Data protection · Provision

Section 9, DPDP Act 2023 — Children, and the ₹200 Crore Head

Section 9, Digital Personal Data Protection Act, 2023

Verifiable parental consent before processing a child, and an outright bar on tracking, behavioural monitoring and targeted advertising.

Quick Statutory Answer

Section 9 of the DPDP Act 2023 requires verifiable parental consent before a Data Fiduciary processes the personal data of a child, meaning any individual under eighteen years of age. It separately prohibits tracking, behavioural monitoring and targeted advertising directed at children, and prohibits any processing likely to cause a detrimental effect on a child. Non-fulfilment carries a Schedule penalty of up to ₹200 crore.

Check your compliance exposure — free All provisions

What the section does

Before processing any personal data of a child, a Data Fiduciary must obtain the verifiable consent of the parent, and in the case of a person with a disability who has a lawful guardian, the verifiable consent of that guardian.
A child is an individual who has not completed eighteen years of age. The threshold is age, not the presence of a school or a toy on the page.
A Data Fiduciary must not undertake processing likely to cause any detrimental effect on the well-being of a child.
A Data Fiduciary must not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children. These are prohibitions, not matters that consent can unlock.

Section 9 DPDP Act — Obligations in Relation to Children

Section 9 DPDP Act — Obligations in Relation to Children
Obligation	What It Requires	Can Consent Unlock It
Verifiable parental consent	Consent of the parent before processing a child, verified rather than asserted	It is the requirement
Guardian consent for persons with disability	Consent of the lawful guardian where one exists	It is the requirement
No detrimental processing	Nothing likely to harm the well-being of a child	No
No tracking or behavioural monitoring	Applies to children regardless of the purpose	No
No targeted advertising to children	A prohibition, not a consent-gated activity	No

Schedule ceiling

up to ₹200 crore. Non-fulfilment of the additional obligations in relation to children is its own head in the Schedule, alongside the ₹250 crore security head.

Where people go wrong

Accepting a tick box that says the user is over eighteen and calling it verification. The section requires consent that is verifiable, which is a higher bar than a self-declaration.
Assuming the section only binds businesses aimed at children. It attaches to processing the data of a child, whoever the product was built for.
Believing parental consent permits tracking or targeted advertising. Those are prohibited outright, so consent does not reach them.
Using a lower age because another jurisdiction does. Under this Act a child is anyone under eighteen unless the Central Government notifies otherwise.

Common questions

What age counts as a child under the DPDP Act?

An individual who has not completed eighteen years of age. The Act allows the Central Government to notify a lower age for a Data Fiduciary that processes data in a verifiably safe manner, but the default is eighteen.

Can a business show targeted ads to children with parental consent?

No. Section 9 prohibits targeted advertising directed at children, along with tracking and behavioural monitoring. A prohibition is not a requirement that consent can satisfy.

What is the penalty for breaching the obligations about children?

The Schedule provides up to ₹200 crore for non-fulfilment of the additional obligations in relation to children. The Board fixes the actual amount on the factors in section 33(2).

Act on this

Section 33 — how the penalty is fixed
Section 6 — what verifiable consent requires
Privacy policy template

About this summary

A plain-English summary of what this provision requires, not a reproduction of it and not legal advice. Read alongside the bare Act, and take advice on anything turning on your own facts.