India wrote the strictest children’s privacy rules in any major market, and set the bar at an age no other regime touches: 18. Under DPDPA section 9, every user below the age of majority needs a verified parent behind them, and the three technologies that fund most consumer internet products, tracking, behavioral monitoring, targeted advertising, are banned for that entire cohort. For platforms whose Indian user base skews young, section 9 is not a compliance detail; it is a product-architecture decision.
| Rule | DPDPA s. 9 + draft DPDP Rules (2025) |
|---|---|
| Child | Under 18 |
| Requirements | Verifiable parental consent; no tracking, behavioral monitoring, or targeted ads |
| Penalty | Up to INR 200 crore |
| Framework | MeitY |
Engineering the requirement
Age assurance without over-collection. You cannot apply children’s rules without knowing who is a child, and you cannot demand government ID from everyone without violating data minimization. The draft rules’ three verification routes (existing verified account data, identity tokens, Digital Locker) all target the parent’s adulthood and identity, so the emerging pattern is: self-declared age at signup, risk-based escalation to verification, and parental flows triggered below 18.
Consent plumbing. Parental consent must satisfy the act’s general consent standard, free, specific, informed, affirmative, so the parent needs their own notice, their own withdrawal path, and linkage to the child’s account. Fiduciaries also inherit erasure and grievance duties running to both parent and child.
The ad-stack question. Because the tracking and targeted-advertising bans are consent-proof, the only compliant configurations are: no under-18 users (with credible age assurance), or under-18 modes with profiling, SDK-level tracking, and personalized ads disabled. Half-measures, personalization flags that still feed measurement pipelines, are exactly what audits of Significant Data Fiduciaries will probe.
Placement in the global stack
Operators already running COPPA gates and UK Children’s Code age-appropriate design have the machinery but the wrong thresholds and the wrong defaults; the India profile raises the age to 18 and converts “high privacy by default” into “prohibited outright”. Build the strictest profile once and parameterize by jurisdiction. The wider Indian regime is covered in the DPDPA guide and the GDPR comparison; test your public surfaces for trackers with a free scan.