Children's data under DPDP: the verifiable consent puzzle

SSection 9 of the DPDP Act is the most ambitious provision in India's privacy framework — and the one most likely to produce litigation. It defines a child as any Data Principal under eighteen years of age, requires verifiable parental consent before processing children's data, and prohibits behavioural monitoring or targeted advertising directed at children. The drafting is short. The operational consequences are vast.

Who counts as a child

Eighteen is a high bar by international standards. The GDPR sets the threshold at sixteen, with member states allowed to lower it to thirteen. The US COPPA framework cuts off at thirteen. India's choice of eighteen means a much larger category of users are caught — and a much larger category of products will have to either age-gate or default to the stricter regime.

What 'verifiable' will mean

The Act does not define 'verifiable parental consent', and the draft rules under consultation have been the subject of intense industry comment. Three approaches have been proposed:

• Government-ID verification of the parent, with a recorded consent against the parent's identity.

• Aadhaar-based verification (with the parent's authentication, not the child's).

• Third-party verification services that combine document checks with knowledge-based questions.

Each approach carries trade-offs. Aadhaar-based verification is operationally simplest but raises its own constitutional concerns under the Puttaswamy framework. Document-based verification scales poorly. Third-party services introduce a new chain of intermediaries who will themselves be data fiduciaries with their own compliance burden.

The behavioural monitoring ban

Section 9(3) flatly prohibits 'tracking or behavioural monitoring of children or targeted advertising directed at children.' The drafting admits no exception and no purpose-based override. For a platform that serves a mixed audience, the practical consequence is that personalisation must be turned off the moment a user is age-classified as under eighteen — including the implicit personalisation that comes from recency or popularity sorting if those signals derive from any other user's profile.

Industry has asked for a narrower reading; the Board has not yet weighed in. The cautious compliance position, for now, is to treat the prohibition as absolute and design product accordingly.