Children’s Data & Age Assurance under the DPDPA
Verifiable consent, no tracking or targeted ads to children, and robust age-assurance—implemented credibly and defensibly.
Key Obligations at a Glance
Age Threshold & Consent
DPDPA treats any person under 18 as a child; parental/guardian verifiable consent is mandatory before processing.
Prohibitions
No tracking, behavioural monitoring, or targeted advertising directed at children. Avoid any processing likely to cause detriment.
Age Assurance
Risk-based checks (self-declaration + signals, document or OTP-based checks, trusted-intermediary models) proportionate to risk.
High-Risk Scenarios
Games, ed-tech, social products, wearables, location features—apply stricter default privacy and DPIA before launch.
Detailed Compliance Topics
DPDPA Duties for Children’s Data
- Verifiable Consent: Collect and retain evidence of parental/guardian consent; withdrawal must be as easy as grant.
- Prohibitions: No targeted advertising, tracking, or behavioural monitoring of children; avoid any processing causing likely detriment to well-being.
- Purpose Limitation: Use data strictly for stated purposes beneficial to the child; no secondary use without fresh lawful basis.
- Data Minimisation: Collect only what is necessary; disable precise location, camera/mic and messaging features by default unless essential.
- Security & Retention: Apply heightened safeguards and shortest-necessary retention with auto-deletion schedules.
Practical Controls & Reference Architecture
- Age-Assurance Ladder: Start with low-friction checks (age-gates + risk signals); escalate to OTP/ID-based or intermediary models for higher risk features (social, chat, geolocation).
- Consent Orchestration: Central ledger for consent status, provenance, time-stamps, and withdrawal; enforce in API gateway.
- Policy Enforcement Points: Disable ads SDKs, disable personalised feeds, and block cross-site tracking for child cohorts at the edge.
- UI/UX for Children: Clear language, prominent privacy toggles, nudging prohibited; safety defaults “on.”
- DPIA Templates: Pre-launch DPIA covering profiling, location, chat, UGC, and recommender systems; document residual risks.
Implementation Roadmap & Audit Checklist
- Map Child Touchpoints: Product inventory of flows where children may interact or be targeted inadvertently.
- Select Age-Assurance: Choose risk-proportionate methods; run false-positive/negative testing.
- Consent Proofing: Implement verifiable consent capture with revocation; build audit exports.
- Ad/Tracking Shutdown: Systematically disable tracking & ads for children; verify with SDK scanning.
- Training & SOPs: Product, marketing, and ad-ops playbooks; quarterly audits and anonymous red-team tests.