Who Is a Child Under DPDP?
LawThe Act defines a child as an individual under 18 years of age. This is a meaningfully higher threshold than several other jurisdictions' data protection frameworks (which often draw the age of digital consent at 13 or 16) — a business benchmarking against a GDPR-style age threshold and assuming DPDP matches it will get the applicability of this chapter wrong.
Children's Personal Data
Everything covered in Chapter 02 about what counts as personal data applies equally here — a child's name, school, location, or online activity is personal data in the same sense an adult's is. What changes isn't the definition of the data, but the standard applied to processing it.
Parental Consent Requirements
LawSection 9 requires a Data Fiduciary to obtain verifiable consent from a parent or lawful guardian before processing a child's personal data. "Verifiable" is doing real work in that sentence — a simple age-gate checkbox ("I am over 18" or "I have parental permission") that anyone can click through doesn't meet a verifiable standard on its own; some genuine mechanism to confirm the person consenting is actually the parent or guardian is required, though the Rules leave room for a range of practical approaches to that verification.
Processing Restrictions
LawThis is the part of Section 9 that goes further than most equivalent provisions elsewhere: the Act prohibits processing that involves tracking or behavioural monitoring of children, or targeted advertising directed at children — and it does so regardless of consent. A parent consenting on a child's behalf doesn't unlock this kind of processing; it's off the table by design. This is a genuinely different structure from the "get consent and proceed" pattern that governs most other DPDP processing.
An EdTech platform for school-age students can process a child's data (with verifiable parental consent) to deliver coursework, track academic progress, and communicate with parents. What it can't do — even with that same parental consent — is build a behavioural profile of the child's usage patterns to serve targeted advertising, because that specific processing is prohibited outright under Section 9, not merely gated behind consent.
Exemptions for Specific Classes
LawThe Act allows the Central Government to exempt certain classes of Data Fiduciaries, or certain purposes, from some of Section 9's requirements — contexts like healthcare, childcare, or educational institutions processing data for the child's safety or wellbeing are the kind of scenario this exemption power is aimed at. This is a notified exemption, not a self-assessed one: a business believing its context "obviously" warrants an exemption still needs that exemption to actually exist in a government notification, not merely feel reasonable.
Websites and Apps
PracticeAny website or app likely to be used by under-18s needs a genuine plan for this chapter, not an assumption that its audience is adult by default. This includes checking whether analytics or advertising SDKs embedded in the product are configured to profile or retarget any users who may be minors — a third-party SDK's default behaviour is still your compliance responsibility as the Data Fiduciary.
Apps, Gaming, and EdTech
These three categories carry particular exposure, since each frequently has a substantial under-18 user base by design. Gaming platforms in particular should audit whether any in-app advertising network is capable of targeting based on behavioural profiles that could include minors; EdTech platforms should separate "processing needed to deliver the educational service" (generally fine, with verifiable parental consent) from "processing used to optimise engagement or monetisation" (much more likely to run into the tracking/targeted-advertising prohibition).
Marketing Considerations
LawMarketing to children specifically, or building marketing systems that can't reliably exclude users known or reasonably believed to be minors, is a direct exposure point under this chapter — this connects directly to the marketing practices covered in Chapter 16, which should be read alongside this one for any business whose audience plausibly includes under-18s.
Treating a self-reported age field as sufficient both for consent purposes and for excluding minors from targeted advertising. A user can enter any age they like; relying on an unverified, self-reported field as your entire compliance mechanism for Section 9 doesn't meet the "verifiable consent" standard and doesn't reliably keep known or likely-minor users out of a targeted-advertising audience.