Navigating the Verifiable: Parental Consent for Children's Data under India's DPDPA
The Digital Personal Data Protection Act, 2023 (DPDPA), now fully operational with the DPDP Rules 2025 in effect, marks a pivotal shift in India’s data governance landscape. Among its most critical provisions is Section 9, dedicated to the processing of children’s data. For an India-first audience, understanding the nuances of “verifiable parental consent” in our diverse context is paramount, especially for businesses operating in the digital space.
The DPDPA’s Stance on Children’s Data
Section 9 of the DPDPA establishes a stringent framework for safeguarding the personal data of children, defined as individuals under the age of eighteen years (Section 9(1)). A Data Fiduciary is generally prohibited from processing the personal data of a child without obtaining verifiable consent from their parent or lawful guardian (Section 9(1)). This foundational requirement underscores the Act’s commitment to protecting vulnerable populations from potential data misuse and exploitation.
Beyond mere consent, the DPDPA imposes further obligations. Data Fiduciaries are explicitly barred from undertaking any processing of a child’s data that is likely to cause harm to the child (Section 9(2)). Crucially, Section 9(3) specifically prohibits tracking or behavioural monitoring of children, or targeted advertising directed at them. This reflects a clear policy intent to shield children from manipulative digital practices, a concern that has driven similar provisions in global privacy laws like the GDPR and COPPA. While the GDPR sets the age of consent at 16, with Member States allowed to lower it to 13, and COPPA specifically targets children under 13, India’s DPDPA takes a broader approach by setting the age at 18, reflecting a comprehensive view of childhood protection.
The “Verifiable” Imperative: India’s Unique Hurdles
The term “verifiable” is the linchpin of Section 9. It signifies that Data Fiduciaries cannot simply assume parental consent; they must take reasonable steps to ensure that the individual providing consent is indeed the parent or lawful guardian. The DPDP Rules 2025 are expected to elaborate on the specific mechanisms for achieving this, as empowered by Section 9(4), which allows the Central Government to prescribe the manner of obtaining verifiable consent.
However, implementing verifiable consent in India presents unique challenges. Unlike some Western nations with mature digital identity ecosystems, India’s diverse population, varying levels of digital literacy, and concerns around privacy and accessibility complicate a ‘one-size-fits-all’ solution. Potential methods could range from digital signatures linked to government IDs (like Aadhaar, though its use for consent verification would need careful consideration given past debates), knowledge-based authentication questions, or even credit card verification (which has limited applicability for a broad Indian demographic). The DPDP Rules will likely need to offer flexibility, allowing Data Fiduciaries to choose methods appropriate for their services and target demographics, while ensuring a minimum standard of verification. For instance, an educational app might employ different verification methods than an online gaming platform.
DPDP Rules and Sectoral Specifics
The DPDP Rules 2025 are the crucial next step in operationalising Section 9. They are anticipated to provide much-needed clarity on the ‘how’ of verifiable consent, potentially outlining a tiered approach based on the risk associated with the data processing, or prescribing specific technologies or frameworks.
Furthermore, sectoral regulators will play a significant role. The Reserve Bank of India (RBI), Securities and Exchange Board of India (SEBI), and Insurance Regulatory and Development Authority of India (IRDAI) may issue specific guidelines for financial institutions, investment firms, and insurance providers that offer products or services to minors. For example, opening a bank account for a minor or purchasing an insurance policy requires parental consent, and these regulators will likely align their existing Know Your Customer (KYC) norms with the DPDPA’s verifiable consent requirements. Similarly, the Ministry of Electronics and Information Technology (MeitY) through the IT Rules, particularly for social media intermediaries and online gaming platforms, could issue specific advisories complementing the DPDPA’s provisions, especially concerning the prohibition on tracking and targeted advertising for children.
Navigating the Balance: Protection vs. Access
While the DPDPA’s robust protection for children’s data is commendable, Data Fiduciaries must also navigate the delicate balance between stringent safeguards and ensuring children can access beneficial online services. Educational platforms, safe social learning environments, and health applications often serve minors and require some level of data processing. The Act’s intent is not to stifle innovation or access to beneficial services, but to ensure they are offered in a privacy-preserving manner. The ‘best interests of the child’ principle, while not explicitly defined in DPDPA, implicitly guides Section 9, requiring Data Fiduciaries to consider the overall welfare and developmental needs of children when designing their services and data processing practices.
Practical Takeaway
For Indian businesses, General Counsels, and Data Protection Officers, proactive compliance with DPDPA Section 9 is non-negotiable. Begin by conducting a thorough data mapping exercise to identify all instances where children’s data is processed. Implement robust age-gating mechanisms to accurately identify users under 18. Develop and deploy multiple, context-appropriate methods for obtaining verifiable parental consent, keeping in mind the diverse digital literacy levels across India. Prioritize data minimization, collecting only data strictly necessary for the service. Ensure that no tracking, behavioural monitoring, or targeted advertising is conducted for children. Stay abreast of the evolving DPDP Rules 2025 and any specific guidelines issued by sectoral regulators, as these will provide the granular detail needed for effective implementation. Regular audits and employee training are crucial to embed these practices within organizational culture and ensure ongoing adherence.