Navigating Children's Data: The Verifiable Consent Conundrum Under DPDPA Section 9

The Digital Personal Data Protection Act, 2023 (DPDPA), now firmly in force, marks a significant shift in India’s data governance landscape. Among its most impactful provisions, Section 9, dedicated to the processing of children’s data, stands out as a critical area demanding meticulous attention from Data Fiduciaries across sectors. This provision introduces a stringent requirement for “verifiable parental consent,” a concept that, while globally recognised, presents unique implementation challenges and opportunities within the Indian context.

Section 9’s Mandate: Protecting Our Youngest Data Principals

At its core, Section 9 of the DPDPA establishes a protective framework for individuals defined as “children” – those under the age of eighteen years, as per Section 2(c). The Act mandates that a Data Fiduciary must obtain verifiable consent from the parent or lawful guardian before processing any personal data of a child (Section 9(1)). This isn’t merely a formality; it’s a fundamental shift, placing the onus on businesses to actively confirm the legitimacy of consent provided on behalf of a minor. Furthermore, Section 9(2) imposes a crucial obligation: Data Fiduciaries must ensure that the processing of a child’s personal data does not have any detrimental effect on the child’s well-being. This principle of “best interest of the child” is paramount and must guide all data processing activities involving minors.

The DPDPA Rules, promulgated under Section 40, are expected to provide specific mechanisms and standards for achieving this “verifiable consent.” While the Act lays down the principle, the practical modalities—how to verify age, how to verify parental relationship, and what constitutes adequate consent—are being fleshed out through these detailed regulations and subsequent guidance from the Data Protection Board of India (DPBI). This approach mirrors frameworks like the GDPR’s Article 8, which also defers to national law for specific age verification methods, but the Indian context introduces distinct complexities.

The Verifiability Challenge: A Uniquely Indian Context

Implementing “verifiable parental consent” in India presents a multi-faceted challenge, primarily due to the country’s vast digital diversity, varying levels of digital literacy, and the absence of a single, universally accepted digital identity mechanism for parental linkage. Unlike some Western nations where credit card verification or specific government-issued digital IDs might be leveraged, India’s solutions must be tailored.

For many Data Fiduciaries, especially those in online gaming, ed-tech, social media, and e-commerce, the question isn’t just if they need consent, but how to verify it robustly and scalably. Potential methods being explored include:

1. Identity Document Upload: Requesting parents to upload government-issued IDs (e.g., Aadhaar, PAN, driving license) for verification. This raises significant privacy concerns regarding the collection of sensitive personal data and the burden of manual review.
2. Knowledge-Based Authentication (KBA): Asking questions only a parent would likely know. While seemingly simple, KBA can be vulnerable to social engineering and may not meet the “verifiable” threshold for high-risk processing.
3. Third-Party Verification Services: The emergence of specialised services that can verify age and parental linkage through various data points, often leveraging telecom or financial data, is promising. However, their regulatory compliance and data security practices must be rigorously vetted.
4. Financial Transaction Verification: For services that involve payments, using a parent’s credit or debit card for a nominal transaction can serve as a verification method, though this excludes a significant portion of the population without access to such instruments.

The DPDPA Rules are anticipated to offer clarity on acceptable verification thresholds, potentially distinguishing between low-risk and high-risk data processing scenarios. The DPBI, as the enforcement authority under Section 19, will play a crucial role in interpreting these rules and issuing guidelines, helping businesses navigate this complex terrain without stifling innovation in services beneficial to children.

Sectoral Overlap and Regulatory Synergies

The DPDPA’s Section 9 does not operate in a vacuum. Its requirements intersect with existing and evolving norms from sectoral regulators. For instance:

• RBI-regulated entities: Fintech companies offering services to minors (e.g., pocket money apps, junior savings accounts) must reconcile DPDPA’s verifiable consent with RBI’s stringent Know Your Customer (KYC) norms. Parental consent for financial transactions involving minors is already a requirement, but the DPDPA elevates the verification standard.
• SEBI-regulated entities: Investment platforms that might allow parents to set up accounts for minors will also need to ensure compliance with Section 9, alongside SEBI’s investor protection guidelines.
• IRDAI-regulated entities: Insurance providers offering child-specific policies will need to align their consent mechanisms with DPDPA, especially when collecting health or other sensitive data.
• IT Rules, 2021: Social media intermediaries and significant social media intermediaries, already grappling with age verification under the IT Rules, will find their obligations reinforced and expanded by DPDPA’s verifiable consent mandate. This is particularly relevant for platforms popular with teenagers.

Harmonisation between these regulatory frameworks is key. Data Fiduciaries must adopt a holistic compliance strategy, ensuring that their consent mechanisms satisfy not only the DPDPA but also any specific requirements from their respective sectoral regulators.

Beyond Consent: Prohibitions and Safeguards

Section 9 extends beyond mere consent, imposing critical prohibitions to safeguard children. Data Fiduciaries are explicitly prohibited from undertaking tracking or behavioural monitoring of children, or targeted advertising directed at children (Section 9(3)). This is a significant restriction, fundamentally altering business models reliant on profiling and personalised ads for younger audiences. The only exceptions to these prohibitions are for processing “necessary for the safety of a child” or “for providing counselling or child protection services” (Section 9(4)), subject to prescribed conditions. This reflects a strong legislative intent to create a digital environment where children are not exploited for commercial gain through their data.

Practical takeaway: Indian businesses, GCs, and DPOs must proactively review and overhaul their data processing operations involving children. This includes mapping all data flows, identifying data principals under 18, and developing robust, DPDPA Rules-compliant verifiable parental consent mechanisms. Prioritise privacy-by-design principles in all child-centric services, ensuring that the “best interests of the child” are at the forefront. Invest in clear, age-appropriate privacy notices and consent interfaces. Stay abreast of the evolving DPDPA Rules and DPBI guidance, and be prepared to adapt, as the interpretation and enforcement of Section 9 will undoubtedly shape the future of digital services for India’s youth.