Readiness assessment
The Act
The DPDP Act, explainedNotice · Section 5Consent · Section 6Security · Section 8The DPDP Rules 2025Glossary
Industries
Fintech & BankingHealthcare & PharmaE-commerce & RetailSaaS & TechnologyEdTechGCC & Global CentresBrowse all sectors
Implementation
DPDP implementationFintech & digital lendingDPDP services & partnersVirtual DPOGet certified
Resources
Readiness assessmentGuidesBy roleGlossaryNews
About
AboutEditorial policyContactFAQ
Readiness assessment
Share this section

Chapter II · Obligations of Data Fiduciary

Section 9: Processing of children's data

Section 9 puts children first: get verifiable parental consent before processing a child's data, never process in a way that harms a child's well-being, and do not track or target advertising at children.

Official text
Section 9Processing of children's data
Chapter
Chapter II · Obligations of Data Fiduciary
Status
Enacted · phased commencement
Full compliance
13 May 2027
Applies to
Anyone processing children's data
Official citation
DPDP Act, 2023, s.9
Reading time
5 min
Updated
August 2026

At a glance

Section 9 requires verifiable consent from a parent or lawful guardian before processing the personal data of a child (or of a person with disability who has a lawful guardian). It prohibits processing likely to cause a detrimental effect on a child's well-being, and bans tracking, behavioural monitoring and targeted advertising directed at children. The Government may exempt certain classes or purposes, and may notify a lower age for verifiably safe processing.

Applies to Anyone processing children's dataChapter Chapter IIEffective 13 May 2027Read time 5 min

Key takeaways

  • Get verifiable parental (or guardian) consent before processing a child's personal data.
  • The same protection extends to a person with disability who has a lawful guardian.
  • Never process in a way likely to harm a child's well-being.
  • No tracking or behavioural monitoring of children.
  • No targeted advertising directed at children.
  • The Government may exempt certain classes or purposes, and may notify a lower age for verifiably safe processing.

Who should read this

Read this if children might be among your users, EdTech, gaming, social and consumer apps especially, because the duties here are strict and the exposure is high.

FoundersLegal / DPOCompliance leadsProduct / engineering

In plain language

Section 9 treats children as a special case. Before processing a child's data you must obtain verifiable consent from a parent or lawful guardian. The same protection applies to a person with a disability who has a lawful guardian. A child, for the Act, is anyone under eighteen unless a lower age is later notified.

Two hard prohibitions follow. You must not process in a way likely to cause a detrimental effect on the well-being of a child. And you must not carry out tracking or behavioural monitoring of children, or direct targeted advertising at them. These are bright-line rules, not balancing tests.

There is some flexibility built in: the Central Government may exempt certain classes of Data Fiduciary or purposes, and may notify a lower age where a Data Fiduciary processes children's data in a verifiably safe manner.

The text of the law

Section 9: Processing of personal data of children

9(1) The Data Fiduciary shall, before processing any personal data of a child or of a person with disability who has a lawful guardian, obtain verifiable consent of the parent of such child or the lawful guardian.

9(2) A Data Fiduciary shall not undertake processing of personal data that is likely to cause any detrimental effect on the well-being of a child.

9(3) A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.

9(4) and 9(5) The Central Government may, by notification, exempt certain classes of Data Fiduciaries or purposes from parts of this section, and may notify a lower age for a Data Fiduciary that processes children's data in a verifiably safe manner.

Wording reproduced or summarised from the enacted Act. Always confirm against the official Gazette text for authoritative language.

What this means for you

  • Build a verifiable parental consent flow before any child data is processed.
  • Turn off behavioural tracking and ad targeting for users who are, or may be, children.
  • Review features for any detrimental effect on a child's well-being.
  • If you rely on an exemption or a notified lower age, document the basis carefully.

Frequently asked questions

What consent is needed to process a child's data?
Verifiable consent of a parent or lawful guardian, obtained before processing. The same applies to a person with disability who has a lawful guardian.
Can I show targeted ads to children?
No. Section 9 prohibits targeted advertising directed at children, as well as tracking and behavioural monitoring.
Who counts as a child under the DPDP Act?
A person under eighteen, unless the Government notifies a lower age for a Data Fiduciary that processes such data in a verifiably safe manner.
Are there any exemptions?
Yes. The Government may exempt certain classes of Data Fiduciaries or purposes, and may notify a lower age in defined circumstances.

Sources

Related sections
Section 6: ConsentSection 8: General obligationsSection 10: Significant Data FiduciaryChapter II overview

This is an educational explanation, not legal advice. dpdpactindia.in is an independent resource and is not affiliated with the Government of India.

Start readiness assessment