Behavioural Monitoring and Tracking
Observing and recording what a person does, such as clicks, location or usage patterns, over time.
Behavioural monitoring means watching and recording what a person does online over time, such as what they tap, watch, search or where they go, and using that record to learn about them. For children, the DPDP Act forbids it.
Meaning of Behavioural Monitoring and Tracking
For children, the Act bars tracking, behavioural monitoring and targeted advertising directed at them, unless an exemption applies. For adults, tracking is allowed but needs a lawful basis, notice, and for non-essential tracking, consent.
Behavioural monitoring goes beyond collecting a single data point. It is the continuing observation of how someone behaves, such as the pages they open, the time they spend on a video, the levels they play, the places their phone visits, or the friends they message, so that a picture of habits and preferences emerges. The DPDP Act does not define the phrase, which means a fiduciary should read it by its ordinary meaning: systematic watching of conduct, not a one-off form field.
The key provision is Section 9(3). It says a Data Fiduciary shall not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children. Section 2(f) defines a child as anyone who has not completed eighteen years, so the ban reaches every teenager as well as small children. The prohibition is not softened by consent: obtaining a parent's verifiable consent under Section 9(1) makes processing a child's data lawful in general, but it does not make tracking or behavioural monitoring lawful.
There are two routes by which the ban can be relaxed. Section 9(4) allows the Rules to exempt certain classes of fiduciary or certain purposes, and Rule 12 with the Fourth Schedule does this for contexts such as clinical establishments, educational institutions and child-safety purposes, subject to conditions. Section 9(5) lets the Central Government notify a higher age for a fiduciary that has shown its processing is verifiably safe. Outside these exceptions, the safest reading is that a child-facing service should not run behavioural analytics tied to an individual child. Adults may be monitored, but only with a lawful ground and an honest notice under Section 5 and Rule 3.
Examples of Behavioural Monitoring and Tracking
A game that records every tap to build an advertising profile of a 13-year-old is engaging in behavioural monitoring that the Act bars.
A maths-practice app for ages 8 to 14 used to log every wrong answer and tap pattern to sell "engagement insights" to a partner. Under Section 9(3) the [profiling](term/profiling) is not allowed; the company keeps only the progress data a teacher needs to show a child's scores, and drops the resale.
A paediatric hospital's patient app records a child's vaccination reminders and appointment history. This is processed to give care and is likely to fall within the health-related classes in the Fourth Schedule, but the hospital does not add advertising trackers to the same app, because that extra monitoring has no health purpose.
A streaming service sees that a household profile is marked as a 12-year-old. It stops using viewing history to rank "recommended for you" rows from that profile and shows plain curated categories instead, while adult profiles keep optional personalisation.
Why Behavioural Monitoring and Tracking matters
The consequence of getting this wrong is financial and reputational. Breach of the children's obligations in Section 9 sits in the penalty Schedule at up to ₹200 crore per instance, decided by the Data Protection Board after an inquiry under Section 33. Even a fraction of that is serious for a mid-sized app, and a published Board order naming a company for tracking children is the kind of headline that parents and schools remember when choosing a product.
There is also a design cost. Many apps built for young users rely on analytics software development kits that quietly collect device identifiers and usage events by default. Under the DPDP Act the fiduciary stays responsible for such third-party code under Section 8(1), so a team that never meant to monitor children can still be liable. Finding and switching off these defaults before the main obligations apply on 13 May 2027 is far cheaper than redesigning after a complaint.
How it works in practice
- 1Map every place your product observes a user: analytics SDKs, advertising identifiers, session recordings, heat maps, location pings, in-app event logs and chat scanning. Write down for each what is collected, why, and whether it can be linked to a single person.
- 2Decide how you will recognise a child user. Because the ban depends on age, link it to your age-verification step and treat any account you cannot confidently classify as an adult with caution, rather than quietly running full tracking on everyone.
- 3For accounts identified as children, switch off behavioural profiling, ad identifiers and personalised recommendation engines tied to the individual, and keep only what the service needs to function, such as basic crash reports that are not linked to a person.
- 4Check whether Rule 12 and the Fourth Schedule apply to your service. A school or clinic may have a narrow exemption, but it is tied to specific conditions and purposes, so record in writing why your processing fits and review it when your features change.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Believing parental consent cures the problem. Consent under Section 9(1) covers processing in general, but Section 9(3) is a prohibition, so tracking a child remains unlawful even with a signed parent permission unless an exemption applies.
Assuming only large ad networks monitor children. A simple "analytics only" SDK that builds a user-level event history is also behavioural monitoring if it relates to a child.
Relying on a date-of-birth box to find out who is a child. A weak age check means the ban is applied unevenly, and the fiduciary cannot show it knew who it was monitoring.
Compliance tips
Audit third-party code first. Most unplanned tracking of children arrives through libraries added for convenience, so review your app's dependency list and the data each library sends out.
Separate what you need to run the service from what you want for growth. Keep the first and, for child accounts, switch off the second by default.
Keep a child-mode flag in your data model so that every analytics event can be filtered by it, rather than trying to scrub child data later.
Common questions about Behavioural Monitoring and Tracking
Does the DPDP Act ban tracking of adults?
No. The ban in Section 9(3) is limited to children. Adults can be tracked, but the processing still needs consent or a listed [legitimate use](term/legitimate-uses), a clear notice under Section 5, and reasonable security. Optional personalisation should be something an adult can decline without losing access to the basic service.
Can a school use analytics to follow a pupil's progress?
Possibly. Rule 12 and the Fourth Schedule contemplate educational institutions, subject to conditions and specific purposes. Following learning progress for teaching is different from building an advertising or behavioural profile. Schools should keep to the stated purpose and take legal advice on the exact conditions.
What is the penalty for monitoring children?
Breach of the children's obligations in Section 9 can attract a penalty of up to ₹200 crore, after the Data Protection Board holds an inquiry. The actual amount depends on factors such as the nature and gravity of the breach, repetition and steps taken to reduce harm.