Parental consent doesn't open the door to profiling or targeted advertising for under-18 users — DPDPA closes that door regardless of who signed off on collection.
July 2026 · 3 min read
The DPDPA sets a materially higher bar for processing children's data — anyone under 18 — than it does for adults, and the bar isn't only about who consents. It's about what you're allowed to do with that data even once consent exists.
Even with parental consent in hand, organizations can't track behavior, run targeted advertising, or build any kind of profile on a child user. This is a default position under the Act, not a setting you can configure your way around with a sufficiently detailed consent form — the prohibition applies regardless of what the parent agreed to.
Consent for a child has to come from a parent or guardian, and it has to be verifiable — not a self-reported checkbox claiming "I am a parent." The purposes behind the collection need to be communicated clearly enough for a parent to make an informed decision, and by default, no profiling or advertising should be enabled regardless of what else the consent covers.
Age has to be established at the point of registration, not inferred later or left to self-declaration alone. That means implementing real age verification during signup, not a single unchecked "I am over 18" box that anyone can click past.
Once a user is identified as a minor, their data needs clear segregation from your general user base — either through a genuinely separate data store or through access and processing controls strict enough to function as a real boundary, not a database flag that downstream systems quietly ignore.
Your consent and preference infrastructure needs to know a user is a minor and exclude them from any non-essential purpose by default — marketing, personalization, analytics profiling — rather than relying on someone remembering to configure this manually for every child account. Built correctly, the underlying consent and audit workflows don't need to be reinvented for minors — they need an age flag that automatically narrows what's permitted, with revocation and history tracked the same way as for any other user.
Section 9 is where these obligations live: verifiable consent from a parent or lawful guardian, and a default prohibition on tracking, behavioural monitoring and targeted advertising directed at children. The DPDP Rules carve out a narrow, conditional exemption pathway for specific categories of Data Fiduciary and specific processing purposes — but it's conditional, not a blanket carve-out, and it's the kind of detail worth confirming applies to your specific processing rather than assuming it does because your sector is mentioned somewhere in the framework.
This hits some sectors harder than others by default. EdTech platforms process children's data as a core function, not an edge case, and healthcare providers routinely handle data for minors alongside adult patients under the same systems. If either describes your organisation, a targeted DPDP gap assessment is the fastest way to find out exactly where your current age-gating and consent flows fall short of Section 9, rather than discovering it after a complaint.
30 minutes to talk through your specific data footprint — no obligation.
Book a Consultation