Processing children's personal data

Under Section 2(f), a child is anyone under 18. That is stricter than GDPR (13 to 16 depending on the member state) and much stricter than COPPA (13).

The definition sits in Section 2(f) of the Act. Every Data Fiduciary that could plausibly process personal data of a person under 18 must have a verifiable-parental-consent path. That includes edtech platforms, gaming apps, social media, music streaming, video streaming, banking apps offering junior accounts, health apps, and school administration systems.

Section 9 imposes three obligations on any Data Fiduciary processing children's data.

1. Sec. 9(1) — Verifiable parental consent. Before processing any personal data of a child, obtain verifiable consent from the parent or lawful guardian.
2. Sec. 9(2) — Same for persons with disabilities. Where a lawful guardian has been appointed for a person with disability, verifiable guardian consent is required.
3. Sec. 9(3) — Behavioural monitoring and targeted advertising ban. No tracking, no behavioural monitoring of children, no targeted advertising directed at children.

Section 9(3) applies regardless of consent. Even with verifiable parental consent, you cannot behaviourally track a child or serve them targeted advertising. This is a hard prohibition.

Rule 10 sets out approved methods to verify that consent for a child's personal data was given by the parent, and that the parent is who they say they are.

Rule 10 permits two verification paths. First, verification against reliable identity and age details already held about the parent, if the parent is themselves a Data Principal on your platform. Second, verification against a virtual token backed by a Digital Locker service provider (DigiLocker) or an equivalent identity service under the Central Government's designation.

The parent-child relationship must also be verifiable. Common approaches: Aadhaar-based Know Your Parent, DigiLocker parental-attestation flow, or a school-issued digital certificate linked to the child. Rule 10 takes effect on 14 May 2027.

Section 9(5) reserves a limited exemption power for the Central Government.

The Government may, by notification, exempt specific classes of Data Fiduciary or specific purposes from the age-of-consent requirement. In practice, this exemption is expected to apply to educational institutions, healthcare providers, and any Data Fiduciary whose processing is demonstrably in the child's interest and is limited to purposes the Government notifies as safe.

As of September 2026, no exemption class has been notified. Assume every child under 18 needs verifiable parental consent until the Government publishes a class-based carve-out.