Processing of personal data of children
The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian, obtain verifiable consent of the parent of such child or the lawful guardian.
A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.
A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.
The Central Government may, by notification, exempt certain classes of Data Fiduciaries or processing for such purposes from the applicability of these provisions, having regard to factors such as verifiably safe processing and the volume of personal data processed.
- 'Child' under the Act means anyone below 18 years — there is no lower age-of-consent carve-out for teenagers as seen in some other regimes.
- Verifiable parental consent is required before collecting a child's data at all, not just for certain sensitive uses.
- Behavioural tracking and targeted ads aimed at children are barred outright, subject to narrow, government-notified exemptions (e.g. for platforms that can demonstrate verifiably safe processing, such as certain edtech or healthcare services).
Reconstructed for readability from the publicly notified DPDP Act, 2023. Always verify exact wording against the official Gazette of India before relying on this for legal or compliance decisions.