Chapter 5: Verifiable Consent and Children

Children, lawful guardians, and specified exemptions

chapter · 2 min read · Updated 14-Feb-2026 · 5 of 14

Executive Summary

•Before processing a child's personal data, a Data Fiduciary must obtain verifiable parental consent and check that the person identifying as the parent is an identifiable adult.

•No Tracking/Behavioral Monitoring: You cannot track children for ads or behavior modification.
•Verifiable Consent: Build a process that checks the identity and age details of the person identifying as the parent, using the methods permitted by rule 10.
•Specified Exemptions: Rule 12 and the Fourth Schedule define limited classes and purposes for which section 9(1) or 9(3) does not apply, subject to stated conditions.

•Safety First: Your children's data is treated with higher sensitivity.
•Lawful authority: A parent acts for a child; rule 11 separately addresses a lawful guardian acting for a person with disability who cannot take legally binding decisions despite support.

Practical application

Use these examples to distinguish a defensible process from a common mistake.

Right

✓A child-focused service verifies the parent or guardian before processing the child’s personal data.

Incorrect

×A service relies only on an unchecked age declaration and continues behavioral tracking of children.

•Section 9: Processing of personal data of children
•Rules 10-11: Verifiable consent for children and persons with disabilities who have lawful guardians
•Rule 12 and Fourth Schedule: Specified exemptions from child-data obligations

Establishes special protections for processing personal data of children.

Primary sources: section 9 of the DPDP Act and rules 10-12 with the Fourth Schedule.