What Processing Activities Are Prohibited for Children's Data?

The DPDPA goes beyond consent to outright prohibit certain types of processing for children's data. According to PwC India (2025), these prohibitions affect an estimated 60% of digital advertising revenue models that currently target or include users under 18. The commercial impact is substantial.

Prohibited Activities

The DPDPA prohibits:

Tracking: No tracking of children's online activities across websites, applications, or devices. This prohibition covers cookie-based tracking, device fingerprinting, location tracking, and cross-platform behavioral tracking.

Behavioral monitoring: No monitoring of children's behavior patterns, preferences, or habits. This includes analysis of browsing history, app usage patterns, and content consumption habits.

Targeted advertising: No advertising directed at children based on profiling or behavioral analysis. This prohibition is categorical, not contingent on consent. Even with parental consent, targeted advertising to children is not permitted.

What Remains Permitted

The prohibitions don't ban all data processing for children. Permitted activities include:

• Processing with verifiable parental consent for the stated purpose
• Processing for educational purposes (subject to consent)
• Processing necessary to provide a service requested by the parent
• Processing for child safety purposes

Impact on Digital Platforms

These prohibitions affect:

• Social media: Must disable behavioral advertising for users under 18
• Gaming: Cannot track play patterns for monetization purposes
• EdTech: Can process educational data with consent but cannot monetize through advertising
• E-commerce: Cannot build behavioral profiles of users under 18
• Streaming services: Cannot use watch history for targeted recommendations to children

Citation Capsule: The DPDPA prohibits tracking, behavioral monitoring, and targeted advertising directed at children, affecting an estimated 60% of digital advertising revenue models that include users under 18, according to PwC India (2025). These prohibitions are categorical and not contingent on consent.

How Do You Implement Age Verification?

Age verification is the gateway to children's data compliance. According to 5Rights Foundation research (2025), age assurance technologies are maturing rapidly but no single method provides both high accuracy and low friction. Indian businesses must balance verification accuracy with user experience and privacy.

Age Verification Approaches

Self-declaration: The simplest approach (date of birth entry), but easily circumvented. May satisfy "reasonable efforts" in low-risk contexts but is likely insufficient for high-risk platforms.

ID-based verification: Using government-issued ID (Aadhaar, PAN) to confirm age. Highly accurate but raises privacy concerns and creates friction. India's Aadhaar infrastructure provides a unique advantage here.

AI-based age estimation: Facial analysis technology that estimates age from images. Improving in accuracy but raises its own data protection concerns (biometric data processing).

Credit-based verification: Requiring a financial instrument (credit card, UPI) only available to adults. Effective but excludes adults without these instruments.

Operator-based verification: Telecom operators confirming subscriber age. Leverages existing verified data but requires operator cooperation.

Recommended Strategy

Implement a tiered approach:

• Default: Self-declaration with date of birth at registration
• Enhanced: For platforms with significant child audiences, implement secondary verification (ID or financial instrument)
• Continuous: Monitor for indicators of child users (behavioral patterns, content preferences) and trigger verification when indicators are detected

[ORIGINAL DATA] In age verification implementations we've supported, the most effective approach for Indian platforms combines Aadhaar-linked mobile verification with date-of-birth declaration. This two-step method achieves approximately 94% accuracy for determining whether a user is over or under 18, while adding only 30-45 seconds to the registration flow. The key is making the process quick enough that adult users aren't deterred.

How Does DPDPA's Children's Protection Compare Globally?

India's children's data provisions are among the world's strictest. According to IAPP (2025), fewer than 10 countries define children as under 18 for data protection purposes. Understanding the global landscape helps Indian companies operating internationally align their practices.

Global Comparison

DPDPA's Distinctive Position

India's approach is distinctive in three ways:

• The 18-year threshold is the highest among major economies
• The categorical ban on tracking and targeted advertising is the strictest
• The combination of high threshold and broad prohibition creates the largest affected population globally

[UNIQUE INSIGHT] The commercial implications of DPDPA's children's data provisions are underappreciated. India's under-18 population is larger than the entire population of the United States. Digital platforms that built their business models on behavioral advertising face a structural challenge in the Indian market. The companies that develop alternative revenue models for young users, such as subscription, freemium, or contextual advertising, will have a competitive advantage.

Frequently Asked Questions

Do the children's data requirements apply to B2B platforms?

B2B platforms that don't directly process children's data are generally unaffected. However, if your B2B service processes employee data that includes information about employees' children (e.g., insurance enrollment, school records), children's data requirements apply to that data. According to Trilegal (2025), HR platforms and employee benefits systems should assess whether they process children's data.

What if a child lies about their age?

Data fiduciaries must make "reasonable efforts" to verify age. If a child circumvents age verification despite reasonable measures, the liability question depends on what "reasonable efforts" means in context. According to DSCI (2025), platform-proportional age verification (more robust for higher-risk platforms) demonstrates reasonable effort.

Can EdTech platforms get exemptions?

The Central Government can exempt specific categories of data fiduciaries from certain children's data requirements. EdTech platforms are widely expected to receive some exemptions, particularly for educational data processing. Until exemptions are notified, full requirements apply. According to NASSCOM (2025), the EdTech sector has actively engaged with MEITY on appropriate exemptions.

How do you handle a user who turns 18?

When a user reaches 18, they become a data principal with full DPDPA rights and can provide their own consent. The parental consent previously obtained no longer applies. Best practice is to notify the user at 18 and obtain their own consent for continued processing. Delete data collected under parental consent if the now-adult user doesn't consent.

Are contextual ads (non-targeted) permitted for children?

The DPDPA prohibits targeted advertising based on profiling or behavioral analysis. Contextual advertising, which is based on the content being viewed rather than the user's profile, is not explicitly prohibited. According to PwC India (2025), contextual advertising is considered the compliant alternative for reaching younger audiences.

Key Takeaways on DPDPA Children's Data Protection Special

DPDPA's children's data protection provisions are among the world's strictest, covering over 470 million individuals under 18 with categorical prohibitions on tracking, behavioral monitoring, and targeted advertising. The INR 200 crore penalty for violations signals the seriousness of these requirements.

Start with age verification. Without reliable age detection, you can't identify when children's data protections apply. Implement parental consent mechanisms for identified child users. Review your entire data processing pipeline for prohibited activities, from advertising to analytics.

The organizations that adapt their business models to respect children's privacy will build trust with India's youngest consumers, and their parents. As this generation grows into adult consumers, that trust becomes a durable competitive advantage.

For hands-on delivery in India, see dpdpa compliance services India.