If your product could plausibly have a user under 18, and for most consumer apps it could, the DPDP Act's children's data provisions apply whether or not you built your platform with children in mind. The penalties for getting this wrong are among the steepest in the entire framework.

Verifiable parental consent

Section 9(1) requires a Data Fiduciary to obtain verifiable consent from a parent or lawful guardian before processing a child's personal data. Rule 10 sets out how: the Data Fiduciary must apply due diligence to confirm that whoever is identifying themselves as the parent is genuinely an identifiable adult, checking either reliable identity and age details it already holds, or details the parent voluntarily provides, including through identity mechanisms like a Digital Locker. A simple tick-box confirming the parent is over 18, filled in on the parent's behalf, does not meet this bar.

The absolute ban on tracking

Section 9(3) is unconditional in a way few other parts of the Act are. A Data Fiduciary must not undertake tracking or behavioural monitoring of children, or target advertising at them, regardless of whether a parent has consented to it. Section 9(2) adds a further requirement that processing must not cause any detrimental effect on a child's wellbeing. Consent can authorise the processing a service genuinely needs to function. It cannot authorise building an advertising profile of a minor.

Age-gating in practice

Product teams need to build these constraints directly into the user onboarding flow.

  • Implement real age-gating at signup, rather than a single self-declared checkbox that anyone can click past.
  • Build a parental verification flow that checks an identifiable adult, not just a click, before unlocking the account.
  • Ensure analytics and advertising SDKs are hardcoded to default off for any account flagged as belonging to a minor.
  • Run periodic audits of third-party SDKs to confirm none of them are quietly profiling or targeting minor accounts behind the scenes.

The bar here is deliberately high. With penalties running up to two hundred crore rupees for violations of these specific obligations, the law's seriousness is calibrated to match the population least able to consent for itself.