Under Section 9 of the DPDP Act, a business must obtain verifiable consent from a parent or lawful guardian before processing personal data of anyone under 18. It must not track, behaviourally monitor or target advertising at children, or process data in a way likely to harm a child. Rule 10 requires checking that the parent is an identifiable adult, for example through reliable records or a token such as DigiLocker. Breaches can cost up to ₹200 crore.
- Child means
- Under 18 years
- Consent from
- Parent or lawful guardian, verified
- Targeted ads to children
- Prohibited
- Penalty
- Up to ₹200 crore
What is required
- Verifiable consent of the parent or guardian before processing a child's data.
- Due diligence that the person consenting is an identifiable adult: using details already held, or details and identity tokens from an authorised entity such as DigiLocker (Rule 10).
- No processing likely to have a detrimental effect on a child's well-being.
- No tracking, behavioural monitoring or targeted advertising directed at children.
Exemptions
The Fourth Schedule to the Rules exempts some classes and purposes from parts of these duties, such as clinical establishments and healthcare professionals, educational institutions and childcare or creche providers (for tracking needed for education, safety and supervision), and specific purposes like a child's real-time location for safety. Check the exact entry before relying on it.
For a person with a disability who cannot take legally binding decisions even with support, consent must come from their lawful guardian, verified under Rule 11.
Frequently asked questions
What age is a child under the DPDP Act?
Anyone who has not completed 18 years. This is stricter than the EU GDPR, where the default age is 16.
How do I verify a parent's age under DPDP?
Rule 10 allows using reliable identity and age details you already hold, or details and a virtual token from an entity entrusted by law or the government, such as DigiLocker.
More DPDP Act guides
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- Does the DPDP Act apply to my business?
- DPDP Act penalties
- Consent and privacy notice under DPDP
- Data breach reporting under DPDP (72 hours)
- Significant Data Fiduciary (SDF)
- Data Protection Officer (DPO) under DPDP
- DPDP Act vs GDPR
- DPDP and marketing (email, WhatsApp, calls)
- Employee and HR data under DPDP
- Data Principal rights and requests
- Data retention and erasure under DPDP
- Cross-border data transfer under DPDP
- DPDP compliance cost in India
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.