Last updated: 6 August 2026
The Digital Personal Data Protection Act, 2023 gives special protection to the personal data of children. Under the Act, a “child” is an individual who has not completed eighteen years of age.
Before processing the personal data of a child — or of a person with a disability who has a lawful guardian — an organisation must obtain the verifiable consent of the parent or lawful guardian, in the manner prescribed under the Act.
An organisation must not process a child's personal data in a way that is likely to cause any detrimental effect on the well-being of the child.
An organisation must not undertake tracking or behavioural monitoring of children, or direct targeted advertising at children.
The Act allows the Central Government to prescribe exemptions and conditions — for certain classes of organisations or purposes, and where processing can be carried out in a verifiably safe manner. The precise scope of these exemptions depends on the rules made under the Act.
Organisations whose services may be accessed by children — such as those in education technology, social media, gaming, or streaming — should pay particular attention to age-appropriate consent, and to the restrictions on tracking and targeted advertising directed at children.