1. Age Definition- Section 2(f) of the DPDP Act
A "child" is any individual who is under 18 years old.
2. Verification Method Requirements -Rule 10 of the Rules
Companies/Data Fiduciaries must use technology to prove that the person giving consent is actually the parent.
Companies must verify that the person claiming to be the parent is an adult.
How to Verify:
- Existing Data: If the parent is already a user on your platform, you can use the ID details you already have.
- Voluntary ID: If they are not a user, they can voluntarily provide ID proof.
- Digital Tokens: Companies can use a "virtual token" (a secure digital code) from a government-authorized service like DigiLocker to verify their age and identity without seeing their actual ID card.
3. Parental Consent Standards- Section 9(1) of the DPDP Act
- Requirement: Before companies process any data of a child, companies must get "verifiable consent" from the parent or lawful guardian.
- Standard: This consent follows the same strict rules as regular consent (free, specific, informed, and unconditional). The key difference is strict verification that it is truly the parent acting.
4. Special Responsibilities of Companies- Section 9(2)-(3) of the DPDP Act, Rule 12 & Fourth Schedule of the DPDP Rules, 2025.
If you process children's data, you have strict prohibitions (things Companies cannot do):
- No Detrimental Effect: You cannot use data in any way that might hurt the child's well-being.
- No Tracking: You cannot track a child's behaviour or monitor them.
- No Targeted Ads: You cannot show advertisements targeted specifically at children.
When you CAN track: Some organizations are allowed to track children for safety or specific duties, the following are exceptions
- Schools: For education and safety.
- Hospitals/Doctors: For health treatments.
- Transport: To track the location of school buses for safety.
5. Deletion Rules- Section 8(7) of the DPDP Act and Rule 8 of the DPDP Rules, 2025
- Withdrawal: If the parent withdraws consent, companies must delete the child's data immediately.
- Inactivity Rule (social media/Gaming): If a child uses a social media or Gaming platform but stops using it for 3 years, the company must automatically delete their data.
