Short answer: From 13 May 2027, an app must not track, behaviourally monitor or target advertising at anyone under 18 (s.9(3)), and verifiable parental consent does not lift that ban: only the Fourth Schedule exemptions do (s.9(4), Rule 12). For apps with young users, the practical question is which marketing SDKs and ad audiences must stay off for accounts identified as children.
What does the DPDP Act prohibit for children's ad tracking?
The DPDP Act prohibits a Data Fiduciary from undertaking tracking or behavioural monitoring of children, or targeted advertising directed at children, where a child is anyone who has not completed 18 years (s.9(3), s.2(f)).
- Child: an individual under 18 (s.2(f)). For a child, the Data Principal includes the parent or lawful guardian (s.2(j)).
- Verifiable consent: parental consent obtained in the manner set out in Rule 10 (Rule 2(1)(d)).
- Fourth Schedule: the classes of Data Fiduciary and purposes for which s.9(1) and (3) do not apply (Rule 12).
The wider children's duties, including how parental consent is verified, are on the children's data page. This page covers tracking, measurement and advertising only.
Does parental consent allow ad tracking of a child?
No. Section 9 sets out separate duties: verifiable parental consent before processing a child's data (s.9(1)), and a ban on tracking, behavioural monitoring and targeted advertising (s.9(3)). The ban does not say it can be lifted by consent.
- Only s.9(4) and Rule 12, through the Fourth Schedule, disapply s.9(3) for listed classes and purposes.
- The Government may notify an age above which an app with verifiably safe processing is exempt from s.9(1) and (3) (s.9(5)). No such notification was found as of 21 October 2026.
- Interpretation: a parent's consent therefore covers processing the app needs to run its service for the child, not behavioural tracking or targeted ads.
Which ad and measurement activities are affected?
The Act and Rules do not mention attribution, SDKs or advertising IDs. Interpretation: s.2 also gives no definition of tracking, behavioural monitoring or targeted advertising, so the table separates what the text says from what is interpretation.
| Activity, for users identified as children | Position | Basis |
|---|---|---|
| Targeted advertising directed at the child | Prohibited | s.9(3) |
| Adding the child to retargeting or lookalike audiences | Interpretation: likely prohibited as tracking and targeted advertising | s.9(3) |
| Install and event attribution to ad campaigns | Interpretation: no exemption for measurement or attribution | s.9(3) |
| Behavioural product analytics | Interpretation: at risk as behavioural monitoring | s.9(3) |
| Contextual ads not based on the child's behaviour | Open question | s.9(3) |
| Checks that harmful ads or content cannot reach the child | Exempt purpose | Fourth Schedule Part B |
| Real-time location tracking for the child's safety | Exempt purpose | Fourth Schedule Part B |
| Processing to confirm a user is not a child | Exempt purpose, with Rule 10 due diligence | Fourth Schedule Part B |
Check 10 of the marketing SDK checklist asks whether each SDK can be switched off for these accounts.
When does an app know a user is a child?
Interpretation: the law does not say. Neither the Act nor the Rules expressly require an app to verify every user's age, and Part B of the Fourth Schedule permits processing to confirm a user is not a child without setting a method. Timing matters for measurement:
- Interpretation: in many apps, attribution and analytics SDKs record the install at first open, before any sign-up screen asks for an age. For a mixed-audience app, that means tracking may have started before the app learns the user is under 18.
- Interpretation: asking for an age signal, such as a date of birth, before marketing SDKs start reduces that gap, and fits the consent-first sequence on the ad tracking consent page.
- Interpretation: once a user is identified as a child, telling each vendor to stop processing that user's data is the practical way to end tracking that has already started. The Act's explicit stop and erase duties towards processors (s.6(6), s.8(7)) are written for withdrawal and erasure, not for this case.
If you are unsure what your measurement partner collects at first open, MMPCompares has a plain explainer on what an MMP does.
Are edtech and gaming apps exempt?
Only partly, and only where the Fourth Schedule fits. Part A covers educational institutions, but only for tracking and behavioural monitoring for educational activities or the child's safety (Rule 12(1)).
- Interpretation: the Part A wording covers educational activities and safety, not advertising, so it does not appear to permit targeted advertising to students even where it applies.
- Interpretation: whether a commercial learning app counts as an "educational institution" is not settled by the text.
- Part A also covers clinical and mental health establishments and healthcare professionals (health services), allied healthcare professionals, crèche and day-care operators (safety) and transport providers engaged by these (location tracking during travel). Gaming apps are not listed.
What does the penalty exposure look like?
Breach of the s.9 duties carries up to ₹200 crore (Schedule item 3), joint second-highest in the Schedule with breach notification failures, after the ₹250 crore for security failures. The Board sets the amount after an inquiry, weighing nature, gravity, duration, the type of data and any mitigation (s.33(2)). See penalties.
What this means for your app
These are practical steps teams commonly consider. They are not a guarantee of compliance.
- A common approach is a single "child account" flag that every marketing SDK and ad audience export reads.
- Consider excluding these accounts from ad network event feeds, retargeting lists and lookalike seeds.
- Review ads shown to children for anything likely to harm their well-being (s.9(2)), and record when each account was identified as a child and when tracking stopped.