Section 9: Processing of Personal Data of Children

Statutory Text (Official Gazette, as amended)

(1) The Data Fiduciary shall, before processing any personal data of a child or of a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.

Explanation.—For the purpose of this sub-section, the expression “consent of the parent” includes the consent of lawful guardian, wherever applicable.

Amendment note: The Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E), dated October 5, 2026, in force on its publication in the Gazette, reported as October 6 or 7, 2026) inserted the word “of”, so the phrase reads “a child or of a person with disability”. The change only makes the wording clearer; it does not add new duties. Section 9 itself is not yet in force and is expected to apply from May 13, 2027.

(2) A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.

(3) A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.

(4) The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed.

(5) The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3) in respect of processing by that Data Fiduciary as the notification may specify.

Definition.—Under Section 2(f), “child” means an individual who has not completed the age of eighteen years.

What Section 9 Means in Plain English

India’s DPDP Act sets one of the strictest legal standards in the world for handling data from minors:

1. Anyone under 18 is legally a child: Unlike COPPA in the United States (which sets the age threshold at 13) or the GDPR in Europe (typically 13 to 16), the DPDP Act covers everyone under the age of 18.
2. Mandatory verifiable parental consent: If your service caters to users under 18 (e.g. EdTech, online gaming, coaching platforms, youth apparel), you cannot simply ask the minor to tick an “I agree” box. You must verify that a parent or legal guardian has provided consent.
3. Ban on tracking & targeted ads (₹200 Crore Penalty): Sub-section (3) bans tracking, behavioural monitoring and targeted advertising directed at children. Breaching Section 9 can bring a penalty of up to ₹200 Crore.
4. Prescribed exemptions (Rule 12): Under sub-section (4), the Fourth Schedule to the Rules lifts the consent and tracking rules in narrow cases: hospitals and healthcare professionals providing care, schools tracking for education or safety, creches and day care centres, school transport tracking location, government functions in a child’s interest, email-only accounts, real-time location for safety, blocking harmful content from children, and checking that a user is not a child.
5. Safe-processing age relief: Under sub-section (5), the government can let a company that processes children’s data in a verifiably safe way apply these rules only below a lower age that it notifies. No such notification has been issued yet.

Engineering Checklist

• Age gating at onboarding: Implement an age verification step before registering accounts or setting marketing cookies.
• Disable tracking pixels for minor accounts: If a user is identified as under 18, immediately block third-party trackers (Meta Pixel, Google Ads, TikTok/Snapchat SDKs, Mixpanel profiling).
• Parental consent verification flow: Under Rule 10, confirm the parent is an identifiable adult using identity and age details you already hold or a virtual token (for example via DigiLocker) before creating the child’s account.