Children’s Data: Edtech, Gaming and App Compliance Questions
Reviewed by CA Nikhil Gupta · Last reviewed 30 May 2026
An age-assurance and parental-consent framework for edtech, gaming and apps processing children’s data, including scheduled exemptions.
For broader context, see the Data Privacy, DPDP and Cyber Law — Full Compliance Hub.
A checkbox saying ‘I am 18’ is not always credible, while collecting full identity documents from every user can create a new privacy risk.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
The Act defines a child as an individual below eighteen and generally requires verifiable parental consent before processing a child’s data.
The Act restricts detrimental processing and tracking, behavioural monitoring and targeted advertising directed at children, subject to notified exemptions.
Rules 10 to 12 prescribe parental-verification methods and limited exemptions, but those rules are in the eighteen-month phase.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- The Act defines a child as an individual below eighteen and generally requires verifiable parental consent before processing a child’s data.
- The Act restricts detrimental processing and tracking, behavioural monitoring and targeted advertising directed at children, subject to notified exemptions.
- Rules 10 to 12 prescribe parental-verification methods and limited exemptions, but those rules are in the eighteen-month phase.
- Age assurance should be proportionate and avoid collecting more identity data than the risk requires.
For the connected rule, example or next step, see Edtech Privacy: Student Profiles, Parent Data and Learning Analytics.
The five-point review
| Check | What to examine |
|---|---|
| Audience | Child-directed, mixed or adult. |
| Age signal | Declaration, context and behaviour. |
| Parent | Identity, adulthood and relationship. |
| Processing | Core service, safety, analytics and ads. |
| Exemption | Specific class, purpose and condition. |
For the connected rule, example or next step, see Loan App Recovery Data Misuse: Contacts, Harassment and Evidence.
Practical example
A gaming app asks every user to upload Aadhaar to prove age. This reduces one risk but creates a large identity-data store. A layered, proportionate method may be safer, subject to the final legal requirement.
How to apply the framework
Map the child journey separately and identify features that profile, advertise, chat or expose location.
Design parental consent so the adult can be verified if required without storing unnecessary full identity documents.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review audience, age signal and parent together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Classify the audience.
- Design age assurance.
- Build parental consent.
- Disable prohibited child profiling.
- Review chat and safety.
- Document exemptions.
Evidence to keep
- Audience assessment
- Verification design
- Consent records
- Ad settings
- Exemption memo
Warning signs
- Adult declaration despite child-directed design
- Full Aadhaar stored by default
- Behavioural ads on child accounts
- No withdrawal path
- Exemption without conditions
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.
Frequently Asked Questions
Source and review trail
Use the current official instrument, portal or regulator publication before acting. This panel separates the category authority from page-specific references.
- Primary category
- Data Protection, Cyber & IT Law
- Official starting point
- www.meity.gov.in