DPDP Act 2023 → enforcement live§8(6) + Rule 7(2): 72h breach reportMax penalty: ₹250 Cr22 scheduled languagesap-south-1 · MumbaiConsent Manager framework: pilotDPDP Rules: operationalisedDPDP Act 2023 → enforcement live§8(6) + Rule 7(2): 72h breach reportMax penalty: ₹250 Cr22 scheduled languagesap-south-1 · MumbaiConsent Manager framework: pilotDPDP Rules: operationalised
[01]Resource · 05

Children's data, under §9.

The DPDP Act treats every Data Principal under 18 as a child. That means verifiable parental consent, no behavioural tracking, and no targeted advertising. Here's how to ship a §9-compliant experience without breaking onboarding.

Age threshold
< 18 yrs
Consent type
Verifiable parental
Tracking allowed
None
Penalty
₹200 Cr
[02]What §9 actually says

Three hard rules, no grey areas.

[01]
Verifiable parental consent

Before processing any personal data of a child, the Data Fiduciary must obtain verifiable consent from the parent or lawful guardian.

[02]
No tracking, no targeted ads

Behavioural monitoring and targeted advertising directed at children are prohibited outright.

[03]
No detrimental processing

Processing likely to cause detrimental effect on the well-being of the child is barred.

[03]Patterns that work

Verifiable parental consent without killing signup.

[01]
Age-gate at the door

Self-declared DOB at signup. If <18, branch into the parental consent flow before any data collection beyond name and parent contact.

[02]
Parent verification options

OTP to parent's mobile + Aadhaar OKYC age check + small refundable token transaction. Crawlshark ships all three out of the box.

[03]
Per-purpose consent for the parent

Parent grants itemised purposes (account, learning records, community) — not a blanket OK.

[04]
Annual re-consent on transition

On the child's 18th birthday, auto-trigger fresh consent from the now-adult Data Principal.

Indians under 18
440M
approx
Edtech users <18
120M+
FY25
Gaming users <18
180M+
FY25
Penalty for violation
₹200 Cr
Schedule, §33
[04]Targets

Who has to get §9 right on day one.

Who
Today's pain
With Crawlshark
Edtech
Test prep, K-12, coding — student is the user, parent is the payer.
Dual-account model: parent consents, child uses; both rights respected.
Gaming
Monetisation depends on engagement signals §9 prohibits.
Switch to contextual ads + per-session limits, with audit evidence.
Social / community
UGC platforms where minors mix with adults.
Age-gated communities, parental review of public posts, takedown workflows.
Healthtech
Pediatric care needs parent + doctor + child involvement.
Multi-party consent with nominee (§14) for adolescents.

Ship §9 without burning your signup funnel.

Use Crawlshark's age-gating + verifiable parental consent SDK and stay defensible against the ₹200 Cr penalty.

Book a demo See pricing