Under the DPDP framework, anyone under eighteen is a child, and almost nothing can be done with a child's data without verifiable parental consent. For platforms built on frictionless sign-up, the Rules of 2025 introduce a gate that must be crossed before processing begins, and a prohibition on the very behavioural targeting that monetised young users.
Indian data law draws the line of childhood at eighteen, higher than many regimes a global business may be used to, and the consequence is sweeping: a very large population of users is, in the eyes of the law, children whose data cannot be processed on the ordinary footing of consent. The Digital Personal Data Protection Act, 2023, read with the Rules notified in November 2025, requires that before a data fiduciary processes a child's personal data it must obtain verifiable consent from a parent or lawful guardian. Consent is not a checkbox the child ticks; it is a verified act by an adult.
The word that carries the weight is 'verifiable'. The fiduciary must adopt appropriate technical and organisational measures to be reasonably satisfied that the person giving consent is in fact an adult and is in fact the parent or guardian, whether by reference to reliable identity and age information already held, or through a trusted token issued by an authorised provider. The difficulty is immediate and practical: verifying adulthood and relationship usually means collecting more data, and a careless verification design can create a fresh privacy problem while solving the consent one.
The Rules go beyond consent to conduct. Tracking and behavioural monitoring of children, and targeted advertising directed at them, are prohibited, which strikes directly at the engagement-and-profiling model on which much of consumer technology is built. For social media, gaming, streaming and EdTech, the change is not a disclosure tweak but a product-design constraint: features that profile young users for retention or advertising cannot simply be re-papered with a better notice; they have to be switched off for that population.
The framework does contemplate relief. Certain classes of fiduciaries and certain purposes, in areas such as health and education, may be exempted or placed under lighter obligations through notification, recognising that a paediatric clinic or a school platform cannot function if every interaction waits on the full verification gate. But the contours of those exemptions are defined by what is notified, not by what a business would find convenient, and until a category is clearly within an exemption it is safer to assume the full obligation applies.
The grey area is the verification architecture itself. A business must design a mechanism that is robust enough to satisfy the standard yet restrained enough not to hoard identity documents of parents, that works across the age boundary without demanding proof of age from every adult user, and that can show the Data Protection Board a defensible basis for how it concluded consent was valid. Over-collection and under-verification are both failures, and the space between them is narrow.
The disciplined response is to map where a product actually touches users who may be under eighteen, build an age-assurance and parental-consent flow that collects the minimum necessary and retains even less, and strip behavioural tracking and targeted advertising out of the child experience by design rather than by disclaimer.
