Obligation
Processing children's data carries special duties: verifiable parental consent, no processing harmful to the child, and no tracking, behavioural monitoring or targeted advertising directed at children.
A Data Fiduciary shall obtain verifiable consent of the parent before processing a child's personal data, shall not undertake processing likely to cause any detrimental effect on the well-being of a child, and shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.
Section 9 sets a strict regime for anyone under 18. Before processing, the fiduciary must obtain verifiable parental consent.
It also bans processing likely to harm a child's well-being, and bans tracking, behavioural monitoring and targeted advertising aimed at children. The government may relax some parts for notified classes or purposes.
An ed-tech app cannot serve targeted ads to a 14-year-old or profile their behaviour, and needs verifiable parental consent to process their data.
Is targeted advertising to children allowed?
No. Section 9 bans targeted advertising directed at children, subject to any notified exceptions.
What penalty applies?
Breach of the children's obligations may attract a penalty that may extend to two hundred crore rupees.