On this page
India's first full privacy law has a section written just for children. The Digital Personal Data Protection Act, 2023 became law on 11 August 2023. Its rules are dated 13 November 2025 in the Gazette and were announced on 14 November, according to the Press Information Bureau backgrounder. If your child uses a learning app, game or social platform, these rules decide what it may do with their data.
What does the DPDP Act say about children?
Under the Act, a "child" is anyone who has not completed 18 years of age (DPDP Act, Section 2(f)). So a Class 12 student preparing for JEE Main counts as a child, just like a seven-year-old.
Section 9 of the Act sets three rules for any company (the law calls it a "Data Fiduciary") that handles a child's data:
Parental consent first. It must get "verifiable consent of the parent" before processing any of the child's personal data.
No harm. It must not process data in a way "likely to cause any detrimental effect on the well-being of a child".
No tracking, no targeted ads. It must not undertake "tracking or behavioural monitoring of children or targeted advertising directed at children".
Breaking these child-specific duties can cost a company a penalty of up to ₹200 crore, under the Schedule to the Act.
How does verifiable parental consent work?
Rule 10 of the DPDP Rules, 2025 (Gazette text) says the app must check that the person saying "I am the parent" is an identifiable adult, meaning someone who has completed 18 years. It can do this using reliable identity and age details it already holds, details the parent provides, or a virtual token issued by an authorised entity, which can include a Digital Locker service provider.
When do these rules start?
Rule 1(4) of the DPDP Rules, 2025 says Rule 10 on parental consent and Rule 12 on exemptions come into force 18 months after the Rules were published on 13 November 2025, which is 13 May 2027. Section 9 of the Act follows the same 18-month timeline under notification G.S.R. 843(E) (TeamLease RegTech summary). In January 2026 the ministry floated a proposal to shorten the 18-month window, but no amendment had been notified as of September 2026 (MirvoLegal timeline).
Are there exceptions for schools and safety?
Yes. The Fourth Schedule of the Rules switches off the consent and no-tracking duties in narrow cases, including:
clinics, mental health establishments and healthcare professionals, only to provide health services to the child
an educational institution, only for tracking and behavioural monitoring for its own educational activities or for the safety of children enrolled with it
crèches and day-care centres, and school or crèche transport, only for the children's safety
tracking a child's real-time location for her safety, creating an email-only account, blocking content or ads that could harm the child, and checking that a user is not a child
Two details matter. First, none of these exemptions removes the duty not to harm a child's well-being. Second, the Rules define an educational institution to include "an institution of learning that imparts education, including vocational education". They do not name edtech apps, so ask the app which rule it relies on.
What questions should families ask an app?
The PIB backgrounder says companies must answer requests about access, correction, updating or erasure of personal data within 90 days (PIB). That duty, like the children's rules, starts in May 2027, but you can ask today. Before your child signs up, or at the next renewal, ask:
Do you treat users under 18 as children, and how will you get my verifiable consent?
What personal data do you collect about my child, and for which purpose?
Do you show my child ads, or build a profile of their behaviour to target them?
Do you share my child's data with other companies? Which ones?
Who is your contact for data questions, and how do I ask for my child's data to be erased?
Once these sections apply, the Act lets you ask for a summary of the data and the list of companies it was shared with (Section 11), and for correction or erasure (Section 12). You must use the company's grievance process before complaining to the Data Protection Board (Section 13).
The same questions apply to any AI tutor, including Fermi's AI tutor, where a student's progress, notes and everything generated along the way stay in the student's library.
For more, read our guide to privacy in learning apps and what "AI-powered" means in edtech apps. For the conversation at home, see how much privacy to give your teenager.
Pick one app your child uses daily and send the five questions this week.
