> ## Content Index > Fetch the complete content index at: https://thecyberstories.com/llms.txt > Use this file to discover other available public pages before exploring further. # Before a child signs up, apps must check the parent: India's new consent rule explained - URL: https://thecyberstories.com/dpdp-parental-consent-children/ - Published: 2026-11-03T04:35:11.000Z - Updated: 2026-11-03T04:35:11.000Z - Description: India's data protection rules require apps to get a verified parent's consent before handling a child's data, and ban tracking and targeted ads aimed at children. The duty starts in May 2027. How the checks work, and what parents and builders should know. - Author: Raja Sekhar Thota - Tags: Privacy, #csv-6ae9612ebb92540f93998f1c, #Import 2026-11-03 21:46 ## In brief Under India's data protection law, an app can't simply let a child sign up. It must first get consent from a parent, and check that the parent is a real adult. The law also bans tracking children and targeting ads at them. The detailed rule takes effect in May 2027, so apps that serve families have months, not years, to get ready. ## What does the law say? The Digital Personal Data Protection Act, 2023 says a company must obtain verifiable consent of the parent [before processing any personal data of a child](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf?ref=thecyberstories.com). Under the law, a child is anyone under 18, and the Rules define an adult as [someone who has completed the age of eighteen years](https://egazette.gov.in/WriteReadData/2025/267650.pdf?ref=thecyberstories.com). Two more lines in the Act matter as much. Companies may not process children's data in a way [likely to cause any detrimental effect on the well-being of a child](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf?ref=thecyberstories.com). And they may not do [tracking or behavioural monitoring of children or targeted advertising directed at children](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf?ref=thecyberstories.com). ## How the check works Rule 10 of the DPDP Rules turns that into practice. An app must make sure [verifiable consent of the parent is obtained](https://egazette.gov.in/WriteReadData/2025/267650.pdf?ref=thecyberstories.com) first, and check that the person claiming to be the parent [is an adult who is identifiable](https://egazette.gov.in/WriteReadData/2025/267650.pdf?ref=thecyberstories.com). It can do that in one of two ways: - **Details it already has.** If the parent already uses the app and has shared [reliable identity and age details](https://egazette.gov.in/WriteReadData/2025/267650.pdf?ref=thecyberstories.com), it can rely on those. - **Details the parent brings.** Otherwise, the parent provides them, or shares [a virtual token issued by an authorised entity](https://egazette.gov.in/WriteReadData/2025/267650.pdf?ref=thecyberstories.com). The Rules say a parent may do this [using a Digital Locker service provider](https://egazette.gov.in/WriteReadData/2025/267650.pdf?ref=thecyberstories.com), such as DigiLocker. The Rules give worked examples. A child says she's a child and names her parent: the app must let the parent identify herself and check before creating the account. A parent opens an account for their child: same check. A virtual token is the privacy-friendly route. It can confirm the person is an adult without handing the app the parent's full ID. ## When does it start? Rule 10 is among the rules that come into force [eighteen months after publication](https://egazette.gov.in/WriteReadData/2025/267650.pdf?ref=thecyberstories.com) in the Gazette of November 13, 2025\. That puts the start in May 2027. ## What remains unknown? How many apps will use tokens rather than collecting ID copies, and how strictly they'll check who is a child in the first place. Children can lie about their age, and the Rules lean on the app's own care in checking. ## What parents should do - **Expect a consent request,** and be suspicious of any kids' app that never asks. - **Use a token or DigiLocker** where offered, rather than uploading a photo of your ID. - **Check the ads.** Targeted ads aimed at your child will be against the law. Report them to the company first, and its grievance officer. ## What app builders should do - **Map every place children can sign up,** including games and education features inside bigger apps. - **Build the parent check now,** with a token or DigiLocker route, and keep a record of each consent. - **Switch off tracking and ad targeting** for accounts you know or suspect belong to children. ## Sources - [The Digital Personal Data Protection Act, 2023 (Ministry of Electronics and IT)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf?ref=thecyberstories.com) - [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) (Gazette of India, November 13, 2025)](https://egazette.gov.in/WriteReadData/2025/267650.pdf?ref=thecyberstories.com)