Verifiable Parental Consent Under India's DPDP Act (Section 9)

If your website, app, or online service is likely to be used by anyone under 18, Section 9 of India's Digital Personal Data Protection Act 2023 changes how you must handle their personal data. It is one of the strictest parts of the Act — and one of the easiest to get wrong, because it applies even when children are not your intended audience.

Section 9 does two big things. First, it requires verifiable consent from a parent or lawful guardian before you process a child's personal data. Second, it flatly prohibits certain kinds of processing directed at children, no matter what consent you have collected. This guide explains who counts as a child, what "verifiable" really means, what you are forbidden from doing, and how to build an age-gate and guardian-verification flow that stands up to scrutiny.

Who Counts as a Child Under the DPDP Act

Under the DPDP Act, a child is any individual who has not completed 18 years of age. This is a higher bar than many global frameworks — for example, several regimes treat 13 or 16 as the threshold for parental-consent rules. In India, anyone under 18 is a child for the purposes of this law.

Section 9 also extends similar protection to persons with a disability who have a lawful guardian. For them, the Data Fiduciary must obtain the verifiable consent of that guardian in the manner prescribed.

The practical consequence is significant: unless you can be confident your users are all 18 or older, you have to assume some of them may be children and design accordingly.

What "Verifiable" Parental Consent Means

Ordinary consent under the Act (Section 6) must already be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action and preceded by a notice under Section 5. Section 9 adds a further layer for children: the consent must come from a parent or lawful guardian, and it must be verifiable.

"Verifiable" means you cannot simply trust a checkbox that says "I am a parent." You need a reasonable mechanism to establish two things:

• The person giving consent is a real adult, not the child clicking through a screen.
• That adult is genuinely the child's parent or lawful guardian.

The Act leaves the precise verification mechanics to be spelled out in the DPDP Rules. The draft DPDP Rules 2025 describe approaches such as verifying the parent as an already-identified adult, or checking identity and age details against a reliable source or a virtual token mapped to such details. These specifics are still in draft and may change before they are finalised, so treat any exact method as provisional rather than settled law.

The takeaway that will not change: a bare self-declaration is not enough. You need an auditable step that meaningfully raises confidence that a verified adult guardian is the one consenting.

The Section 9 Prohibitions You Cannot Consent Around

This is the part organisations most often miss. Some Section 9 obligations are absolute prohibitions — they apply even if a parent has given perfect, fully verified consent. A Data Fiduciary must not:

1. Process children's data in a way likely to cause a detrimental effect on the well-being of the child.
2. Undertake tracking or behavioural monitoring of children.
3. Do targeted advertising directed at children.

In other words, verifiable parental consent unlocks permitted processing — it does not unlock these prohibited activities. You cannot get a parent to sign away a child's protection from behavioural profiling or targeted ads. If your product relies on tracking pixels, ad personalisation, or engagement-optimising behavioural analytics, those features must be switched off for users identified as children.

| Requires verifiable parental consent | Prohibited outright for children | | --- | --- | | Collecting a child's personal data for a permitted purpose | Behavioural monitoring and tracking | | Providing a service to a child's account | Targeted advertising directed at children | | Processing tied to the notice given to the guardian | Any processing likely to be detrimental to the child |

Which Businesses Section 9 Actually Applies To

A common misconception is that Section 9 only affects "kids' apps." In reality it reaches any service likely to be accessed by children — educational platforms, gaming, social features, streaming, quizzes, general-purpose e-commerce, and many mainstream websites. If children can plausibly sign up or browse, the obligations are in play.

That is why an age-gate matters even for products aimed at adults. Establishing a user's age band is the first step that determines whether the standard adult consent flow (Section 6) applies, or whether the stricter Section 9 guardian flow and prohibitions kick in. For background on how the baseline consent model works, see our guide to consent management under the DPDP Act.

How to Implement Verifiable Parental Consent

Here is a practical, defensible flow you can adapt. The goal is to age-gate first, verify a guardian when needed, and keep an immutable record of every step.

1. Age-gate at the point of collection

Ask for date of birth or an age band before you collect other personal data — not after. Avoid a single "I am over 18" checkbox as your only gate; neutral date-of-birth entry is harder to game and easier to justify later. Branch the flow based on the result:

• 18 or older — proceed with standard Section 6 consent.
• Under 18 — route into the guardian-verification path and hold back processing until it completes.

2. Collect and verify the guardian

Capture the parent or guardian's details and verify them with a real signal rather than a self-declaration. Common options include:

• OTP verification to the guardian's mobile number or email to confirm a reachable, controllable contact.
• Identity or age verification against a reliable source, consistent with whatever the finalised DPDP Rules require.
• A guardian confirmation link sent out-of-band, so the adult acts on their own device.

Pair verification with a clear Section 5 notice to the guardian describing exactly what data is collected, for what purpose, and how to withdraw consent later.

3. Enforce the prohibitions technically, not just in policy

Once a user is flagged as a child, your systems should automatically disable tracking scripts, behavioural analytics, and ad personalisation for that session and account. This should be enforced in code — a policy document alone will not stop a pixel from firing.

4. Handle withdrawal and expiry at majority

Withdrawal must be as easy as giving consent (Section 6(4)), and the guardian must be able to withdraw at any time. Build in expiry at the age of majority, too: when a child turns 18, they become an adult Data Principal in their own right, and you should re-establish consent directly with them rather than continuing to rely on old guardian consent.

5. Keep an immutable audit trail

Record who consented, that they were verified as a guardian, when it happened, which notice version was shown, and which purposes were covered — in an append-only log you can produce for the Data Protection Board if asked. Under the Act, the burden of proving valid consent sits with you.

How DPDP Comply Helps

DPDP Comply is built to make the Section 9 workflow practical instead of painful. Our children's data solution helps you:

• Age-gate consent flows so under-18 users are branched into the guardian path automatically.
• Verify guardians through mechanisms such as OTP-based confirmation, with the flexibility to align to the finalised DPDP Rules.
• Suppress prohibited processing — tracking, behavioural monitoring, and targeted advertising are held off for users identified as children.
• Capture immutable consent records, including guardian verification and the notice version shown, in an append-only audit log.
• Manage expiry and withdrawal, so consent can be revoked easily and refreshed when a child reaches adulthood.

If you want the broader legal picture first, our overview of what the DPDP Act 2023 requires sets the context for how Section 9 fits alongside consent, rights, and breach obligations.

Processing children's data is one of the areas the Data Protection Board is most likely to scrutinise, and one where getting the flow wrong is hard to undo. The good news is that a clean age-gate, a verifiable guardian step, and enforced prohibitions cover the core of what Section 9 asks for.

Get started free and set up a Section 9-ready consent flow for your website or app in minutes.

This article is general information, not legal advice.