excessive Data Collection Can Create an Additional Risk

Consent does not make unnecessary collection appropriate. Businesses sometimes collect extensive information because it may become useful later. For children's services, this approach creates unnecessary privacy exposure. A business should consider whether each data field is genuinely required for the stated service.An educational platform may need a student's age group to provide appropriate learning material. It may not need precise location information. A gaming application may require an account identifier but have no genuine need for access to a child's contact list. Data minimisation reduces the consequences of a security incident and makes the organisation's compliance position easier to demonstrate.

Security Failures Can Compound Consent Problems

A business can obtain valid parental consent and still face legal exposure if children's personal data is inadequately protected. The DPDP Act imposes obligations on Data Fiduciaries concerning reasonable security safeguards. The Act also provides significant financial penalties for specified contraventions. A consent process therefore needs to sit alongside appropriate access controls, authentication, monitoring, secure storage and incident response procedures. Internal access should also be limited. Employees should receive access based on their actual responsibilities rather than unrestricted access to children's information. Security testing should cover both the application and the systems supporting the consent process.

Poor Consent Records Can Become a Serious Evidentiary Problem

One of the most overlooked risks is the inability to prove compliance. A business should be able to establish when consent was obtained, who provided it, how the person was verified and what processing was covered. The organisation should also understand how consent withdrawal is handled. If a parent withdraws consent, the business needs a process for responding appropriately and updating relevant systems. Simply changing a status field in one database may not be sufficient if children's information remains accessible through other systems or third party platforms. Good record keeping therefore has both legal and operational value.

Businesses Need to Consider the DPDP Implementation Timeline

The DPDP Act and Rules are being brought into force in stages. The Central Government notified the DPDP Rules, 2025 on 13 November 2025. The Rules provide different commencement periods for different provisions. Rules 3, 5 to 16, 22 and 23 are scheduled to commence eighteen months after publication. The corresponding commencement notification under the Act similarly places Sections 3 to 5, Sections 6 to 17 and several related provisions eighteen months after 13 November 2025. Section 9 therefore falls within the later commencement group. Businesses should not interpret the phased timeline as a reason to delay preparation. Rebuilding account registration, age assurance, parental verification, analytics and advertising architecture can take considerable time. Early preparation is particularly important for platforms with a large existing child user base.

What Businesses Should Do Before Processing Children's Data?

The starting point should be a detailed data mapping exercise. The business should identify where children's personal data enters the organisation, where it is stored, who can access it, which vendors receive it and how long it is retained. The next step should be an assessment of the registration and consent journey. The organisation should determine whether it can identify child users appropriately, whether parental verification works reliably and whether processing begins only after the required consent has been obtained.Technology should then be reviewed. Analytics, advertising, recommendation engines, cookies and software development kits should all be assessed. The objective is to ensure the actual technology reflects the organisation's legal position. Businesses should also review contracts with processors and vendors. Finally, the organisation should establish internal responsibility. Legal, product, engineering, marketing, security and compliance teams should understand their respective responsibilities. For organisations dealing with complex privacy questions, obtaining advice from a best corporate lawyer can help integrate data protection requirements with commercial contracts, technology arrangements and broader corporate governance.

Exemptions Need Careful Legal Assessment

The DPDP framework does provide exemptions for specified classes of Data Fiduciaries and purposes. The final Rules contain a Fourth Schedule setting out certain classes and purposes for which specified child related obligations do not apply, subject to conditions. Examples include certain healthcare activities, educational activities and child safety functions. Businesses should not assume an exemption applies simply because their service falls within a broad industry category. The conditions attached to an exemption matter. An educational institution, for example, may have a prescribed basis for tracking or behavioural monitoring when the activity is restricted to educational activities or the safety of enrolled children. The same principle cannot automatically be extended to commercial profiling for unrelated purposes. The safest approach is to document the precise statutory basis for any exemption relied upon.

Common Mistakes Businesses Should Avoid

A business may believe it is compliant because its privacy policy refers to children. This is insufficient if the underlying consent mechanism does not meet the statutory requirements. Another common mistake is relying entirely on self declared age information. Businesses also overlook third party analytics and advertising tools. A platform may appear compliant at the user interface level while collecting information through embedded technologies in the background. Another problem is treating parental consent as permission for all subsequent processing. Section 9 contains separate restrictions, including restrictions on tracking, behavioural monitoring and targeted advertising. Finally, businesses sometimes wait until enforcement becomes imminent before reviewing their systems. Privacy compliance is considerably easier when considered during product development rather than retrofitted into an established platform.

Conclusion

Processing children's personal data without proper consent is not simply a privacy policy issue. It can create regulatory, contractual, operational, security and commercial risks for businesses operating in India.The DPDP framework places children in a specially protected category. Businesses need verifiable parental consent before processing children's personal data where Section 9 applies. They must also consider separate restrictions concerning detrimental effects on well being, tracking, behavioural monitoring and targeted advertising. The strongest compliance approach begins with understanding the data flow. Businesses should know what they collect, why they collect it, how parental consent is verified, where the information goes, who can access it and when it should be deleted. Most importantly, legal compliance should match the technology in use. A carefully drafted policy cannot protect a business if its application behaves differently from the policy. The official Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 should remain the primary references when assessing current obligations and commencement dates.

Frequently Asked Questions (FAQs)

Q1. What is Children's Data Consent under Indian law?

It refers to the verifiable consent of a parent or lawful guardian required before a Data Fiduciary processes personal data belonging to a child, subject to applicable exemptions under the DPDP framework.

Q2. Who is considered a child under the DPDP Act?

The DPDP Act defines a child as an individual who has not completed eighteen years of age. The Central Government may notify a lower age for specified circumstances where the statutory conditions are satisfied.

Q3. Is a child's own consent sufficient?

No. Where Section 9 applies, the Data Fiduciary must obtain verifiable consent from the parent or lawful guardian before processing the child's personal data.

Q4. What does verifiable parental consent mean?

Rule 10 requires appropriate technical and organisational measures and due diligence to establish whether the individual identifying themselves as the parent is an identifiable adult. Verification may rely on reliable information already held by the Data Fiduciary or information voluntarily provided through specified mechanisms.

Q5. Does parental consent allow targeted advertising to children?

No. Section 9 separately prohibits targeted advertising directed at children, subject to prescribed exemptions. Parental consent should not be treated as permission to disregard this restriction.

Q6. Can businesses track children if parents have given consent?

Businesses must separately examine the prohibition on tracking and behavioural monitoring under Section 9. Consent does not automatically override this statutory restriction. Prescribed exemptions may apply in limited circumstances.

Q7. What happens if a business processes children's data without proper consent?

The business may face regulatory consequences under the DPDP framework, alongside contractual, commercial, reputational and investor due diligence risks. The applicable consequences depend on the nature and circumstances of the contravention.

Q8. Can schools and healthcare providers rely on exemptions?

Certain exemptions exist under the Fourth Schedule, but they are limited and conditional. A business or institution should establish the exact statutory basis and conditions before relying upon an exemption.

Q9. When should businesses begin preparing for children's data compliance?

Businesses should begin preparation before the relevant provisions become operational. Consent architecture, age assurance, vendor arrangements and technology controls can require substantial redesign, particularly for platforms with a large existing user base.

This update was released on 26 Aug 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.