Children's Data and Verifiable Consent Under DPDPA Section 9

The Digital Personal Data Protection Act, 2023 (DPDPA), now fully operational as of November 2026, marks a watershed moment for data privacy in India. Among its most critical provisions are those safeguarding children’s data, primarily enshrined in Section 9. This section imposes stringent obligations on Data Fiduciaries processing the personal data of individuals under eighteen years of age, with “verifiable parental consent” standing out as a cornerstone requirement. For an India-first audience navigating global privacy developments, understanding these nuances is paramount.

The DPDPA’s Stance on Children’s Data

Section 9(1) of the DPDPA unequivocally mandates that Data Fiduciaries must obtain verifiable consent from a parent or lawful guardian before processing the personal data of a child. This sets the age of digital majority in India at 18, a higher threshold than some international counterparts like the GDPR, which permits member states to set the age between 13 and 16. This uniform 18-year age limit simplifies compliance across India but places a significant onus on platforms and services targeting younger demographics.

Beyond the consent requirement, Section 9(2) introduces crucial prohibitions. Data Fiduciaries are expressly forbidden from undertaking behavioural monitoring of children, targeted advertising directed at children, or any processing of children’s data that is likely to cause detriment to their well-being. These restrictions reflect a proactive approach to protecting children from exploitative data practices prevalent in the digital economy. While Section 9(3) allows the Central Government to exempt certain Data Fiduciaries (e.g., educational institutions) for specified purposes, the general rule of verifiable consent and strict prohibitions remains the default.

Navigating Verifiable Parental Consent in India

The true challenge for Indian businesses lies in operationalising “verifiable” parental consent. The anticipated DPDP Rules, which elaborate on the Act’s provisions, are expected to provide more specific guidelines on acceptable methods. Given India’s diverse digital landscape, a one-size-fits-all approach is unlikely to suffice.

Potential methods for verification in the Indian context could include:

1. Digital Identity Integration (Voluntary): Leveraging existing digital identity frameworks, such as voluntary Aadhaar-based e-KYC or DigiLocker, could offer robust verification. However, the DPDPA explicitly states that Aadhaar cannot be made mandatory for consent, so it would need to be an optional, secure method.
2. Payment Gateway Verification: For services involving micro-transactions, requiring a nominal payment via a parent’s verified bank account or UPI can serve as an indirect age and parental consent verification mechanism.
3. OTP to Registered Parent Numbers: Sending One-Time Passwords to mobile numbers explicitly registered and verified as belonging to the parent or guardian, potentially linked to official ID documents during initial onboarding.
4. Self-Attestation with Follow-up Verification: While less robust, initial self-attestation combined with a clear mechanism for subsequent, more rigorous verification (e.g., submission of ID documents, video calls) might be considered for certain low-risk data processing activities.
5. Offline Verification: For services with a physical presence (e.g., schools, coaching centres), traditional methods like signed consent forms with ID proof verification remain relevant.

The key will be balancing user convenience with the assurance that consent is genuinely provided by an adult. The Data Protection Board of India (DPBI) will play a pivotal role in issuing advisories and enforcing standards for these verification mechanisms.

Intersecting with Sectoral Regulations

The DPDPA’s requirements for children’s data do not exist in a vacuum. They significantly intersect with existing sectoral regulations and guidelines:

• IT Rules, 2021 (as amended): These rules already impose obligations on social media intermediaries and online gaming platforms regarding children’s safety and age-gating. The DPDPA strengthens these by adding explicit data processing consent requirements.
• RBI Norms: Financial institutions (banks, fintechs) dealing with minor accounts or services like digital wallets for children must now layer DPDPA Section 9 compliance on top of existing Reserve Bank of India (RBI) KYC and account opening norms. Verifying parental consent for any data processing beyond core financial services will be crucial.
• SEBI and IRDAI Regulations: Similarly, for investment products (SEBI) or insurance policies (IRDAI) involving minors, the DPDPA will necessitate explicit verifiable consent for data processing, complementing the existing regulatory frameworks.
• Ed-tech and Online Gaming: These sectors, heavily used by children, face the most immediate and significant impact. They must revamp their onboarding processes, data collection practices, and advertising models to align with Section 9.

Operationalising Compliance for Data Fiduciaries

For Data Fiduciaries, achieving compliance with Section 9 requires a multi-pronged approach:

1. Data Mapping and Inventory: Identify all instances where children’s personal data is processed.
2. Age-Gating Mechanisms: Implement robust age verification at the point of entry for services likely to be accessed by children.
3. Consent Management Platforms: Develop or integrate systems capable of obtaining, recording, and managing verifiable parental consent, including mechanisms for withdrawal of consent.
4. Privacy by Design: Embed privacy principles into the design of products and services, ensuring children’s data is processed with the highest level of protection.
5. Impact Assessments: Conduct Data Protection Impact Assessments (DPIAs) for any processing activities involving children’s data to identify and mitigate risks.
6. Training and Awareness: Educate employees on the specific requirements of DPDPA Section 9 and the importance of protecting children’s data.

Non-compliance with DPDPA Section 9 can attract substantial penalties under Chapter VII of the Act, underscoring the need for meticulous adherence.

Practical takeaway: Indian businesses, GCs, and DPOs must prioritise a comprehensive review of their data processing activities involving individuals under 18. This includes implementing robust, verifiable parental consent mechanisms that are both technologically sound and sensitive to India’s diverse digital landscape. Focus on integrating digital identity tools where appropriate and ensuring strict adherence to the prohibitions on tracking, targeted advertising, and detrimental processing. Proactive engagement with anticipated DPDP Rules and industry best practices will be key to navigating this critical aspect of India’s new data protection regime.