DPDPA Children's Data

The DPDPA treats children’s data with the highest care. If your product may be used by anyone under 18, these rules apply to you.

Verifiable parental consent

Before processing a child’s personal data, a Data Fiduciary must obtain verifiable consent from a parent or lawful guardian. “Child” means an individual under 18.

Hard prohibitions

• No processing likely to cause detrimental effect on a child’s well-being.
• No tracking or behavioural monitoring of children.
• No targeted advertising directed at children.

What this means in practice

You need reliable age assurance, parental-consent flows with records you can show a regulator, and controls that switch off tracking and ad-targeting for users identified as children. Classifying children’s data automatically is the first step.