Compliance
Section 9 of the Digital Personal Data Protection Act forces businesses to obtain verifiable parental consent before handling a child’s data and bans tracking, behavioural monitoring and targeted ads, with non‑compliance attracting a schedule ceiling of up to ₹200 crore.
Check your DPDP readiness — free More on the blogThe DPDP Act defines a child as anyone who has not completed eighteen years of age. This definition is fixed by the statute and does not depend on school enrolment, toys or any other indicator. The age threshold applies to every data processing activity, irrespective of the product’s intended audience.
Before a data fiduciary processes personal data of a child, it must obtain consent that can be verified, not merely a self‑declaration. The consent must come from a parent or, where the child has a lawful guardian due to disability, from that guardian. Verification typically involves methods that can be audited, such as OTPs to a registered mobile number or government‑issued IDs, raising the compliance bar above a simple tick‑box.
Section 9 places three clear bans: tracking or behavioural monitoring of children, targeted advertising directed at children, and any processing likely to harm a child’s well‑being. These are outright prohibitions; they cannot be waived by parental consent. The law treats these activities as inherently unsafe for minors, so businesses must redesign any feature that attempts to profile or serve ads to users under eighteen.
Businesses that overlook these obligations expose themselves to the schedule ceiling of up to ₹200 crore. The Data Protection Board will determine the exact amount based on factors such as the nature of the breach, the scale of affected data, and steps taken to mitigate harm. This penalty sits alongside a separate ₹250 crore security head, highlighting the financial stakes of non‑compliance. Implementing compliant consent flows often requires technical changes, such as integrating identity verification APIs and maintaining audit logs. Companies must also audit existing data pipelines to ensure no tracking scripts or behavioural models run on users identified as minors. Failure to strip such logic can be deemed processing likely to cause detrimental effects, attracting additional liability. For startups and small enterprises, the cost of compliance may appear steep, but the alternative—potential fines in the hundreds of crores—can be existential. Early investment in compliant design, clear privacy notices, and robust consent management can mitigate both financial risk and reputational damage. The Act also empowers the Central Government to notify a lower age for data fiduciaries that can demonstrate verifiable safety. Until such a notification is issued, the eighteen‑year threshold remains the operative standard, and businesses should plan their data handling policies accordingly. Regular training for staff handling personal data, periodic privacy impact assessments, and a documented response plan for breaches are practical steps. These measures not only help meet the DPDP requirements but also build trust with customers and regulators alike.
A child is anyone who has not completed eighteen years of age. The Act allows the Central Government to notify a lower age for fiduciaries that can prove a verifiably safe process, but the default remains eighteen.
No. Section 9 expressly bans targeted advertising, tracking and behavioural monitoring of children. These prohibitions cannot be overridden by parental consent, making such practices unlawful regardless of consent.
Verifiable consent means the data fiduciary must obtain proof that a parent or lawful guardian has agreed, using methods that can be audited, such as OTP verification, government‑issued IDs or other reliable identity checks, not just a self‑declaration tick box.
The Schedule sets a ceiling of up to ₹200 crore for non‑fulfilment of the child‑specific obligations. The Data Protection Board will fix the actual amount based on factors outlined in section 33(2) of the Act.
Published 26 September 2026. Founder & CEO at VidhiSar. I have watched four companies pay for the same mistake, and it was never the mistake anyone expected. VidhiSar is software, not a law firm: every answer names the section it relies on so you can check it, and anything turning on your specific facts is worth putting to a professional. More about who builds this
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.