Processing Children’s Data Under DPDPA Section 9 What Every Platform Must Do.
Section 9 carries the strictest obligations in the entire DPDPA, and this article is direct about who it applies to: any platform a child can access, whether or not it was designed for children, with “no wiggle room” for a narrower interpretation. A child, under the Act, is anyone under 18 no lower threshold, no exceptions.
Get OneConsent.Ai’s stories in your inbox
Join Medium for free to get updates from this writer.
The compliance bar is high. A simple checkbox for parental consent doesn’t hold up; the law expects verifiable parental identity, through mechanisms like Aadhaar-linked DigiLocker or an equivalent electronic token. Beyond consent, the article lists outright prohibitions that apply even when parental consent exists: no cookie-based tracking, no device fingerprinting, no location tracking, and no targeted or personalised advertising to children under any circumstances.
Penalties for getting this wrong run up to ₹200 crore, on top of reputational damage that can be harder to recover from. The article’s practical guidance is architectural: platforms need genuinely separate data-handling pathways for child accounts, a full audit of third-party SDKs that might be collecting data behind the scenes, and clear documentation of how age and parental consent are verified.
Essential reading for founders and product teams at any platform minors might use, not just kids’ apps.
Protect your Children’s data and privacy with implement Consent compliance with OneConsent’s Consent management platform.
