Navigating Children's Data: The Verifiable Consent Imperative Under DPDPA Section 9

The Digital Personal Data Protection Act, 2023 (DPDPA), now fully operational, marks a significant shift in India’s data governance landscape. Among its most impactful provisions are those concerning children’s personal data, particularly Section 9. As of September 2026, data fiduciaries across India are grappling with the practical implications of securing “verifiable parental consent” – a standard that is both stringent and, in the diverse Indian context, uniquely challenging to implement.

The DPDPA’s Protective Framework for Children

The DPDPA establishes a robust protective framework for individuals under the age of eighteen, defined as a “child” under Section 2(c). At its core, Section 9(1) mandates that a Data Fiduciary must not process the personal data of a child without obtaining “verifiable consent” from their parent or lawful guardian. This isn’t merely a suggestion; it’s a foundational requirement. Beyond this, Section 9(2) imposes further restrictions, explicitly prohibiting Data Fiduciaries from undertaking tracking or behavioural monitoring of children, engaging in targeted advertising directed at them, or processing their data in any manner likely to cause detriment to their well-being. These prohibitions reflect a clear legislative intent to shield children from exploitative data practices, moving beyond mere consent to a broader “best interests of the child” principle. While the Act allows the Central Government to exempt certain fiduciaries from these provisions for specific purposes like education or safety (Section 9(3)), the general rule remains firmly in place, impacting a vast array of online services.

The Nuance of “Verifiable Parental Consent” in India

The critical challenge lies in the interpretation and implementation of “verifiable parental consent.” Unlike some global counterparts that might accept “reasonable efforts,” the DPDPA’s use of “verifiable” suggests a higher standard of assurance. The forthcoming DPDP Rules, specifically anticipated under Section 9(4), are expected to provide much-needed clarity on the specific methods and thresholds for such verification. In the absence of definitive rules, Indian businesses are exploring various approaches, each with its own set of complexities.

For instance, relying on digital identification methods, while seemingly efficient, presents hurdles. While Aadhaar is a robust identity system, its use by private entities for identification purposes requires careful navigation under existing laws and the DPDPA’s own principles of data minimisation and purpose limitation. Other methods like credit card verification are limited by India’s lower credit card penetration. OTP-based verification to a parent’s registered mobile number is common, but verifying that the number genuinely belongs to the parent of that specific child remains a gap. Age-gating mechanisms, often used globally, are notoriously easy for children to circumvent and do not meet the “verifiable” standard. The DPDP Rules will likely need to balance practicality with security, potentially outlining a tiered approach or specifying acceptable proof-of-parentage documents, perhaps leveraging existing government databases or secure digital locker services, while also considering privacy implications. This is where the Indian approach might diverge significantly from, say, GDPR’s Article 8, which asks for “reasonable efforts” to verify parental consent, a slightly less stringent phrasing than DPDPA’s “verifiable.”

Sector-Specific Considerations and Regulatory Synergies

The implications of Section 9 resonate deeply across several Indian sectors. The burgeoning ed-tech industry, for example, which frequently collects extensive data on children for learning analytics and personalised content, must entirely re-evaluate its data collection practices. Similarly, online gaming platforms, social media services, and content providers targeting younger audiences face a significant compliance burden.

Beyond the DPDPA, other sectoral regulators also play a role. The Reserve Bank of India (RBI) already has norms for minor bank accounts, requiring guardian involvement. While these existing KYC processes might provide a foundation, they don’t explicitly address the digital consent for data processing under the DPDPA. Similarly, the IT Rules, 2021, place due diligence obligations on intermediaries regarding content harmful to children, creating a synergistic regulatory environment where data protection and online safety converge. The Data Protection Board of India (DPBI) will undoubtedly work in tandem with these existing regulators to ensure a cohesive enforcement approach, especially when processing activities span multiple regulatory domains.

Challenges and the Path Forward

Implementing verifiable parental consent in a country as diverse as India presents unique challenges. The digital divide means that methods reliant on advanced digital literacy or specific payment instruments might exclude a significant portion of the population. Striking a balance between robust protection and ensuring children can still access beneficial online services (like educational platforms) without undue friction is crucial. Furthermore, Data Fiduciaries must consider the dynamic nature of consent – what happens when a child reaches eighteen? The DPDPA mandates that the Data Fiduciary must cease processing their data or re-obtain consent directly from the individual (Section 9(5)). The DPBI’s role in providing clear guidelines, issuing advisories, and enforcing these provisions will be paramount in shaping the practical application of Section 9.

Practical takeaway Indian businesses, particularly those in ed-tech, gaming, social media, and any sector interacting with individuals under 18, must urgently review and update their data processing frameworks. Proactively preparing for the DPDP Rules on verifiable parental consent is crucial; this includes investing in robust age verification technologies, exploring secure digital consent mechanisms, and conducting thorough Data Protection Impact Assessments (DPIAs) for all child-related data processing activities. Engage with legal counsel and DPOs to ensure compliance, prioritise the child’s best interests in all data handling, and train staff on the new requirements to mitigate the risk of significant penalties under the DPDPA.