Verifiable Parental Consent in India: DPDP Rule 10 Guide

The short answer

Under Rule 10 of the Digital Personal Data Protection Rules, 2025, any organisation that processes the personal data of a child in India must obtain verifiable consent from the child's parent or lawful guardian, and must independently verify that the person giving that consent is an identifiable adult. A child, for this purpose, is anyone under 18 — not 13, not 16. The obligation is not yet live: Rule 10 commences roughly 18 months after the Rules were notified on 14 November 2025, which places it in mid-May 2027. Everything about the engineering, however, has to be designed and tested well before that.

If you run an edtech platform, a gaming app, a social product or a D2C brand whose sign-up funnel never asks for age, this is one of the heavier build items in the whole DPDP programme. Our DPDP compliance implementation work and wider India technology practice exist for this kind of problem: a legal deadline that resolves into product, identity and data-architecture decisions rather than a policy document. Stratgik is a technology firm, not a law firm — take your legal position from qualified Indian counsel.

What the law actually says

Two layers matter. Section 9 of the Digital Personal Data Protection Act, 2023 sets the obligations. The DPDP Rules, 2025 set the method.

Section 9 has five limbs:

• 9(1) — obtain verifiable consent of the parent or lawful guardian before processing a child's personal data, by the method prescribed in the Rules.
• 9(2) — do not undertake processing likely to cause any detrimental effect on the well-being of a child.
• 9(3) — do not track or behaviourally monitor children, and do not direct targeted advertising at them.
• 9(4) — the Government may exempt certain classes of Data Fiduciary, or certain purposes, from 9(1) and 9(3), subject to conditions.
• 9(5) — the Government may notify, for a specific Data Fiduciary that processes children's data in a verifiably safe manner, an age above which some or all of these obligations do not apply.

Rule 10 then prescribes the method. A Data Fiduciary must adopt appropriate technical and organisational measures to ensure that verifiable consent is obtained before processing, and must observe due diligence to check that the person claiming to be the parent is an identifiable adult — defined in the Rule as someone who has completed eighteen years of age. Three routes are permitted: reliable identity and age details already held by the Data Fiduciary; identity and age details voluntarily provided by the individual; or a virtual token mapped to such details and issued by an "authorised entity", which includes details made available and verified through a Digital Locker Service Provider. Rule 11 deals separately with persons with disability who have a lawful guardian.

The Rule's four illustrations tell you what the regulator expects your flow to look like. They cover the child signing up and naming a parent you already hold verified details for; the child naming a parent who is a stranger to you, so you verify against government-issued details or a mapped virtual token; and the same two cases with the parent opening the account. In half of them you are identity-checking an adult with no prior relationship to your product. That is the expensive case, and the one most products have not built.

Timelines: what is live and what is not

The Rules were published in the Official Gazette on 14 November 2025 with a deliberately phased commencement, as set out in the enforcement note from Shardul Amarchand Mangaldas & Co.

Published commentary differs by a day on the 18-month date depending on whether the printed Gazette date or the eGazette listing date is used as the anchor. Plan to 13 May 2027 and you are safe either way. Treat the exact day as pending confirmation; the primary notifications are listed on the Ministry of Electronics and Information Technology data protection framework page.

Eighteen months sounds generous. It is not, because the work is not a policy rewrite: it is an age-assurance layer, an adult identity check, a consent record store, a re-consent path for when a child turns 18, and advertising and analytics changes that touch every SDK in your app. For a mid-sized platform that is two to four quarters of engineering, with dependencies on third parties you do not control.

The exemptions, and why most commercial products do not get them

The Fourth Schedule to the Rules exempts specific classes of Data Fiduciary and specific purposes from Sections 9(1) and 9(3). The classes are narrow and institutional: clinical establishments, mental health establishments and healthcare professionals processing to provide health services to the child; allied healthcare professionals supporting a recommended treatment or referral plan; educational institutions, limited to tracking and behavioural monitoring for their educational activities or for the safety of enrolled children; crèche and day-care staff, limited to safety monitoring; and transport providers engaged by an institution, limited to tracking location during travel to and from it.

The exempted purposes are similarly tight: statutory powers or duties exercised in a child's interests; issuing a subsidy, benefit, certificate, licence or permit in her interests; an account used only for email; determining a child's real-time location for her safety; blocking access to content or advertisements likely to harm her well-being; and confirming that a Data Principal is not a child while observing Rule 10 due diligence.

Two consequences follow. First, "we are an edtech company" is not an exemption: it attaches to an educational institution, and only to tracking and monitoring for its educational activities or safety — not to a commercial platform selling courses to children. Second, the Schedule exempts nothing from Section 9(2), so the prohibition on processing likely to harm a child's well-being applies regardless. If your recommendation engine optimises watch time for under-18 users, that is a design question answered on the merits, not a checkbox.

What you actually have to build

Strip away the legal language and Rule 10 lands as six engineering workstreams.

