Children's Data and the DPDP Act

What the Act requires

• Verifiable consent from a parent or lawful guardian before processing a child's personal data
• No tracking or behavioural monitoring of children
• No targeted advertising directed at children
• No processing likely to cause a detrimental effect on a child's wellbeing

"Verifiable" is doing real work in that sentence

A checkbox claiming to be a parent is not verifiable consent. The Rules set out how parental identity and age may be established, including reliance on virtual tokens and the details already available to the Data Fiduciary — follow the mechanism the Rules prescribe rather than designing your own.

Keep the consent artefact. You need to be able to show, later, that a specific adult consented for a specific child to a specific purpose.

Age assurance you can actually operate

Most services do not know how old their users are. Start by finding out where age signals already exist in your data — date of birth fields, school or exam identifiers, guardian relationships, product context. Discovery and classification will usually find more than the product team expects.

Treat an unknown age as a risk to resolve, not as permission to proceed. A field left blank is not an assertion of adulthood.

Where this bites hardest

• EdTech and schools, where almost the entire user base is in scope
• Gaming and social products with mixed-age audiences
• Healthcare, where paediatric records sit beside adult ones
• Any consumer service running advertising SDKs that profile by default

Exemptions exist, but narrowly

The Act allows certain classes of Data Fiduciary and certain purposes to be exempted from some of these duties by notification, and healthcare and educational contexts are recognised. Check whether a notified exemption actually covers your activity before relying on it — assuming one applies is a common and expensive error.