Children's Data Under DPDP

Children's Data Under DPDP

Why Age Checks, Parental Consent And Safety Rules Change Product Design

Published by Vishwaas.ai | DPDP Series

1. Children's Privacy Is Not A Small Corner Case

Children grow up online now. They learn, play, chat, stream, shop and create digital trails long before they understand what personal data really means. That is exactly why the DPDP Act gives children's personal data a much stronger protection layer than ordinary adult data.

For businesses, this is not just a legal point. It changes how apps, websites, games, educational tools and even support journeys need to be designed.

If a product can attract children, it must also be ready to protect them.

2. Under DPDP, A Child Means Anyone Below 18

The law draws a simple but serious line: a child is any person under the age of 18. That means age is not a casual onboarding detail anymore. It is a compliance trigger.

Whenever a Data Fiduciary processes a child's personal data, it enters a stricter rule set that includes verifiable parental consent, restrictions on tracking and behavioural monitoring, and limits on targeted advertising.

That framework makes sense because children should not be treated like adult users with the same defaults.

3. Verifiable Parental Consent Changes The UX

Rule 10 and the connected DPDP provisions require verifiable parental or guardian consent before processing a child's personal data, subject to the relevant exceptions and conditions. This means the business must do more than add a checkbox.

The verification must be reliable. In recent guidance, examples include using identity data already available with the fiduciary, information voluntarily provided by the parent, or verification through trusted or authorised systems such as Digital Locker-based checks where applicable.

The key idea is simple: if you cannot reasonably verify that the adult is the real parent or guardian, the consent should not be treated as valid.

4. Tracking And Targeted Ads Are Off The Table

This is one of the most important parts of the regime. DPDP restricts tracking, behavioural monitoring and targeted advertising directed at children. That means products cannot quietly build commercial profiles of children or optimise ads based on their digital behaviour.

For businesses that rely on behavioural analytics, this forces a rethink. If a feature is built around child engagement, it may need to be redesigned, disabled or tightly narrowed.

The law is clearly trying to reduce exploitative digital design around minors.

5. Exemptions Exist, But They Are Narrow

The DPDP Rules 2025 do contain exemptions for certain classes of fiduciaries and certain purposes, but they are not blanket carve-outs. Healthcare, education, childcare, child transport and a few narrow public-interest or safety-related purposes are treated differently because the law recognises real-world necessity.

That does not mean anything goes. The exemptions are conditional and purpose-specific, and they still require minimisation, safeguards and documentation.

In practice, organisations should be very careful before assuming an exception applies.

6. Why Age Verification Is Harder Than It Sounds

Age verification seems straightforward until you build it. What happens when a user lies about their age? What if the same account is shared by family members? What if a product serves both adults and children in one flow? What if the business has users across regions and languages?

These are not edge cases. They are everyday design problems.

A good age-verification flow needs to be proportionate, not invasive; accurate, not annoying; and strong enough to support the legal obligations without collecting unnecessary information.

7. Product Teams Need To Think Beyond Legal Text

A privacy notice alone will not solve children's data risk. Product teams need to think about the full experience: onboarding, age gates, parental flows, account permissions, content restrictions, support conversations and deletion paths.

If the product can be used by children, the default settings should be conservative. The journey should avoid dark patterns, overly persuasive consent nudges and unnecessary data collection.

This is where child privacy becomes a design principle, not just a policy requirement.

8. Where Companies Usually Go Wrong

Some of the most common mistakes include:

• Using a simple age checkbox without real verification.

• Serving targeted ads to users who may be minors.

• Collecting more child data than the service actually needs.

• Failing to separate child and adult workflows.

• Not documenting which exemption, if any, is being relied on.

These errors often come from convenience, not malice. But DPDP is designed to hold organisations to a higher standard anyway.

9. What A Child-Safe DPDP Posture Looks Like

A mature child-safety posture usually includes:

• A clear child-data inventory.

• A reliable age-verification method.

• A parental or guardian consent workflow that can be audited.

• No child-targeted behavioural ads or hidden profiling.

• Purpose-specific retention and deletion controls.

When these controls are in place, the organisation is much better prepared to show that it treats children's data with the seriousness it deserves.

10. Where Vishwaas.AI® Fits

Child-data compliance is one of the most operationally sensitive parts of DPDP. Vishwaas.AI® can help by mapping child-data touchpoints, tracking age-verification and parental-consent flows, and making sure the rules are visible across product, policy and evidence layers.

That matters because the strongest child-safety programs are the ones that work quietly in the background while still protecting the child at every step.

In the DPDP era, building for children means building for trust first.

(c) Published by Vishwaas.ai | DPDP Compliance Made Simple