The DPDP framework provides special protections for children’s data and requires verifiable parental consent, subject to the applicable commencement date and notified exceptions. It would not be accurate to describe it as a fully effective rule for all apps today.
Understand the law and process
Under the general definition in the DPDP Act, a person under eighteen years of age is a child. The law sets out restrictions and certain exceptions relating to tracking children, behavioural monitoring and targeted advertising. The rules may treat references to schools, healthcare services or other notified purposes differently. A simple checkbox in an app does not establish that an appropriate parent or guardian gave informed permission. Conversely, parental permission does not mean that every kind of processing is lawful. During the transition period, school agreements, applicable IT rules and other laws concerning child safety are also important.
In detail: What could affect the outcome?
Parents should ask what data the app needs for education and which permissions are sought only for advertising or profiling. Ask separately about the purpose of access to the contact list, continuous location tracking and the microphone. Granting every permission without a reason is not merely a matter of convenience; it is also a question of who is receiving the child’s information.
What should you do?
- Keep a copy of the app’s age policy, the school circular and the list of permissions requested.
- Ask in writing about parent verification, data sharing and the process for closing the account.
- Disable unnecessary permissions and, if there is a sensitive use, complain to the school or the platform’s grievance officer.
Which documents should you keep?
Keep the admission agreement, app policy, permission screen, details of the child’s account and the institution’s responses.
Hypothetical example
Suppose a homework app automatically asks for permission to create an advertising profile. Opening an account for schoolwork and giving consent to advertising are separate issues. You may ask the school for a clear response about alternative access to homework and unnecessary permissions.
Does parental permission make every use of data lawful?
No. In addition to consent, the applicable restrictions, the child’s interests, the purpose and the exceptions provided by law must be examined.
Sources and related rules
- Digital Personal Data Protection Act 2023
- DPDP commencement notification, November 2025
- DPDP Rules 2025
Editorial review: October 26, 2026. This is general legal information. The outcome may vary depending on the facts of the case, applicable state law and subsequent amendments.