CHILDREN’S DATA PROTECTION UNDER THE DPDPA: A STEP FORWARD OR AN UNFINISHED SAFEGUARD

INTRODUCTION: Who protects the child online?

When a child enters the digital world, is their data protected by the parent, the platform, or the law? In practice, children’s personal data is gathered through ed-tech platforms, gaming applications, social media, entertainment services and ordinary online services that rely on profiling, engagement tracking and targeted design. This article argues that the Digital Personal Data Protection Act, 2023 is a significant step forward because it recognises children as a special category requiring stronger protection, yet it remains an unfinished safeguard because parental consent, age verification, platform accountability, enforcement and child autonomy still raise unresolved legal questions.[2]

The constitutional importance of the issue is clear. In Justice K.S. Puttaswamy (Retd.) v Union of India, the Supreme Court recognised privacy as part of the right to life and personal liberty, grounding it in dignity and autonomy. If privacy is to be meaningful for children, the law must do more than create a consent checkbox.[3] It must ask whether the structure of digital services itself is compatible with childhood and vulnerability.

THE LEGAL PROMISE: Children as Vulnerable Data Principles

Section 9 of the DPDP Act treats a child as an individual who has not completed eighteen years and requires verifiable consent of the parent or lawful guardian before processing a child’s personal data. The Act also prohibits processing that is likely to have a detrimental effect on the well-being of the child, and bars tracking, behavioural monitoring and targeted advertising directed at children.[4] These are important restrictions because they recognise that children are not merely smaller adults in data law. The statute also places responsibility on the data fiduciary, rather than leaving compliance entirely to parents or intermediaries. That matters in a digital economy where platforms often design services to maximise attention and data extraction. The legal promise of the DPDP Act is therefore clear: children are to be protected from surveillance-heavy processing that may exploit their limited capacity to assess long-term consequences.[5]
Yet the Act’s promise depends on whether these rules work in reality. A law that appears protective on paper may still fail if its safeguards are too formal, too easy to evade, or too dependent on user behaviour rather than platform design.

THE LEGAL GAPS: Consent, Verification and Autonomy

Can parental consent alone protect children in a digital economy built on profiling and behavioural tracking? It cannot. The DPDP Act places the parent or lawful guardian at the centre of decision-making, but consent often becomes a formal compliance step rather than informed legal authorisation. Parents usually cannot fully understand how platforms collect, infer, share and monetise children’s data.[6]

Verifiable parental consent also creates a privacy paradox. To verify age or authority, platforms may need to collect more personal data before processing can begin. The child is then protected from one intrusion but exposed to another at the verification stage[7]. A true safeguard must therefore require minimal and privacy-preserving age assurance.

The law also places too much burden on parents and too little on platforms. Parents can supervise use, but they cannot control default settings, recommendation systems or dark patterns. Platforms do hold power, that the legal burden must rest primarily on data fiduciaries.

The Act also ignores the differing capacities of children and teenagers by treating everyone below eighteen alike. Older adolescents seem to often have a stronger grasp of digital risk and yet the statute does not reflect that reality.[8] In addition, consent-based protection is too weak for opaque digital ecosystems where harm comes from continuous profiling, monitoring and behavioural steering. Section 9 is therefore an important beginning, but not a complete safeguard.[9]

THE WAY FORWARD: From Formal Compliance to Child-Centric Accountability

If children’s data protection is to be meaningful, the legal focus must shift from formal consent to child-centric accountability.[10] The first reform should be child-friendly privacy notices written in clear, age-appropriate language. Notices should explain, in simple terms, what data is collected, why it is collected, how long it is kept and whether it is shared. A notice that is technically accurate but unintelligible cannot satisfy the purpose of informed protection.

Secondly, the law should require privacy-by-design and safety-by-design for services likely to process children’s data. Default high-privacy settings, limited profiling, restricted visibility and minimal data collection should be built into the architecture of the platform rather than added later as a correction.[11] This is especially important for ed-tech, gaming and social media platforms, where the child’s experience is shaped by interface choices and automated recommendations. The law should require protective defaults, not merely optional settings.

Thirdly, data minimisation and short retention periods should be treated as central safeguards. If a service does not need a child’s precise location, contact list or persistent behavioural profile, it should not collect or retain such data. Similarly, platforms should definitely not store children’s data indefinitely with the assumption that it may become useful in the future. Children’s data should be kept only for as long as necessary for the stated purpose.[12]

Fourthly, stronger platform accountability is essential. The burden should not fall primarily on parents to understand complex digital systems. Platforms should be required to assess risks to children, document compliance and avoid manipulative design patterns. For child-facing services, duties should be stricter because the likelihood of harm is greater. The law must address how repeated prompts, dark patterns and nudges can undermine genuine parental choice.[13]

Finally, the Data Protection Board must be equipped for effective enforcement, and clearer subordinate legislation is needed to operationalise the statute. The DPDP Act leaves important matters to further rules, including how verifiable consent and related obligations will function in practice. Without detailed rules, the protection of children may remain conceptually strong but administratively weak. Enforcement must be visible, sector-sensitive and capable of responding to the realities of ed-tech, gaming and social media ecosystems.[14]