The fourth row is where most programmes fail. Age assurance is visible UI and gets built. Propagating a child flag through six analytics tools, two ad networks, a CDP and a warehouse — and proving it is honoured — is invisible work nobody owns by default. It is also the part a regulator can test from outside, by installing your app and watching the network traffic.

Whether to build the identity layer or buy it is a real decision, and the answer differs for a 50,000-user platform and a five-million-user one. Our free build-vs-buy calculator is a reasonable first pass; if the consent ledger must sit inside your own systems for latency or data-residency reasons, that is custom software territory, and keeping it working is closer to managed technology than to a one-off project.

A practical readiness checklist

1. Find your children. Run a data-discovery pass to establish whether you already hold data on under-18s. Most consumer products do and do not know it; look at school email domains, parent-purchased accounts and support tickets.
2. Decide your age-assurance posture. Self-declaration, inference, or verified. Document the reasoning, because that reasoning is your defence.
3. Map the adult verification route. Existing reliable details, volunteered details, or a token-based check via an authorised entity or DigiLocker provider. Confirm commercial terms and latency before you design the UX around it.
4. Design the consent record now. Purpose-scoped, versioned, withdrawable, exportable. Retrofitting a consent ledger into a mature schema is the single most expensive item on this list.
5. Audit every SDK. List each third party receiving user-level events and check whether it can be switched to a non-tracking mode per user. Some cannot; budget for replacement.
6. Kill targeted advertising to under-18s. Including lookalike audiences, retargeting pixels and any model trained on children's behaviour.
7. Write the transition logic. Eighteenth birthday, consent withdrawal, guardian change, account deletion.
8. Flow obligations down. Update processor contracts and give your offshore or vendor teams written purpose limits.
9. Appoint accountability. Even if you are not a Significant Data Fiduciary, name the person who owns children's data decisions.
10. Rehearse the evidence. Produce, on demand, the consent record for a named account. If that takes a week and a data engineer, you are not ready.

What it costs to get wrong

Breaches of the Section 9 obligations sit at the top of the Act's penalty schedule, with commentary consistently citing up to ₹200 crore; read the Schedule with your counsel rather than relying on secondary summaries for the precise item mapping. The nearer risk for most companies is the enforcement mechanism: the Data Protection Board is constituted, proceedings are digital-first, and one parent's complaint is enough to start one. For a consumer brand the reputational cost arrives long before any order does.

Frequently asked questions

Who counts as a child under the DPDP Act?

Anyone who has not completed 18 years of age. India did not adopt a lower digital-consent age the way the EU and the US did, so a 17-year-old user is a child for DPDP purposes. Section 9(5) allows the Government to notify a lower threshold for a specific Data Fiduciary that processes children's data in a verifiably safe manner, but that is a case-by-case notification, not a general carve-out, and none should be assumed.

Is self-declared age enough?

Rule 10 prescribes no single technical standard and expressly allows details voluntarily provided by the individual. But it also requires due diligence that the person claiming to be a parent is an identifiable adult, and a tick-box any 12-year-old can defeat is hard to defend as due diligence for a product whose audience is obviously young. The defensible position is documented and risk-proportionate: lighter assurance for low-risk processing, stronger verification where you collect more or monetise attention.

Does Rule 10 apply to a company outside India?

The DPDP Act applies to processing of digital personal data outside India where it relates to offering goods or services to Data Principals in India. If Indian children can sign up, the obligations follow, irrespective of where your servers or entity sit.

Do we need a Consent Manager for this?

No. Consent Manager registration is a separate regime with its own earlier commencement around November 2026, and using a registered Consent Manager is an option for Data Principals rather than a precondition for parental consent. You can satisfy Rule 10 with your own flows, provided the record-keeping and verification hold up.

What happens to data we already hold on children?

You will need a position on legacy data before the 18-month date: obtain verifiable parental consent retrospectively, delete it, or establish that an exemption genuinely applies. Retrospective consent campaigns have poor response rates, so the realistic plan usually combines a targeted re-consent push with deletion of what you cannot justify keeping.

Are school and university records exempt?

Partly. Educational institutions are an exempted class, but only for tracking and behavioural monitoring in connection with their educational activities or the safety of enrolled children. That is narrower than "anything a school does with student data", and it does not extend to a commercial platform merely serving schools.

Related reading and next steps

Children's data is one strand of a wider programme. Our notes on Significant Data Fiduciary obligations under Rule 13, breach reporting under Rule 7 and CERT-In and Consent Manager registration cover the adjacent workstreams. The DPDP compliance implementation page sets out how we turn these obligations into shipped engineering, and the India practice page covers the broader context for companies building here.

If you would like to pressure-test your own readiness, book a free 30-minute session. We will walk your sign-up funnel, your SDK list and your consent model, and tell you honestly which of the ten checklist items above you can defer and which you cannot. Written by the Stratgik team. This is technology and programme guidance, not legal advice; please take your legal position from qualified Indian counsel.