Section 9(3): Total Ban on Tracking & Targeted Ads Directed at Children

Statutory Text (Official Gazette)

Section 9(3): A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.

What Section 9(3) Means in Plain English

Section 9(3) is a flat prohibition. Even if a parent gives consent, you may not track, behaviourally monitor, or target ads at anyone under 18. The only way out is an exemption prescribed under Section 9(4).

What Is Strictly Banned Under Section 9(3):

1. Behavioral Telemetry: Recording mouse movements, scroll depth, session recordings (e.g. Hotjar, FullStory, Clarity), or app usage patterns of minors.
2. Personalized Targeted Advertising: Serving ads based on a child’s past browsing history, search queries, or demographic profile.
3. Third-Party Tracking Pixels: Loading Meta Pixel, Google Remarketing Tags, or programmatic ad networks on pages accessed by identified minors.

Prescribed Exemptions (Rule 12 and the Fourth Schedule)

The Fourth Schedule allows tracking or monitoring of children only in narrow cases, each limited to what is necessary:

• Educational institutions: For educational activities or the safety of enrolled children.
• Creches and day care centres: For the safety of children in their care.
• School transport providers: Tracking location during travel to and from school.
• Healthcare providers: To provide health services or follow a treatment plan.
• Real-time location: Tracking a child’s location for her safety.
• Blocking harmful content: Processing needed to keep harmful information, services or ads away from children.

Advertising and marketing analytics are not on this list.

What Is Still Permitted:

• Contextual Ads: You may show a toy ad on a cartoon video based solely on the video topic itself, provided you do not build a profile on the individual child.
• Strictly Functional Analytics: Basic aggregate metrics (e.g. total pageviews or server error rates) that do not track identifiable user behavior.

Engineering Checklist for Section 9(3)

• Minor Account Tracker Killswitch: When an account is identified as under 18, automatically suppress all ad-tech SDKs and telemetry tracking across client apps and web sessions.
• Contextual Ad Routing: Ensure advertising APIs switch from behavioral bidding to contextual placement for minor accounts.
• Third-Party Script Audit: Ensure no hidden analytics packages transmit device fingerprints or IP telemetry of minor users.

← Back to Full Section 9: Children’s Data Guide