Navigating Children's Data: The Verifiable Consent Imperative Under DPDPA Section 9

The Digital Personal Data Protection Act, 2023 (DPDPA), now fully in force along with its accompanying rules, marks a significant shift in India’s data privacy landscape. Among its most impactful provisions is Section 9, which establishes stringent requirements for processing the personal data of children. For businesses operating in India, particularly those in the EdTech, gaming, social media, and even certain financial services sectors, understanding and implementing “verifiable parental consent” is not merely a compliance task but a fundamental reimagining of their data handling practices.

The Mandate of Verifiable Parental Consent

Section 9(1) of the DPDPA unequivocally states that a Data Fiduciary shall not process the personal data of a child without obtaining verifiable consent from their parent or lawful guardian. A “child” is defined under Section 2(c) as an individual who has not completed eighteen years of age. This 18-year threshold is notably higher than in some other jurisdictions, such as the GDPR’s default of 16 (with Member States able to lower it to 13), underscoring India’s commitment to robust child protection. Furthermore, Section 9(2) prohibits processing that could be detrimental to a child’s well-being, and Section 9(3) bans targeted advertising to children. While Section 9(4) offers a narrow exemption for processing data “not likely to cause harm” as prescribed by the DPDP Rules, the overarching principle remains clear: verifiable parental consent is the cornerstone for engaging with children’s data.

Challenges in the Indian Context

The DPDPA’s emphasis on “verifiable” consent introduces a complex implementation challenge, especially given India’s diverse digital landscape. The DPDP Rules are expected to elaborate on acceptable mechanisms, but businesses must proactively consider practical, scalable, and secure solutions.

One prominent debate revolves around identity verification. Leveraging existing national digital infrastructure, such as Aadhaar, for parental verification could offer a robust, albeit sensitive, solution. However, its use would necessitate careful consideration of privacy safeguards and potential legal challenges, given past judicial scrutiny of Aadhaar’s scope. Other methods could include:

• Government ID upload: Requiring parents to upload a copy of a government-issued ID, coupled with robust document verification technologies.
• Credit/Debit Card Verification: A nominal transaction to verify card ownership, a method sometimes used globally, but less ubiquitous for general consent in India.
• Third-party verification services: Relying on specialized providers to authenticate parental identity, which would require careful due diligence by Data Fiduciaries.
• Declarations with follow-up: A parental declaration followed by an additional confirmation step, such as an OTP to a registered mobile number or email, or even a call-back.

The digital divide in India further complicates matters. Any verification mechanism must be accessible to parents across varying levels of digital literacy and internet access. Overly complex processes risk excluding segments of the population, while overly simplistic ones may fail to meet the “verifiable” standard. Sector-specific regulations also play a role. For instance, while RBI, SEBI, or IRDAI may not directly dictate DPDPA compliance, their existing Know Your Customer (KYC) norms for minors in financial products (e.g., minor bank accounts, insurance policies) already require stringent parental verification, which can inform DPDPA compliance strategies in these regulated sectors.

Regulatory Expectations and Enforcement

The Data Protection Board of India (DPBI) will be instrumental in interpreting and enforcing Section 9. Businesses can expect the DPBI to issue guidance on what constitutes “verifiable” consent and the due diligence expected from Data Fiduciaries. The DPBI’s approach will likely balance the need for robust child protection with practical implementation challenges faced by businesses. Non-compliance carries significant penalties under Section 33, potentially reaching up to ₹200 crore for breaches related to children’s data, underscoring the high stakes involved.

The DPDPA’s provisions for children’s data are, in some ways, more prescriptive than the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which generally focus on due diligence for intermediaries. DPDPA specifically targets the processing of personal data, placing a direct onus on Data Fiduciaries. This layered regulatory environment means businesses must ensure their policies and technologies meet the highest common denominator of protection.

Practical Takeaway

Indian businesses, General Counsels, and Data Protection Officers must treat Section 9 of the DPDPA as a critical priority. This requires a comprehensive strategy that goes beyond mere checkbox compliance. Start by conducting a thorough data mapping exercise to identify all instances where children’s personal data is processed. Subsequently, invest in developing or integrating robust consent management platforms capable of implementing verifiable parental consent mechanisms. These systems should be user-friendly, secure, and adaptable to India’s diverse user base. Businesses should also clearly communicate their data practices to parents in an accessible format, ensuring transparency. Finally, adopt a “privacy by design” approach for any product or service targeting children, embedding data protection from the initial stages of development. Regular audits and seeking expert legal counsel will be essential to navigate this evolving regulatory landscape and mitigate the significant risks of non-compliance.