Age Verification
Checking that a user is the age they claim to be, so children can be identified and protected.
Age verification means checking, to a reasonable level of confidence, that a user is as old as they say, so that children can be spotted and protected. The Act sets a duty that depends on it but leaves the method to the organisation.
Meaning of Age Verification
The Act does not prescribe one method. Because the rules for children depend on knowing who is under 18, fiduciaries need a reliable way to tell. A date-of-birth box that a child can bypass is weak. Methods range from declarations with checks to verified tokens.
The DPDP Act never uses the phrase age verification as a heading, yet the whole children's regime depends on it. Section 9 requires verifiable parental consent before processing a child's data and bans tracking, behavioural monitoring and targeted advertising directed at children. A fiduciary cannot apply those rules to the right people unless it can tell who is under eighteen, which Section 2(f) fixes as the age of a child.
The Act and Rules do not prescribe a single method for finding a user's age. What Rule 10 does regulate is the step after that: confirming that the adult who consents for a child is an identifiable adult, using reliable details already held, or details or a virtual token from an authorised entity, including a Digital Locker service provider. Age verification of the user and identity verification of the parent are therefore connected but distinct tasks.
Methods sit on a ladder of strength. At the bottom is a self-declared date of birth, which a determined child can bypass in seconds. Higher up are declarations backed by checks, such as school-issued email addresses, payment instruments held by adults, or a mobile number tied to a verified adult account. At the top are tokens that confirm an age band from a trusted source without revealing the underlying document. The right level depends on the risk: a service with adult content or chat features needs a firmer method than a recipe site.
Age checks create their own data protection duty. Collecting a photo of an ID card to confirm age is itself processing of personal data, so the notice, security safeguards under Section 8(5) and Rule 6, and erasure under Section 8(7) all apply to the evidence you gather. The principle of keeping only what you need points toward methods that return a yes or no result rather than a stored document.
Examples of Age Verification
A social app asks for a date of birth and, for users who appear to be under 18, requires a parent to complete verification.
A photo-sharing app asks for a date of birth, then uses a signal from the user's linked school email to flag likely minors. Flagged accounts move to a restricted mode with no ad targeting, and the app asks a parent to complete verification.
A gaming service offers paid loot boxes. It asks players who declare themselves adults to confirm through a government-backed token that says only "over 18: yes", and stores nothing except that result and the date.
A school management app already knows each pupil's class and age from enrolment records. It relies on that existing data rather than asking children to type their age, and sets all pupil accounts to child mode.
Why Age Verification matters
If age is judged poorly, one of two failures follows. Either children slip through and are tracked or enrolled without a parent, which risks a penalty of up to ₹200 crore for breach of children's obligations, or adults are wrongly blocked and the service loses customers. Neither is cost-free, so proportionate design matters.
A badly designed check can also turn into a privacy problem of its own. Collecting and retaining identity documents from millions of users to prove age creates a high-value store that attackers would target, and a breach of it would carry a separate exposure under Section 8(6) and the penalty for failing to keep reasonable security safeguards, up to ₹250 crore.
How it works in practice
- 1Start with a risk assessment. List the features that would be harmful or unlawful for a child, such as chat with strangers, targeted ads, or financial products, and decide how sure you need to be about age for each.
- 2Ask for date of birth neutrally, without hinting at the cut-off age, and stop users from trying again with a different date straight after being rejected, for example by a short cooling-off period.
- 3For accounts that look like children, route into the parent flow in Rule 10 before collecting anything beyond the minimum, and add extra checks where signals conflict, such as a school email address with an adult birth year.
- 4Where you need stronger assurance, use a token from an authorised entity that confirms the user is above or below eighteen without sharing the document itself, and store only the result and date of check.
- 5Retain the evidence for a short, defined period, then erase it, and make sure the notice explains why age is being checked and how the answer is used.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Relying only on a date-of-birth field a child can edit. This is easy to bypass, so it is weak evidence if the Board asks how you identify children.
Collecting ID scans from everyone "to be safe" and keeping them. That creates a new store of risky data; prefer methods that return only a pass or fail.
Using age verification only at sign-up. Users age, change details and share devices, so risk-based rechecks are sensible for sensitive features.
Compliance tips
Match the strength of the check to the risk of the feature instead of applying one blunt rule to everyone.
Prefer yes-or-no age tokens over document copies, and treat any evidence you keep as personal data with a deletion date.
Design for usability. Checks that frustrate adults tend to be abandoned or evaded, which defeats the purpose.
Common questions about Age Verification
Does the DPDP Act require age verification?
It does not name a specific age verification method, but Section 9 and Rule 10 make it necessary in practice. You must be able to identify children to obtain verifiable parental consent and to switch off tracking and targeted advertising for them.
What age counts as a child in India under the DPDP Act?
Anyone who has not completed eighteen years. Section 2(f) sets this single threshold, so there is no lower band like 13 or 16 for independent consent. Every user under eighteen needs the parental consent process unless an exemption in the Rules applies.
Can I use Aadhaar or DigiLocker to check age?
Rule 10 recognises identity and age details or virtual tokens issued by authorised entities, and names Digital Locker service providers among them. How you use any government-linked service must follow its own rules and the minimisation principle, so take specific legal advice before building the flow.