India Privacy Act Understand. Assess. Protect.
Extra care required

Children's data needs a higher bar.

The Act defines a child as anyone under 18 — and processing a child's personal data comes with additional obligations.

← Back home

Verifiable parental consent

Before processing a child's personal data, you generally need verifiable consent from a parent or lawful guardian, in the manner the rules prescribe — subject to any applicable exemptions.

Well-being comes first

Fiduciaries must not process a child's data in a way that's likely to cause a detrimental effect on their well-being.

No tracking or behavioural monitoring

The Act restricts tracking or behavioural monitoring of children.

No targeted advertising

Targeted advertising directed at children is also restricted.

If your website, app, or product is used by children — even incidentally — this deserves particular attention in how you design consent flows, analytics, and marketing.

Rules for children's data can carry exemptions and specific conditions depending on the service. This is a general overview, not a compliance determination for your product.