Under India's DPDP Act 2023, processing children's personal data generally requires verifiable parental consent and prohibits tracking, behavioural monitoring and targeted advertising directed at children. In 2026, EdTech platforms, schools and consumer apps must implement age-gating and verifiable parental-consent workflows.
What the Act requires
Data Fiduciaries must obtain verifiable parental consent before processing a child's data and must not undertake tracking, behavioural monitoring or targeted advertising aimed at children.
Who is most affected
EdTech, schools, gaming and consumer apps that attract young users carry the heaviest obligations and the highest penalty exposure for lapses.
How to comply
Implement age verification, verifiable parental-consent workflows, a children's-data policy and a DPIA for child-facing processing.
FAQ
The DPDP Act treats individuals below 18 years as children, requiring verifiable parental consent and prohibiting tracking and targeted advertising directed at them.