Children and guardians
A user under eighteen changes what your product may do.
India sets the line at eighteen, not thirteen or sixteen. Below it, a parent must give verifiable consent before you touch the data, and some things stay off the table even with that consent. The same guardian rule reaches adults with certain disabilities.
Back to DPDP services01 · Who is covered
Two groups who need a guardian in the loop
A child by age, and an adult whose decisions a lawful guardian takes.
Most teams think only about minors. The Act puts a second group under the same consent rule: a person with disability who has a lawful guardian. For both, the person who says yes is not the person whose data it is.
- Child
- Anyone who has not yet turned eighteen. There is no lower band for teenagers.
- Parent
- Includes a lawful guardian of the child where one acts in the parent's place.
- Person with disability
- An adult with a long-term impairment who, even with support, cannot take legally binding decisions, and who has a guardian under the relevant disability law.
- Lawful guardian
- For the disability case, someone appointed by a court, a designated authority or a local level committee under guardianship law.
For a guardian of a person with disability, the Rules ask you to check the appointment itself: who appointed them and under which law. A family member's word is not enough.
02 · Three duties
What the Act asks once a child is on the other side
One gate before processing, and two lines you do not cross.
- S9.1Parental consent firstObtain verifiable consent from the parent before any processing of the child's data, in the way the Rules prescribe.
- S9.2No harm to well-beingDo not process a child's data in a way likely to harm the child's well-being. No rule relaxes this one.
- S9.3No tracking or targetingNo tracking, no behavioural monitoring, and no advertising targeted at children.
The order matters. Consent comes before the account exists, not after a trial week. And a parent's consent does not unlock tracking or targeted ads: those bars stand on their own.
Only two of the three can bend
The Rules exempt certain fiduciaries and purposes from the consent duty and the tracking bar. Nothing exempts anyone from the duty not to harm a child's well-being.
03 · Checking the parent
Proving the adult is really an adult
The Rules ask for due diligence that the parent is an identifiable adult.
A tick-box saying "I am the parent" will not carry this. Rule 10 expects you to check that the person giving consent is an identifiable adult, using identity and age details you already hold and can rely on, or details they offer, either directly or as a virtual token from an authorised issuer such as a Digital Locker service.
| Who starts the sign-up | Is the parent already your user? | What you check before creating the child's account |
|---|---|---|
| The child, naming a parent | Yes | That the identity and age details you already hold for the parent are reliable and show an adult |
| The child, naming a parent | No | The parent's identity and age through details or a token from an authorised entity |
| The parent, for the child | Yes | The same check against the records you hold for that parent |
| The parent, for the child | No | Identity and age from an authorised source, which the parent may share through a Digital Locker service |
Rule 10 is in the group of Rules that commence eighteen months after publication. Build the flow now: retrofitting age checks onto a live user base is the slow way.
04 · Is this a child?
A decision path for every new account
Ask the age question early, and record how you answered it.
- Does the service collect any personal data at sign-up or in use? If not, the Act's child duties have nothing to attach to.
- Ask for date of birth or age before collecting anything else. Checking that a user is not a child is itself a permitted purpose under the Rules.
- If the user says eighteen or over and nothing you hold contradicts it, proceed as an adult account and keep the declaration.
- If the user is under eighteen, stop. Collect only what you need to reach the parent, and nothing for any other use.
- Run the parent check in the table above. If it fails, the child's account is not created.
- Before go-live, test whether a Fourth Schedule carve-out fits. If one does, record which one and the limit that comes with it.
- With consent in place, switch off profiling, tracking and ad targeting for the account, and keep the setting locked.
Signals that contradict a declared age, such as a school year in a profile or a parent's support ticket, should send the account back to step four. Write down how you handle that, because a reviewer will ask.
05 · Carve-outs
Where the Rules relax consent or the tracking bar
The Fourth Schedule lists classes of fiduciary and purposes, each with a tight limit.
