Processing of Children's Data

Paraphrased legal text

Before processing any personal data of a child or a person with disability, the Data Fiduciary must obtain verifiable consent of the parent or lawful guardian. The Fiduciary shall not undertake any processing that is likely to cause detrimental effect on the well-being of a child, and shall not undertake tracking, behavioural monitoring, or targeted advertising directed at children.

What this means in plain English

• Verifiable parental consent before processing.
• No behavioural monitoring or tracking of minors.
• No targeted advertising aimed at children.
• Rule 10 of the DPDP Rules, 2025 sets out how the parent's consent is verified.

Penalty if you get this wrong

Up to ₹200 crore for failure to fulfil obligations relating to children's personal data.

How ProtectComply solves it

Consent Management — children's flow

• A child's consent is held until the parent/guardian approves it
• Children's-mode policy auto-disables tracking and targeted ad pixels
• Notice template explicitly children-appropriate
• Audit trail records the parent/guardian's approval or decline