Short answer: Under the DPDP Act a child is anyone under 18 (s.2(f)). From 13 May 2027 an app must obtain verifiable parental consent before processing a child's personal data, and must not track, behaviourally monitor or target advertising at children (s.9). Rule 10 sets out how parental consent is verified.
Who is a child under the DPDP Act?
A child under the DPDP Act is an individual who has not completed the age of 18, and for a child the Data Principal includes her parents or lawful guardian (s.2(f), s.2(j)).
- Verifiable consent: consent obtained in the manner set out in Rule 10 for children (or Rule 11 for persons with disability) (Rule 2(1)(d)).
What does s.9 require of an app?
Section 9 imposes three duties: obtain verifiable consent from a parent or lawful guardian before processing any personal data of a child, avoid processing likely to harm a child's well-being, and never track, behaviourally monitor or target advertising at children (s.9(1) to (3)).
- Reported change: a Removal of Difficulties Order dated 5 October 2026 reportedly made a small textual correction to s.9(1), in the words referring to a person with disability. Commentators (SCC Online, King Stubb & Kasiva) report that it adds no new duties. The primary Gazette text was not retrieved for this guide.
How must parental consent be verified under Rule 10?
Rule 10 requires the app to adopt technical and organisational measures to obtain verifiable parental consent, including due diligence that the person claiming to be the parent is an identifiable adult. The check can rely on reliable identity and age details the app already holds, or on details voluntarily provided or a virtual token issued by an authorised entity, including through a Digital Locker service provider such as DigiLocker (Rule 10).
| Route under Rule 10 | When it fits |
|---|---|
| Identity and age details already held by the app | The parent is already a registered user |
| Details voluntarily provided by the individual | The parent is not yet a user |
| Virtual token from an authorised entity, including via DigiLocker | Where the parent prefers a token over sharing details |
Rule 10's illustrations cover four cases: the parent already registered or not, and the sign-up started by the child or by the parent.
Are any apps or purposes exempt?
Yes. Rule 12 and the Fourth Schedule disapply s.9(1) and (3) for some classes of Data Fiduciary and some purposes (s.9(4), Rule 12).
Part A, classes of Data Fiduciary (Rule 12(1)):
- clinical and mental health establishments and healthcare professionals, for health services
- allied healthcare professionals
- educational institutions, for tracking and behavioural monitoring for educational activities or child safety
- crèche and day-care operators, for safety
- transport providers engaged by these, for location tracking during travel
Part B, purposes (Rule 12(2)):
- exercise of legal powers in a child's interest
- State subsidies and benefits
- creating a user account limited to email communication
- real-time location tracking for the child's safety
- ensuring detrimental information, services or advertisements are not accessible to the child
- confirming that a Data Principal is not a child, while observing Rule 10 due diligence
Separately, the Government may notify an age above which a Data Fiduciary whose processing is verifiably safe is exempt from s.9(1) and (3) (s.9(5)). No such notification was found as of 21 October 2026.
Does the law require age verification of every user?
Interpretation: neither the Act nor the Rules expressly require an app to verify the age of every user. Rule 10 deals with verifying the parent once a child is identified, and Part B of the Fourth Schedule permits processing to confirm someone is not a child, but no method for identifying children is specified. This is an open question.
Interpretation: s.9(3) has no exemption for measurement or attribution. Behavioural tracking of users known to be children, and targeted advertising directed at them, appears prohibited even with parental consent unless a Fourth Schedule exemption applies. Whether contextual, non-behavioural ads shown to children count as targeted advertising is unclear.
What this means for your app
These are practical steps teams commonly consider. They are not a guarantee of compliance.
- Consider an age signal at sign-up (such as a date of birth or age declaration), and decide what happens when a user says she is under 18.
- A common approach is a separate flow for under-18 users that routes to a parent for verifiable consent using one of the Rule 10 routes.
- Consider switching off behavioural analytics, attribution and ad personalisation SDKs for accounts identified as belonging to children. See personal data in attribution.
- Check whether your app falls within a Fourth Schedule class, such as an educational institution, before assuming s.9 applies in full.
- Record how and when parental consent was verified, since the burden of proof for consent sits with the app (s.6(10)).
- Review content and features for anything likely to have a detrimental effect on a child's well-being (s.9(2)).
- Track progress in the readiness checklist and compare penalty exposure on the penalties page.