DPDP Compliance for Edtech Platforms Serving Children

Any platform processing the personal data of a user under 18 needs verifiable parental or guardian consent before processing begins, under Section 9. For a K-12 edtech product, that means the sign-up flow itself has to establish age and route to a parent-consent step, rather than treating age as a self-declared field a ten-year-old can simply tick past.

The Rules describe mechanisms platforms can use to make that parental consent verifiable rather than nominal, and an edtech platform that only asks “are you over 18?” with no follow-through is not meeting the standard. School-issued accounts complicate this further, since the school or an administrator may be consenting on behalf of the institution while the parent relationship still needs to be addressed separately for individual student data.

Section 9 also prohibits behavioural monitoring and targeted advertising directed at children, which rules out building an ad-tech-style profile of a student's study habits, quiz performance, or attention patterns for commercial targeting purposes. This is a bright line, not a matter of getting a stronger consent — the Act does not permit consenting around it for children.

Freemium edtech products that monetise through in-app advertising need to separate their advertising logic entirely for child accounts: no interest-based ad selection, no cross-app tracking pixels, and no “personalised recommendations” engine repurposed from an adult product without stripping the profiling layer for minors.

Remote proctoring — webcam capture, screen recording, browser lockdown logs — collects a considerably more invasive data set than a standard course platform, often including a child's room, face, and background audio during an exam. Parents need clear notice of exactly what a proctoring session captures and how long the recording is kept, and “detrimental to the well-being of the child” processing is barred outright under Section 9, which should inform how long and how widely proctoring footage circulates internally.

Classroom analytics dashboards that rank or flag students based on engagement metrics are a legitimate pedagogical tool, but the underlying data should be treated as decision-affecting under the general accuracy obligation, since a mislabelled “disengaged” flag can follow a student through a term.

Edtech platforms frequently plug in third-party libraries for video hosting, plagiarism detection, or adaptive-quiz engines, each of which may receive student work product or performance data. Every one of those integrations is a processor relationship requiring a Section 8(2) contract, and none of them should be permitted to repurpose student data for their own model training or marketing without the platform's own consent chain covering it first.

Where a vendor is based overseas, the same cross-border considerations under Section 16 apply, and a school or parent has no visibility into that chain unless the platform's own notice discloses it.

Run the Consent Notice Builder to draft parental consent language that is specific about proctoring, analytics, and any third-party content vendors, rather than a single all-purpose clause. The Rights Navigator is also worth reviewing so parents have a clear, visible path to access, correct, or request erasure of a child's records.