Section 9 — Processing of Personal Data of Children and Persons with Disabilities

Section 9 applies whenever a Data Fiduciary processes the personal data of a child — anyone who hasn't completed eighteen years, under Section 2(f) — or of a person with disability who has a lawful guardian, folded into the "Data Principal" definition by Section 2(j)(ii). It doesn't replace anything in Section 8; every general obligation still applies in full. Section 9 adds a second, stricter layer on top, because the Act treats this category of data as carrying a different order of risk.

Verifiable consent, not a checkbox — 9(1)

Before processing a child's or a guardian-dependent person's personal data, a Data Fiduciary must obtain verifiable consent of the parent or lawful guardian, in the manner prescribed. The Explanation clarifies that "consent of the parent" already includes a lawful guardian's consent wherever that's the applicable relationship. The Act itself doesn't define what makes consent "verifiable" — that's left to the Rules, which require the Fiduciary to run actual due diligence confirming the adult on the other end is who they claim to be, whether through identity details it already reliably holds or details the parent voluntarily supplies directly or via a virtual token from an authorised entity such as a Digital Locker service. For a lawful guardian of a person with disability, the equivalent check confirms the guardian was actually appointed by a court, a designated authority, or a local-level committee — not someone self-declaring as a caretaker. The practical effect is the same either way: an age-gate checkbox that a nine-year-old can tick on her parent's behalf doesn't meet this bar.

A harm test that consent can't switch off — 9(2)

Separately from consent, a Data Fiduciary must not undertake processing of a child's personal data that is likely to cause any detrimental effect on the child's well-being. This is a free-standing duty, not a consent-dependent one — a parent agreeing to something doesn't make it permissible if the processing itself is harmful. It's also the one part of Section 9 with no exemption route anywhere in the Rules: whatever carve-outs apply to sub-sections (1) and (3), sub-section (2)'s harm test keeps applying regardless.

The flat ban on tracking and ad-targeting — 9(3)

A Data Fiduciary "shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children." There's no consent-based workaround here either — a parent can't opt a child into behavioural tracking, because the restriction doesn't run through consent at all. The focus is the nature of the activity, not the technology used to carry it out: a recommendation engine that profiles a child's usage patterns to personalise content or ads is squarely inside this ban, whether or not anyone calls it "personalisation" rather than "tracking."

Exemptions are narrow, and only apply to two of the five sub-sections — 9(4), 9(5)

Sub-section (4) lets the Rules exempt specific classes of Data Fiduciaries, or specific purposes, from sub-sections (1) and (3) only — never from (2)'s harm test. In practice, this covers a short list: clinical and mental health establishments, allied healthcare professionals, educational institutions, creche and day-care operators, and transport providers serving them, but only to the extent the processing serves the health, education or safety purpose actually named — not a general licence to drop the parental-consent requirement across the board. A handful of purpose-based exemptions also apply narrowly, such as safety-related location tracking, creating an email-only account, and age verification itself. Sub-section (5) is a different mechanism entirely: the Central Government may notify, for a specific Data Fiduciary it's satisfied processes children's data in a verifiably safe manner, an age above which that Fiduciary is exempt from (1) and (3) — a fiduciary-specific carve-out earned case by case, not a blanket industry exemption.

Why this matters in practice

The Schedule to the Act treats a breach of Section 9's additional obligations as its own category, carrying a penalty that may extend to ₹200 crore — second only to the ₹250 crore ceiling for a security-safeguards failure under Section 8(5). For any product with meaningful under-18 usage, that puts age assurance and consent verification ahead of almost every other compliance workstream, not behind it.

Illustration: an ed-tech platform lets a thirteen-year-old create an account by having a parent tick a consent box during signup, with no check on who the parent actually is. Under Section 9(1) and Rule 10, that's not verifiable consent — the platform has no due-diligence trail confirming an identifiable adult gave that consent. If the same platform then uses the student's activity data to personalise which paid courses get recommended to her, that's a separate problem under Section 9(3), regardless of whatever the parent agreed to at signup.

How Section 9 connects to the rest of the Act

Section 2(f) and 2(j)(ii) define who Section 9 actually covers; Section 8 remains the operational floor underneath it. Rule 10 and Rule 11 detail the verifiable-consent mechanics for children and for guardian-dependent persons with disabilities respectively, Rule 12 and the Fourth Schedule detail the exemption classes and purposes under 9(4), and the Schedule under Section 33(1) sets the ₹200 crore penalty ceiling for getting any of it wrong.