Edtech platforms, schools and coaching institutes handle children's data, which the DPDP Act protects most strictly. Anyone under 18 is a child: you need verifiable parental consent, and you must not track, behaviourally monitor or target ads at children. Educational institutions get a limited Fourth Schedule exemption for tracking needed for education and safety; most commercial edtech apps do not. Penalties for breaching children's data duties go up to ₹200 crore.
- Child means
- Under 18
- Parental consent
- Verifiable (Rule 10)
- Targeted ads to students
- Prohibited
- Penalty
- Up to ₹200 crore
Where edtech, schools and coaching face the most DPDP risk
| Area | What to do |
|---|---|
| Student sign-up | Age gate and verifiable parental consent (Rule 10), e.g. via DigiLocker or details already held |
| Learning analytics and recommendations | No behavioural monitoring of children beyond what the exemption allows |
| Lead generation and counselling calls | Parents' consent for marketing; no buying of student lead lists |
| Recorded classes and proctoring | Notice, purpose limits, short retention of recordings |
| Ads and retargeting pixels | Remove ad tracking from pages used by children |
Other rules that apply alongside the DPDP Act
- Fourth Schedule to the DPDP Rules (exemptions for educational institutions and child-care providers)
- Consumer protection rules on dark patterns for sign-up and payment flows
Where another law sets a stricter or longer requirement, follow both: the DPDP Act does not override sector rules on retention or storage.
Six steps to comply
- Find every place a student under 18 can sign up or be added.
- Build parental consent with identity checks into onboarding.
- Turn off ad pixels, retargeting and behavioural profiling for under-18 users.
- Check whether the Fourth Schedule exemption covers you, and document why.
- Set retention for recordings, test data and inactive accounts.
- Train counsellors on consent for calls and WhatsApp.
Most DPDPA duties apply from 13 May 2027, with penalties up to ₹250 crore per breach. See the DPDPA 2027 roadmap and the DPDP compliance checklist.
Want it done for you? Our DPDP compliance service covers data mapping, notices, consent, vendor contracts, breach plans and staff training for edtech platforms, schools, colleges and coaching institutes.
Frequently asked questions
Does an edtech app need parental consent under the DPDP Act?
Yes, for any user under 18. Rule 10 requires verifiable consent of a parent or lawful guardian, checking that they are an identifiable adult.
Are schools exempt from DPDP children's data rules?
Partly. The Fourth Schedule exempts educational institutions from some children's data duties for tracking and monitoring done for education and the safety of children. Other duties, such as security and breach reporting, still apply.
Can edtech companies show ads to students?
Not targeted ads directed at children. Section 9 prohibits tracking, behavioural monitoring and targeted advertising directed at children.
DPDP guides for other industries
- DPDP Act (DPDPA), 2023: complete guide
- DPDP compliance checklist
- DPDPA 2027 compliance: deadline and roadmap
- DPDP compliance cost in India
- DPDP compliance for hospitals and healthcare
- DPDP compliance for fintech, nbfcs and lending apps
- DPDP compliance for e-commerce and d2c brands
- DPDP compliance for hr, staffing and recruitment firms
- DPDP compliance for real estate developers and brokers
See all deadlines on the compliance calendar, or browse the compliance hub.
This guide is general information based on the law as of 25 October 2026, not legal advice. Rules and dates can change by notification; speak to a professional about your situation.