Section 9: Processing of Personal Data of Children
Section 9 sets a strict default for anyone under eighteen: verifiable parental consent before processing, an outright ban on tracking, behavioural monitoring and targeted advertising directed at children, and a path for the Central Government to relax these rules for specific, verifiably safe use cases.
Quick summary
What Section 9 says
- Sub-section (1) — before processing personal data of a child, or of a person with disability who has a lawful guardian, the Data Fiduciary must obtain verifiable consent of the parent or the lawful guardian, in the prescribed manner — and “consent of the parent” includes consent of a lawful guardian, wherever applicable.
- Sub-section (2) — a Data Fiduciary shall not process a child's personal data in a manner likely to cause any detrimental effect on the child's wellbeing.
- Sub-section (3) — a Data Fiduciary shall not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children.
- Sub-section (4) — sub-sections (1) and (3) don't apply to processing of a child's data by such classes of Data Fiduciaries, or for such purposes, and subject to such conditions, as may be prescribed.
- Sub-section (5) — if satisfied that a Data Fiduciary has ensured its processing of children's data is done in a verifiably safe manner, the Central Government may notify, for that Fiduciary, an age above which it's exempt from all or any of the obligations under sub-sections (1) and (3), specifying that age in the notification.
Breaking it down
- Sub-s. (1)
Required
Verifiable consent of a parent or lawful guardian before any processing.
- Sub-s. (2)–(3)
Banned
Harmful processing, tracking, behavioural monitoring and targeted advertising.
- Sub-s. (4)–(5)
Exemptions
Prescribed classes or purposes, or a notified age for a verifiably safe Fiduciary.
The age threshold is fixed by the Act's own definition, not left flexible. Section 2(f) defines “child” as anyone who hasn't completed eighteen years — a stricter line than the 13-16 range common in some other jurisdictions' data protection laws.
“Verifiable” consent is a deliberately higher bar than ordinary consent. The Act requires the parent's or guardian's consent be verifiable, not just collected — the specific verification mechanics (what counts as adequate verification) are left to the DPDP Rules to prescribe.
The tracking/monitoring/targeted-advertising ban is absolute where it applies, not a consent-based opt-in. Unlike sub-section (1), which can be satisfied by obtaining valid parental consent, sub-section (3) is a flat prohibition — there's no consent mechanism that makes behavioural tracking or targeted advertising to children lawful under this section.
Two separate escape hatches exist, for different reasons. Sub-section (4) lets the government carve out specific, narrower classes or purposes (for example, an educational platform's limited internal progress-tracking might be treated differently from open-ended behavioural profiling) from both the consent and the anti-tracking requirements. Sub-section (5) is different: it's a Fiduciary-specific exemption for users above a notified age (not necessarily eighteen), granted only where the government is satisfied the Fiduciary's processing is verifiably safe — a case-by-case route, not a general carve-out.
Why this section matters
Children's data provisions are consistently among the most strictly enforced parts of comparable data protection regimes worldwide, and Section 9 signals the same priority here: verifiable (not just clicked-through) consent, a flat ban on the advertising techniques platforms most commonly build around engagement and monetisation when it comes to minors, and government-controlled (not self-certified) exceptions. Any product with users who could plausibly be under eighteen needs this section built into its architecture from the start, not retrofitted later.
Real-world example
Playnest, an ed-tech platform used by both schoolchildren and adult learners
Playnest's trust-and-safety team designs its age-handling logic around Section 9:
- A 12-year-old signs up through a school-issued account — verifiable parental or guardian consent is required under sub-section (1) before Playnest can process their data at all — a school-managed rollout still needs this built in, not assumed to be covered by the school's own arrangements unless the Rules specifically prescribe otherwise under sub-section (4).
- Playnest wants to show the 12-year-old ads for other apps based on their in-app behaviour — flatly prohibited by sub-section (3), regardless of what consent is on file — this isn't something parental consent can unlock.
- A 17-year-old on the verge of turning 18 uses a verified, ID-checked adult-learning track with no behavioural profiling at all — if Playnest can demonstrate this track is verifiably safe, it could apply for a Central Government notification under sub-section (5) exempting that specific cohort from sub-sections (1) and (3) obligations.
Who needs to care about this section
- Any consumer platform with users who could be under 18 — age assurance and verifiable parental consent need to be built into onboarding, not bolted on later.
- Ad-tech and growth teams — sub-section (3)'s ban on targeted advertising to children affects ad-targeting and personalisation systems directly, and can't be consented around.
- Ed-tech and youth-focused platforms — sub-section (4)'s prescribed carve-outs are worth tracking closely in the Rules, since they can materially change what's required for education-specific processing.
Common questions
Can a child consent to processing themselves once they're old enough to use an app independently?
Is it enough to just ask users to confirm they're over 18 at signup?
Can we ever show ads to teenage users?
Related sections
Section 10 — Additional Obligations of Significant Data Fiduciary
Continue to the next section in sequence.
Read Section 10Section 8 — General Obligations of Data Fiduciary
Go back to the previous section.
Read Section 8Chapter II — Obligations of Data Fiduciary
See every section in this chapter together.
View the chapterFull DPDP Act Guide
Back to the overview page, with the complete section-by-section guide.
View all 44 sectionsData Principal Rights
How rights and consent work for Data Principals generally, including children as a protected category.
Read about Data Principal rights