A fifteen-year-old downloads your app, types a birth year that makes them twenty-two, and starts using it. Under the DPDP Act that sign-up is a problem, and the fact that they lied is not much of a defence.
A child is anyone under 18 in India, their data can only be processed with verifiable consent from a parent or lawful guardian, and tracking, behavioural profiling and targeted advertising directed at children are prohibited outright.
The bottom line
Who counts: anyone who has not completed 18 years of age, plus persons with disabilities who have a lawful guardian.
What you need: verifiable parental consent, obtained through approved methods including DigiLocker-based identity verification. A checkbox saying "I am a parent" is not one of them.
What is banned regardless of consent: tracking, monitoring, behavioural profiling and targeted advertising aimed at children.
What it costs: up to ₹200 crore per contravention.
Who counts as a child
A child is any individual who has not completed 18 years of age. That sits above the 13 and 16 thresholds common elsewhere, so a teenager treated as an adult user under US COPPA or parts of GDPR is still a child here.
For most gaming, social and ed-tech products the 13–17 band is a large slice of the user base, and it is the slice these rules land on. The same heightened protection extends to persons with disabilities who have a lawful guardian.
What "verifiable" actually demands
For a child, consent does not come from the child. It comes from a parent or lawful guardian, and it has to be verifiable — you must take reasonable steps to confirm that the person consenting really is an adult, and really is that child's parent or guardian.
The Rules build the approved approaches around reliable identity signals rather than self-declaration:
- verifying the parent's identity and age against reliable identity details, or a virtual token mapped to them; and
- integration with DigiLocker, the government-backed digital document wallet, to confirm identity and establish the parent–child relationship.
The design test is simple. Can a child click through the flow by pretending to be an adult? If yes, it is not verification. That makes this an engineering problem rather than a drafting one, and it is the part most teams underestimate.
What you cannot do even with consent
Some processing of children's data is banned outright, and parental consent does not unlock it. You must not track, monitor or behaviourally profile children, and you must not direct targeted advertising at them.
This is where ad-funded and engagement-optimised products run into trouble. A business model built on profiling young users to serve personalised ads, or to maximise time in app, collides with the prohibition directly. For a good number of ed-tech and gaming companies, complying means reworking how the product makes money, not just what the sign-up screen says.
Age-gating
Applying parental consent only where it is needed means first knowing who is a child. That requires age-gating: technical measures to detect, or reasonably establish, whether a user is under 18, and to stop processing a child's data before verified parental consent arrives.
A date-of-birth field that any twelve-year-old can lie past will not satisfy a regulator asking how seriously you took the obligation. Age assurance is the part of this framework most likely to attract enforcement attention as the Board finds its feet.
The exemptions
Blanket parental-consent and no-tracking rules would break services that genuinely need a child's data to function, so limited exemptions are expected to be notified for certain classes of Data Fiduciary and certain purposes. Healthcare providers, educational institutions and child-transport or child-safety services are the obvious ones.
Until those exemptions are notified and their boundaries are visible, treat them as narrow and design for the default rule. An exemption you have assumed into existence is not a defence.
The penalties
Processing children's data without verifiable parental consent, or tracking and targeting children, sits in the ₹200 crore tier — the same severe band as failing to report a breach.
Penalties apply per contravention, and the Board can publish the violation. For a product sold to families, that second part may hurt more than the first.
A worked example
A learning app for school students currently lets a child sign up with a name, an email and a self-entered age, then personalises content and shows ads against it.
What has to change:
- Age detection comes first, before any processing, to establish whether the user is under 18.
- Child users route to a parental consent flow with DigiLocker-based verification behind it, not a self-declared checkbox.
- Profiling and targeted ads switch off entirely for child accounts.
- Data collection narrows to what the educational service actually needs.
- Records are kept showing how each parental consent was verified — the obligation is to demonstrate compliance, not merely to have complied.
If the app later relies on a notified education exemption, it still has to stay inside that exemption's exact scope rather than treating it as a general pass.
Common mistakes
- Setting the threshold at 13 or 16 because that is what the US or EU product does. In India it is 18.
- Relying on a self-declared "I am a parent" checkbox. Consent has to be verifiable, not asserted.
- Profiling or advertising to children on the strength of parental consent. Consent does not make it lawful.
- Building an age gate a child can walk through. Weak age assurance is close to no age assurance.
- Assuming an exemption covers you. They are narrow, and some are still to be notified.
Frequently asked questions
What age is a "child" under the DPDP Act? Anyone who has not completed 18 years of age.
What is verifiable parental consent? Consent from a parent or lawful guardian, obtained using approved methods that confirm the adult's identity and their relationship to the child, including DigiLocker-based verification. A self-declared checkbox does not qualify.
Can I show targeted ads to children if a parent consents? No. Tracking, behavioural profiling and targeted advertising directed at children are prohibited regardless of consent.
What is the penalty for mishandling children's data? Up to ₹200 crore per contravention.
Are there any exemptions? Limited exemptions are expected for sectors such as healthcare and education, but they are narrow and some are still to be notified.
What if a child lies about their age? The duty is to build age-gating that reasonably establishes whether a user is under 18. A regulator will look at the measures you put in place, so a gate that is trivially bypassed does not help you.