DPDP Rules for Children's Data
Indian EdTech and apps for minors must follow strict DPDP rules for parental consent and age verification. Learn the specific data handling requirements.
Discuss this page with an LLM
DPDP Action Sheet
Use this before your next workflow goes live. It keeps the useful parts visible and turns DPDP into checks your team can actually answer.
For DPDP Rules for Children's Data, the DPDP question is how personal data enters the workflow, where it is stored, which tools touch it, what purpose was explained, and how deletion or withdrawal will work.
1. Lead Forms
Check:
- What data are you collecting?
- Is the purpose clear at the point of collection?
- Is marketing consent separate from service communication?
- Can the user withdraw consent later?
Common mistake: one checkbox that silently covers newsletters, sales calls, partner sharing and remarketing.
2. Email and WhatsApp
Check:
- Who is on the list?
- Where did consent come from?
- Is the list imported from a vendor, event, webinar, scrape or old CRM?
- Can you prove the source of consent?
Common mistake: treating every lead as permanently marketable.
3. Ads and Retargeting
Check:
- Are pixels or ad platforms receiving identifiable user behavior?
- Are audiences built from customer lists?
- Are lookalike or remarketing audiences using personal data?
Common mistake: assuming "the ad platform handles it" means your company has no DPDP responsibility.
4. Website Analytics
Check:
- Which tools run on the site?
- Are IP address, device identifiers, session IDs or form fields being captured?
- Is analytics used only for measurement, or also for profiling and targeting?
Common mistake: installing tools first and asking privacy questions later.
5. Vendor List
Make a quick list:
- CRM
- Email platform
- WhatsApp provider
- Analytics
- Ad pixels
- Form tool
- Landing page builder
- Webinar tool
For each vendor, answer: what data goes there, why, who can access it and how deletion works.
6. This Week's Action
Map one campaign from first click to final follow-up. Mark every place personal data is collected, enriched, shared, uploaded or used for targeting.
If your team cannot answer where the data came from and where it goes next, start with a data flow map before rewriting policy copy.
Book a DPDP clarity callWant all of this handled, end to end? Sanctum is the all-in-one DPDP compliance programme behind this site: legal position, data map, gap analysis, implementation, tooling, training, readiness opinion, and breach cover under one accountable owner. How all-in-one DPDP compliance works or see the Sanctum programme.
Verifiable Parental Consent
Platforms catering to minors must implement a hard gate at sign-up. Under DPDP, “standard” consent is insufficient for users under 18. You must obtain consent from a parent or lawful guardian before any data processing begins. This requires a technical link between the child’s profile and the parent’s verified contact details. Relying on a simple “I am over 18” checkbox is a violation for any service targeting students or minors.
Behavioral Tracking Restrictions
DPDP forbids any processing of children’s data that involves tracking or behavioral monitoring. You cannot monitor a child’s navigation patterns, time spent on specific modules, or interaction styles if that data is used to predict future behavior for non-educational purposes. Any feature designed to increase “time on app” through behavioral triggers may be classified as causing well-being harm, which is strictly prohibited for minors.
Data Workflows for Minors
| Activity | Personal Data Involved | DPDP Risk Level |
|---|---|---|
| Student Onboarding | Age, Parent Name, Mobile, Email | Very High |
| Live Online Classes | Voice recordings, Video feeds, Chat logs | High |
| Academic Assessment | Test scores, Learning gaps, Progress reports | Medium |
| Content Personalization | Search history, Interaction speed, Interests | High |
| Subscription Billing | Parent’s payment info, Billing address | Medium |
The Age Verification Conflict
Most EdTech platforms currently allow students to register using individual social media logins or emails. Under DPDP, this creates a compliance gap because these methods do not verify the user’s age or the guardian’s authority. You must redesign the registration flow to include an “Age Gate.” If the user is under 18, the system must pause and require a parent to complete the verification process before the account is activated.
This week
Review your user registration database to identify every account where the user age is under 18, and check if you have a documented record of parental consent for each.
Now think about your work. Where does personal data enter your workflows? Where does it sit? Who else touches it?
Frequently asked questions
Can we use student data for marketing?
No. DPDP prohibits using children's data for targeted advertising or any marketing that tracks their behavior. You cannot use learning history to profile students for commercial products.
Is age 18 the cutoff in India?
Yes. Unlike global standards that use age 13 or 16, India's DPDP Act defines a child as anyone under the age of 18. All users in this bracket require parental consent.
How do we verify a parent's identity?
The Act requires verifiable consent. You must use reliable methods like OTPs sent to a parent's registered mobile number, government ID verification, or digital signatures to link a child to a guardian.