Data protection · Provision
Verifiable parental consent before processing a child, and an outright bar on tracking, behavioural monitoring and targeted advertising. (Section 9, Digital Personal Data Protection Act, 2023.) Comes into force on 13 May 2027 · Text checked against India Code on 25 October 2026.
Quick Statutory Answer
Section 9 of the DPDP Act 2023 requires verifiable parental consent before a Data Fiduciary processes the personal data of a child, meaning any individual under eighteen years of age. It separately prohibits tracking, behavioural monitoring and targeted advertising directed at children, and prohibits any processing likely to cause a detrimental effect on a child. Non-fulfilment carries a Schedule penalty of up to ₹200 crore.
9. Processing of personal data of children.— (1) The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed. Explanation.— For the purpose of this sub-section, the expression "consent of the parent" includes the consent of lawful guardian, wherever applicable. (2) A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child. (3) A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. (4) The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed. (5) The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3) in respect of processing by that Data Fiduciary as the notification may specify.
| Obligation | What It Requires | Can Consent Unlock It |
|---|---|---|
| Verifiable parental consent | Consent of the parent before processing a child, verified rather than asserted | It is the requirement |
| Guardian consent for persons with disability | Consent of the lawful guardian where one exists | It is the requirement |
| No detrimental processing | Nothing likely to harm the well-being of a child | No |
| No tracking or behavioural monitoring | Applies to children regardless of the purpose | No |
| No targeted advertising to children | A prohibition, not a consent-gated activity | No |
up to ₹200 crore. Non-fulfilment of the additional obligations in relation to children is its own head in the Schedule, alongside the ₹250 crore security head.
An individual who has not completed eighteen years of age. The Act allows the Central Government to notify a lower age for a Data Fiduciary that processes data in a verifiably safe manner, but the default is eighteen.
No. Section 9 prohibits targeted advertising directed at children, along with tracking and behavioural monitoring. A prohibition is not a requirement that consent can satisfy.
The Schedule provides up to ₹200 crore for non-fulfilment of the additional obligations in relation to children. The Board fixes the actual amount on the factors in section 33(2).
On 13 May 2027. Notification G.S.R. 843(E) of 13 November 2025 brought the Act into force in three stages: the definitions and the Data Protection Board that day; Consent Manager registration one year later; and, eighteen months later, the provisions that carry the obligations and the penalties — sections 3 to 5, most of section 6, sections 7 to 17 and 27 to 34. Section 9 is in the last group.
Maintains the law explainers, calculators, templates and blog posts on vidhisar.in: checks them against the statute text and updates them when the law changes. Errors and changes in the law can be reported to legal@vidhisar.in.
The section in its own words, with a plain-English explanation of what it requires. Not legal advice: take advice on anything turning on your own facts.