DPDP Rules for Children's Data (Under 18)
Liability Check
Processing children's data (under 18) without verifiable parental consent is a direct route to crippling penalties under the DPDP Act, with fines up to ₹250 Crore. This isn't just a guideline; it's a strict liability.
Why DPDP Rules for Children's Data (Under 18) is at Risk
The DPDP Act treats **children's data** with extreme sensitivity. Any Data Fiduciary processing data of individuals under 18 must obtain **verifiable parental consent** or consent from a lawful guardian. This applies across the board, from ed-tech platforms in Bengaluru to gaming apps in Gurugram. The law explicitly prohibits processing data that could cause **detrimental effect** to a child, or for targeted advertising based on their data. This isn't just about privacy; it's about **child protection**, and the Data Protection Board will scrutinize this heavily.
Common Violations
- 1.Failing to implement a robust, verifiable **parental consent mechanism** before processing data of users under 18.
- 2.Engaging in **targeted advertising** directly at children or profiling them based on their personal data.
- 3.Processing children's data (e.g., location, browsing history) in a manner that could cause **detrimental effect**, even if consent was obtained.
The Immediate Fix
Immediately conduct an **age gate review** across all user-facing platforms. Implement a clear, verifiable parental consent flow for any user identified or reasonably expected to be under 18, utilizing methods like OTP verification to a parent's number or school IDs.
Get DPDP Updates for DPDP Rules for Children's Data (Under 18)
We'll send you compliance alerts and deadline reminders specific to your area. No spam — unsubscribe anytime.
Need help checking your business?
- Start with the free self-check to find questions for your team.
- Our paid gap assessment takes four weeks. We check your apps, documents and records, then list what needs fixing.
- Fixing the agreed gaps takes two to three months. A final assessment checks the completed work.
Save your results and discuss the questions with your team.
Next step after the audit
The audit shows the gaps. Sanctum closes them. One programme covers legal position, data map, gap analysis, implementation, tooling, training, a written readiness opinion, and breach cover, under one accountable owner. See the all-in-one programme
What Should You Do Next?