CONCLUSION: A Beginning, Not a Complete Safeguard

The DPDP Act marks an important shift in Indian data protection law because it openly recognises children as a vulnerable category and places legal limits on tracking, behavioural monitoring and targeted advertising. That is a real step forward. It shows that the law no longer treats children’s data as ordinary commercial material, but as information requiring heightened protection in light of privacy, dignity and autonomy.[15]

At the same time, the framework remains incomplete. Parental consent cannot by itself neutralise the risks created by opaque platforms, persuasive design and data-driven profiling. A child’s safety online depends not only on who clicks “agree”, but also on how the platform is built, what it collects, how long it retains the data and how strictly it is supervised.[16] For that reason, children’s data protection cannot rest on consent alone; it must be supported by stronger duties on data fiduciaries, privacy-preserving verification methods and meaningful enforcement.

The larger lesson is that child protection in the digital sphere must be structural, not symbolic. If the law is to protect children in a realistic way, it must move beyond formal compliance and require digital services to be designed around restraint, transparency and accountability. The DPDP Act has provided the foundation, but the safeguard will remain unfinished unless India supplements it with clearer rules, sharper enforcement and child-sensitive regulatory design.[17] The statute is therefore best understood as a beginning, not an endpoint.

REFERENCE(S):

1. Digital Personal Data Protection Act, 2023, No. 22 of 2023, India Code, https://www.indiacode.nic.in/bitstream/123456789/22037/1/a2023-22.pdf (last visited July 7, 2026).nic
2. Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology, https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (last visited July 7, 2026).gov
3. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, Supreme Court of India, https://api.sci.gov.in/supremecourt/2012/35071/35071_2012_Judgement_24-Aug-2017.pdf (last visited July 10, 2026).sci.gov
4. 5Rights Foundation, Our Rights in the Digital World (2024), https://5rightsfoundation.com/wp-content/uploads/2024/09/OurRIghtsinaDigitalWorld-FullReport.pdf (last visited July 10, 2026).5rightsfoundation
5. Press Information Bureau, DPDP Act, 2023 Upholds Privacy While Preserving Innovation and Ease of Doing Business (Aug. 19, 2025), https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2158506 (last visited July 10, 2026).

[1] 5Rights Foundation, Our Rights in the Digital World 1 (2024), https://5rightsfoundation.com/wp-content/uploads/2024/09/OurRIghtsinaDigitalWorld-FullReport.pdf (last visited July 7, 2026).

[2] The Digital Personal Data Protection Act, 2023, No. 22 of 2023, India Code, enacted Aug. 11, 2023, available at https://www.indiacode.nic.in/handle/123456789/22037?view_type=browse (last visited July 7, 2026).

[3] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, Supreme Court of India, judgment dated Aug. 24, 2017, available at https://api.sci.gov.in/supremecourt/2012/35071/35071_2012_Judgement_24-Aug-2017.pdf (last visited July 7, 2026).

[4] The Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology PDF, available at https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (last visited July 7, 2026)

[5] The Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology PDF, available at https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (last visited July 7, 2026)

[6] The Digital Personal Data Protection Act, 2023, No. 22 of 2023, India Code, enacted Aug. 11, 2023, available at https://www.indiacode.nic.in/handle/123456789/22037?view_type=browse (last visited July 7, 2026).

[7] UN Office of the High Commissioner for Human Rights, “Children want to shape their rights in the digital world” (Nov. 19, 2025), available at https://www.ohchr.org/en/stories/2025/11/children-want-shape-their-rights-digital-world (last visited July 7, 2026).

[8] The Digital Personal Data Protection Act, 2023, No. 22 of 2023, India Code, enacted Aug. 11, 2023, available at https://www.indiacode.nic.in/handle/123456789/22037?view_type=browse (last visited July 7, 2026).

[9] The Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology PDF, available at https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (last visited July 7, 2026)

[10] UNICEF, Children’s Rights in the Digital Age (2019), available at https://www.unicef.org/childrightsandbusiness/reports/childrens-rights-digital-age (last visited July 9, 2026).

[11] Press Information Bureau, DPDP Act, 2023 Upholds Privacy While Preserving Innovation and Ease of Doing Business (Aug. 19, 2025), available at https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2158506 (last visited July 9, 2026)

[12] UNICEF, Children’s Rights in the Digital Age (2019), available at
https://www.unicef.org/childrightsandbusiness/reports/childrens-rights-digital-age (last visited July 9, 2026).

[13] Press Information Bureau, DPDP Act, 2023 Upholds Privacy While Preserving Innovation and Ease of Doing Business (Aug. 19, 2025), available at https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2158506 (last visited July 10, 2026)

[14] The Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology PDF, available at https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (last visited July 10, 2026)

[15] The Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology PDF, available at https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (last visited July 10, 2026)

[16] UN Office of the High Commissioner for Human Rights, “Children want to shape their rights in the digital world” (Nov. 19, 2025), available at https://www.ohchr.org/en/stories/2025/11/children-want-shape-their-rights-digital-world (last visited July 10, 2026).

[17] The Digital Personal Data Protection Act, 2023, Ministry of Electronics and Information Technology PDF, available at https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf (last visited July 10, 2026)