| Who or what | Relaxed for | Limit that comes with it |
|---|---|---|
| Clinical and mental health establishments, healthcare professionals | Consent and tracking duties | Only to provide health services to the child, as far as needed to protect her health |
| Allied healthcare professionals | Consent and tracking duties | Only to support a treatment or referral plan a professional recommended |
| Educational institutions | Consent and tracking duties | Tracking and monitoring only for educational activities or the safety of enrolled children |
| Creches and child day care | Consent and tracking duties | Tracking and monitoring only for the safety of children in their care |
| Transport hired by a school or creche | Consent and tracking duties | Location tracking only during the journey to and from the institution |
| Duties under law in a child's interest | Consent and tracking duties | Only as far as the legal function needs |
| State subsidies, benefits, licences for a child | Consent and tracking duties | Only as far as issuing the benefit needs |
| An account used only for email | Consent and tracking duties | Only to create the account, used for email alone |
| Real-time location for a child's safety | Consent and tracking duties | Only real-time tracking, for safety and protection |
| Keeping harmful content or ads away from a child | Consent and tracking duties | Only what is needed to block that content |
| Confirming a user is not a child | Consent and tracking duties | Only what the age check itself needs |
Notice what is missing: there is no carve-out for edtech companies as such, for games, or for general consumer apps. The education entry covers an educational institution. Whether a commercial platform selling to schools counts is a question to put to counsel, not a safe assumption.
The Act also lets the government notify a lower age for a particular fiduciary whose processing of children's data it accepts as verifiably safe. We have not found such a notification; check before relying on one.
06 · By product
Edtech, games and family apps, illustrated
Three illustrative products, three different pressure points.
Illustrative
A learning app sold to parents
- Parent check before the child's profile exists
- Progress tracking framed as the service, not as behavioural profiling for ads
- No retargeting of the child on other sites
- The school carve-out does not cover a direct-to-parent app
Illustrative
A mobile game open to all ages
- Age gate at first launch, before analytics SDKs fire
- Under-18 accounts with ad personalisation off and engagement nudges reviewed for harm
- Third-party ad and analytics kits checked for what they collect by default
- Purchases routed through the parent
Illustrative
A family safety or photo app
- The parent is the account holder; children appear inside it
- Real-time location for safety may fit a carve-out; location history for insights does not
- Shared photos of children kept out of any recommendation engine
- Guardian status recorded where an adult with disability is a member
These scenarios are illustrative. They show where the questions land, not a ruling on any real product.
07 · Mistakes
Where child-data programmes go wrong
Most failures are design choices made before anyone thought about age.
- Using thirteen as the line. That number comes from other countries' rules. Under the Act a seventeen-year-old is a child.
- A checkbox for the parent. A self-declared parent with no check against reliable identity and age details falls short of Rule 10.
- SDKs that load before the age gate. If analytics or ad kits collect data on the first screen, processing has already started without consent.
- Treating consent as a pass for ads. Parental consent does not lift the bar on targeted advertising at children.
- Stretching the school carve-out. It covers an educational institution for education and safety, not every product used by students.
- Forgetting adult guardianship. Accounts run by a lawful guardian for an adult need the guardian's appointment checked too.
- No record of the age decision. If you cannot show how you decided a user was an adult, you cannot defend it to the Board.
Sources: the Digital Personal Data Protection Act, 2023 (sections 2 and 9, and the Schedule) and the Digital Personal Data Protection Rules, 2025 (rules 1, 10, 11 and 12, and the Fourth Schedule), as published by the Ministry of Electronics and Information Technology.
Questions about children's data
Is a sixteen-year-old a child under the DPDP Act?
Yes. The line is eighteen.
The Act defines a child as anyone who has not completed eighteen years. There is no separate teenage band, so a sixteen-year-old needs a parent's verifiable consent unless a Fourth Schedule carve-out applies.
Can a parent consent to targeted advertising for their child?
No. The bar holds even with consent.
The ban on tracking, behavioural monitoring and targeted advertising directed at children is a separate duty from consent. A parent's yes covers processing for the stated purpose; it does not switch the ban off.
Do we have to collect ID documents from every parent?
You need a reliable check, not necessarily a document upload.
Rule 10 accepts identity and age details you already hold and can rely on, or details the parent provides, including a virtual token from an authorised entity such as a Digital Locker service. Choose the lightest method that still proves an identifiable adult.
Does the school exemption cover an edtech company?
Not automatically.
The carve-out names an educational institution and limits it to educational activities and children's safety. A company selling directly to families is not an institution. A platform acting for a school is a closer question: have counsel look at the contract and the data flows.
What is the maximum penalty for breaching the children's duties?
The Schedule sets a ceiling of up to ₹200 crore.
The Act's Schedule caps the penalty for breaching the section 9 duties at up to ₹200 crore. It is a maximum the Board may impose after an inquiry, weighed against the factors the Act lists, not a fixed charge.
Find the children in your data before the Rules bite.
A DPDP readiness assessment maps where minors and guardians enter your product and tests your age and consent flow. Counsel should confirm how the law applies to your contracts and product.