Verifiable Parental Consent
Consent from a child’s parent or lawful guardian that the Data Fiduciary has checked is genuine.
Verifiable parental consent means a parent or lawful guardian agrees to the processing of a child's data, and the organisation has actually checked that the person is a real adult who is the parent or guardian. A simple tick-box is not enough.
Meaning of Verifiable Parental Consent
The fiduciary must make sure that the person giving consent is an identifiable adult and the child's parent or guardian, using reliable details of identity and age the fiduciary already holds, or a verified token from a government-backed service. Rule 10 sets out how.
Section 9(1) of the DPDP Act requires a Data Fiduciary, before processing the personal data of a child, or of a person with a disability who has a lawful guardian, to obtain the verifiable consent of the parent or lawful guardian in the prescribed manner. The word verifiable is deliberate. Ordinary consent under Section 6 only needs to be free, specific, informed, unconditional and unambiguous. Verifiable consent adds a layer: the fiduciary must be able to show who gave it and that this person could legally give it.
The method is set by the Rules. Rule 10 applies to children and asks the fiduciary to adopt appropriate technical and organisational measures to make sure the person claiming to be the parent is an identifiable adult. Verification can draw on reliable identity and age details the fiduciary already holds, or on details voluntarily provided by the individual, or a virtual token mapped to those details, from an entity authorised by law or the Government, including a Digital Locker service provider. Rule 11 sets the equivalent process for lawful guardians of persons with disability.
A child for this purpose is anyone who has not completed eighteen years, per Section 2(f). That is a high threshold compared with some other countries, and it means a service with college-age users must treat those under eighteen carefully. The Act places the burden on the fiduciary: Section 6(10) makes the fiduciary prove valid consent, and the same logic applies to proving that a parent's consent was properly verified.
Verifiable parental consent is not required in every situation. Rule 12 and the Fourth Schedule exempt certain classes of fiduciary, such as clinical establishments and educational institutions, and certain purposes, such as child safety, from Section 9(1) under conditions. Parental consent also sits alongside other duties that cannot be waived: Section 9(2) bars processing likely to harm a child's wellbeing, and Section 9(3) bars tracking and targeted advertising, whatever a parent says.
Examples of Verifiable Parental Consent
A learning app asks a parent to verify using a government-backed digital identity token before it creates the child's profile.
A coaching app for Class 6 to 10 asks every new learner to name a parent. The parent receives a link, confirms identity through a government-backed digital locker token, and ticks consent for named purposes. The child's profile is only activated after this completes.
A pocket-money app for teenagers lets 15 to 17 year olds hold a wallet linked to a parent. The parent, already a verified customer with full KYC, gives consent from her own account, and the app relies on the identity details it already holds, as Rule 10 allows.
A paediatric clinic app stores a child's records. As a clinical establishment it may fall within the Fourth Schedule exemption, but it still keeps a parent's authorisation on file for non-treatment features such as newsletters and research invitations, and records which purpose each covers.
Why Verifiable Parental Consent matters
Failing to obtain verifiable consent can attract a penalty of up to ₹200 crore, the ceiling set for breach of the children's obligations in the Schedule. Since a service may hold thousands of child profiles, one weak sign-up flow can turn into a systematic breach that the Board treats as a single serious failure rather than many small ones.
For families the stakes are practical. A child may not understand what happens to their data, and a parent who is never actually checked can be impersonated by the child themselves. A well-built verification step protects children from being enrolled without a responsible adult's knowledge. For the business, a smooth and trustworthy process also reassures schools and parents who decide which products children use.
How it works in practice
- 1Decide at the sign-up screen whether the user may be a child. Combine a declared date of birth with signals such as school email domains, class selection and product type, and route anyone under eighteen into a parent flow before any personal data beyond the minimum is stored.
- 2Build the parent flow around Rule 10. If the parent already has a verified account with you, confirm identity and age from those reliable details. If not, ask the parent to verify through a government-linked service or a virtual token, such as a Digital Locker credential, and store only the result you need.
- 3Link the verified parent to the child's account and record when and how verification happened, the version of the notice shown, and the purposes agreed. Keep these records so you can demonstrate compliance to the Board.
- 4Provide the parent with the notice under Section 5 and Rule 3 in plain language, listing the data collected, the purposes, and how to withdraw consent or complain, and make withdrawal as easy as giving consent.
- 5Re-verify when something material changes, such as a new purpose or a new feature that uses data differently, and have a process for the child reaching eighteen, after which the young person gives their own consent.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Accepting a checkbox that says "I am the parent". Rule 10 expects the fiduciary to check identity and age of the adult, not simply record a claim.
Forgetting the age limit is eighteen. Teams copy a threshold of 13 or 16 from foreign laws and leave older teenagers outside the parent flow.
Collecting a copy of the parent's full ID document and keeping it indefinitely. The aim is verification, so keep the minimum evidence and erase the rest when the purpose is served.
Thinking parental consent allows anything. Section 9(2) and 9(3) still apply, so harmful processing and behavioural tracking remain barred.
Compliance tips
Map every account type and product feature that may involve under-18s, including family plans, school integrations and referral programmes.
Use tokens or confirmations from reliable sources instead of storing identity documents, which also reduces your security exposure under Section 8(5).
Test the parent flow with real families for usability. A process parents abandon will push children to bypass it.
Log each step and keep records, so you can show the Board what you did and when.
Common questions about Verifiable Parental Consent
At what age is parental consent needed under the DPDP Act?
For anyone under eighteen. Section 2(f) defines a child as a person who has not completed eighteen years, and Section 9(1) requires verifiable consent of a parent or lawful guardian before processing a child's personal data, unless an exemption in the Rules applies.
Is verifiable parental consent the same as ordinary consent?
No. Ordinary consent under Section 6 is given by the [Data Principal](term/data-principal) herself. Verifiable consent is given by a parent or lawful guardian, and the fiduciary must also check the adult's identity and age using the methods in Rule 10 or Rule 11, which is a stricter step.
Does an exemption mean I can skip parental consent entirely?
Only where your organisation or purpose is within the Fourth Schedule under Rule 12, and its conditions are met. Even then, other obligations such as notice and security safeguards apply. Treat the exemption as narrow and confirm eligibility with legal advice.