On this page
If your child uses a study app, a test series or a school portal, someone probably ticked a consent box without reading it. India's data protection law is changing what that box has to mean for anyone under 18. Here is what the law says, when it starts, and what you can check today.
What does the DPDP Act say about children's data?
The Digital Personal Data Protection Act, 2023 defines a child as “an individual who has not completed the age of eighteen years”.
Section 9 of the Act puts three duties on any company or body that decides how a child's data is used (the law calls it a “Data Fiduciary”):
It must obtain “verifiable consent of the parent” before processing any personal data of a child.
It must not process data in a way “likely to cause any detrimental effect on the well-being of a child”.
It must not undertake “tracking or behavioural monitoring of children or targeted advertising directed at children”.
The Act also gives you a direct role: for a child, the “Data Principal”, the person whose data it is, includes the parents or lawful guardian. The Press Information Bureau's backgrounder on the DPDP Rules says violations of obligations relating to children can attract penalties of up to ₹200 crore.
How does an app check that you are really the parent?
The method is in Rule 10 of the Digital Personal Data Protection Rules, 2025. The app must check that the person consenting is an identifiable adult, meaning someone who has completed 18, using one of these:
reliable identity and age details it already holds, for example because you have your own account on the same platform;
identity and age details you provide voluntarily;
a virtual token mapped to those details from an authorised entity, which includes details verified by a Digital Locker service provider.
The Rules walk through four cases: the child or the parent starts the sign-up, and the parent is or is not already a registered user. In every case the app must confirm the parent is an identifiable adult before it processes the child's data to create the account.
When does the parental consent rule start?
Not yet. Rule 1 of the DPDP Rules, published in the Gazette on 13 November 2025, says Rules 3, 5 to 16, 22 and 23, which include the children's consent rule, come into force eighteen months after publication: around 13 May 2027. A September 2026 timeline review by MirvoLegal reports that MeitY floated a proposal in January 2026 to cut that period to 12 months, but found no amending notification as of 20 September 2026. Check MeitY's site for the current date.
You can still ask any provider about it now.
Do schools and school portals need parental consent too?
Partly. The Fourth Schedule of the DPDP Rules exempts an educational institution from the consent and no-tracking duties, but only for “tracking and behavioural monitoring” for its “educational activities” or “in the interests of safety of children enrolled”. A school's transport provider is exempt only for tracking a child's location on the way to and from school.
Read that narrowly. It covers education and safety, not, say, passing your child's details to another company for marketing. And the duty not to harm a child's well-being has no school exemption. Our parents' guide to online school portals covers the everyday side of these systems.
A parent's checklist for study apps and school portals
Who is responsible? Find the company or school named in the privacy notice.
What is collected, and why? Rule 3 of the DPDP Rules requires an “itemised description” of the data and its specific purpose.
Were you asked? Once the rule is in force, an under-18 account should have a step where you, not your child, consent and are verified.
Is anything aimed at your child? Section 9 bans tracking or behavioural monitoring of children and targeted advertising directed at them, apart from the narrow exemptions above.
Are permissions limited? A maths app rarely needs contacts or precise location. Section 6 of the DPDP Act limits consent to data “necessary” for the stated purpose.
Who answers questions? Rule 9 requires a published contact for questions about your data.
Can you correct or delete data? The PIB backgrounder says Data Fiduciaries must respond to access, correction, updating or erasure requests within ninety days.
What does your child share themselves? The law binds the company, not your child's posts. Go through what children should never share online together.
The same questions apply to every study tool, ours included. Fermi's AI tutor works out what a student already knows to build a plan for the session, so it is fair to ask what it keeps and for how long.
For more on reading privacy settings, see our guide to privacy in learning apps.
