Child
An individual who has not completed 18 years of age.
Under the DPDP Act, a child is anyone below 18 years of age. Before a company handles a child's data, it needs a parent's or guardian's verified consent, and it cannot track the child or show targeted ads.
Meaning of Child
The Act's age of 18 is higher than in many countries, so teenagers are children. Processing a child's data needs verifiable consent of a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are not allowed, unless an exemption applies.
Section 2(f) defines a child as an individual who has not completed eighteen years of age. India has chosen the age of majority rather than a lower digital age of consent such as 13 or 16, which some other countries use. A seventeen-year-old who uses a food-delivery app, an exam-preparation site or a game is therefore treated, for the Act, in the same way as a seven-year-old.
Section 9 sets the core duties. Before processing a child's personal data, the Data Fiduciary must obtain verifiable consent of the parent or lawful guardian, in the manner the Rules prescribe. It must not process the child's data in a manner likely to cause a detrimental effect on the child's wellbeing, and it must not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. Rule 10 explains how the parent's identity and adulthood are verified, for example by existing reliable details or by a token from an authorised entity such as a Digital Locker service provider.
There are conditional relaxations. Section 9(4) and Rule 12 with the Fourth Schedule exempt certain classes of fiduciaries and purposes, such as clinical establishments and healthcare professionals providing health services, educational institutions for educational activities and safety, and child-care providers, but only for the purposes and conditions specified. Section 9(5) lets the Central Government notify a higher age for a fiduciary that processes children's data in a verifiably safe way.
A child remains a Data Principal; the parent acts for her in giving consent and in exercising rights. Section 2(j) includes the parent or lawful guardian in the Data Principal definition for this reason. The child's data is not a special category in the way sensitive data was under the earlier IT Act rules, but the Act applies the strictest consent and conduct standards here, and the penalty for failing the children's obligations can go up to ₹200 crore.
Examples of Child
A 15-year-old signing up for a gaming app is a child, so the app needs verifiable parental consent.
A homework-help app lets students aged 9 to 16 create accounts. It asks for the parent's details, verifies her through a Digital Locker token, disables ad identifiers for these accounts, and stores only the data needed to deliver lessons.
A casual mobile game finds that many of its players are 14 or 15. It stops personalised in-game offers for under-18 users, removes behavioural tracking and routes every new teen account through parental verification before play.
A clinic records a nine-year-old patient's symptoms for treatment. It relies on the Fourth Schedule category for clinical establishments and limits use of the data to health services, without using it for marketing or tracking.
Why Child matters
Children's data is where the Act expects the most from product design. Ed-tech apps, gaming platforms, social media services, kids' content sites and even e-commerce stores that sell school supplies must ask how they will know a user is under 18, and how they will reach a verified parent. If a service cannot answer these questions, it risks collecting data unlawfully on every under-18 account.
The impact goes beyond fines. A breach of children's data attracts public attention, and the ban on behavioural monitoring and targeted ads can force changes in how a business earns revenue. Companies with advertising-led models for teenage audiences need to redesign, not just add a consent banner.
How it works in practice
- 1Decide how you will know that a user is a child. Ask for date of birth or age band at sign-up, and treat a user as a child unless you have reasonable assurance of adulthood. Consider the likely audience of your product, not only declared age.
- 2Build a parent-verification flow in line with Rule 10. Where the parent is a known user, rely on the reliable details you already hold; otherwise use an authorised entity or a virtual token, including a Digital Locker service, to confirm that the parent is an adult.
- 3Switch off analytics, recommendation profiling, behavioural advertising and ad-tech SDKs for child accounts. Review third-party SDKs in your mobile app, since many collect advertising identifiers by default.
- 4Check whether the Fourth Schedule exemptions apply to you, and if you rely on one, note the exact purpose and conditions so that your processing stays within them.
- 5Give parents a simple dashboard to review, correct and erase the child's data and to withdraw consent, and keep records of the verification performed for each child account.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Treating 13 or 16 as the cut-off because a foreign law does so. In the DPDP Act, anyone below 18 is a child.
Using a self-declared "I am the parent" tick box. Rule 10 asks for verification of an identifiable adult, not a bare assertion.
Obtaining parental consent and then running behavioural advertising anyway. Section 9(3) bans tracking, behavioural monitoring and targeted advertising directed at children irrespective of consent, unless an exemption applies.
Forgetting existing users. Accounts opened years ago by users who were minors still fall within the Act when the main obligations start.
Compliance tips
Run an age-audit of your user base so you know how many users are under 18 and through which channels they arrive.
Keep child-account data minimal, with short retention periods, and delete it once the specified purpose is complete.
Review every advertising and analytics SDK with a child-safety lens before the 13 May 2027 date for the main obligations.
Write a short, child-friendly notice in addition to the parent-facing notice, in English or a language of the Eighth Schedule, so the child understands what is happening.
Common questions about Child
At what age is someone a child under the DPDP Act?
Anyone who has not completed 18 years is a child. The Act does not set a lower age of digital consent. So teenagers aged 13 to 17 need verifiable consent from a parent or lawful guardian before a Data Fiduciary processes their personal data.
Can a company show ads to a child if the parent consents?
Section 9(3) prohibits tracking, behavioural monitoring and targeted advertising directed at children. Consent does not cancel this bar. Limited exemptions can be prescribed for classes of fiduciaries or purposes, so a business should rely on one only after checking its exact scope.
How does a company verify that someone is the child's parent?
Rule 10 requires measures to ensure the person is an identifiable adult. A platform can use reliable details it already holds about the parent, or details and virtual tokens from an authorised entity, including a Digital Locker service provider. An unverified checkbox is not enough.
Are schools and hospitals exempt from the children's rules?
Not entirely. Rule 12 and the Fourth Schedule relax the parental consent and tracking requirements for specified classes, including clinical establishments and educational institutions, but only for listed purposes. Uses outside those purposes, such as marketing, need the usual verifiable consent.