In brief
Under India's data protection law, an app can't simply let a child sign up. It must first get consent from a parent, and check that the parent is a real adult. The law also bans tracking children and targeting ads at them. The detailed rule takes effect in May 2027, so apps that serve families have months, not years, to get ready.
What does the law say?
The Digital Personal Data Protection Act, 2023 says a company must obtain verifiable consent of the parent before processing any personal data of a child. Under the law, a child is anyone under 18, and the Rules define an adult as someone who has completed the age of eighteen years.
Two more lines in the Act matter as much. Companies may not process children's data in a way likely to cause any detrimental effect on the well-being of a child. And they may not do tracking or behavioural monitoring of children or targeted advertising directed at children.
How the check works
Rule 10 of the DPDP Rules turns that into practice. An app must make sure verifiable consent of the parent is obtained first, and check that the person claiming to be the parent is an adult who is identifiable. It can do that in one of two ways:
- Details it already has. If the parent already uses the app and has shared reliable identity and age details, it can rely on those.
- Details the parent brings. Otherwise, the parent provides them, or shares a virtual token issued by an authorised entity. The Rules say a parent may do this using a Digital Locker service provider, such as DigiLocker.
The Rules give worked examples. A child says she's a child and names her parent: the app must let the parent identify herself and check before creating the account. A parent opens an account for their child: same check.
A virtual token is the privacy-friendly route. It can confirm the person is an adult without handing the app the parent's full ID.
When does it start?
Rule 10 is among the rules that come into force eighteen months after publication in the Gazette of November 13, 2025. That puts the start in May 2027.
What remains unknown?
How many apps will use tokens rather than collecting ID copies, and how strictly they'll check who is a child in the first place. Children can lie about their age, and the Rules lean on the app's own care in checking.
What parents should do
- Expect a consent request, and be suspicious of any kids' app that never asks.
- Use a token or DigiLocker where offered, rather than uploading a photo of your ID.
- Check the ads. Targeted ads aimed at your child will be against the law. Report them to the company first, and its grievance officer.
What app builders should do
- Map every place children can sign up, including games and education features inside bigger apps.
- Build the parent check now, with a token or DigiLocker route, and keep a record of each consent.
- Switch off tracking and ad targeting for accounts you know or suspect belong to children.