Supreme Court child online safety proposals and the DPDP Rules: verifiable parental consent and age gates

Recent Supreme Court observations on protecting children online, combined with policy debates around age-verification gates and platform accountability, have put under-18 digital safety at the top of boardroom agendas across India. For product, legal and trust-and-safety teams building social networks, gaming apps, learning platforms, streaming services and consumer websites, the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 set the binding statutory rulebook that takes effect on 13 May 2027.

Who counts as a child and why the 18-year line matters

Under India's data protection statute, a child is any individual who has not completed the age of eighteen years. Unlike foreign privacy regimes that set child-consent thresholds at thirteen or sixteen years of age, Indian law applies its child-data protections all the way up to a user's eighteenth birthday. For any child, the definition of Data Principal includes the parents or the lawful guardian acting on the child's behalf.

This single threshold means that a consumer app serving sixteen-year-old high-school students, a competitive test-prep portal, an online multiplayer game or a short-video community cannot rely on a teenager's own click-through agreement to process personal data, unless a narrow statutory exemption applies.

How verifiable parental consent works under the Rules

The Rules require every Data Fiduciary to adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before processing any personal data of a child. More specifically, the organisation must exercise due diligence to check that the individual identifying herself as the parent is an adult who is identifiable if required in connection with compliance with any law in force in India.

In doing so, the Rules state that the Data Fiduciary must verify the parent's identity and age by reference to:

• Reliable details of identity and age of the individual already available with the Data Fiduciary; or
• Voluntarily provided details of identity and age, or a virtual token mapped to the same, which is issued by an authorised entity—including an entity entrusted by law or the Government—and includes details or a token verified and made available by a Digital Locker service provider.

The statutory illustrations walk through how this works in practice. When a child informs an online platform that she is under eighteen, the platform must enable her parent to verify her age and identity either through an existing adult account on the same platform or through a Digital Locker service provider before creating the child's account.

The absolute ban on tracking, behavioural monitoring and targeted ads

Even after a parent completes identity verification and gives valid consent, the platform does not receive a blank cheque to monetise the child's profile. The Act places two standalone prohibitions alongside parental consent:

• A Data Fiduciary must not undertake processing of personal data that is likely to cause any detrimental effect on the well-being of a child.
• A Data Fiduciary must not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children.

For mobile apps and websites, this requires a clean architectural split between adult accounts and under-18 accounts. Third-party advertising software development kits, behavioural retargeting pixels, cross-site profiling cookies and targeted promotional notifications must be switched off whenever the logged-in profile belongs to a user under eighteen.

Where the Fourth Schedule exemptions apply—and where they stop

The Rules and the Fourth Schedule grant targeted exemptions from the parental-consent and tracking restrictions for specific classes of Data Fiduciaries—including clinical establishments, mental health establishments, healthcare professionals, allied healthcare professionals and educational institutions—and for specific child-safety purposes such as location tracking of a child during school transport. In every case, however, the exemption is restricted strictly to the processing needed for health treatment, educational activities or the safety of the child. Using student or patient records for commercial advertising or lead generation remains outside the exemption.

Our view: six architecture checks for consumer, gaming and EdTech apps

In our view, product managers, engineers and privacy counsel building platforms used by young people in India should complete six practical checks before 13 May 2027: