Introduction
In a digitally connected world, children are among the most active and vulnerable users of the internet. Whether through educational platforms, gaming apps, or social media, Indian children increasingly interact with digital services that collect, analyse, and monetise their data. The very characteristics that define childhood, cognitive immaturity, emotional dependence, and lack of informed agency, also render children especially susceptible to privacy violations, profiling, targeted advertising, and exploitation. In such a context, protecting children’s data online is not just a regulatory necessity but a moral imperative.
India, with over 250 million individuals under the age of 18, is witnessing a sharp rise in young users accessing the internet. The push toward digitisation in education and entertainment, especially post-pandemic, has only intensified the need for robust legal frameworks that protect children’s online privacy. While India has made commendable progress through the enactment of the Digital Personal Data Protection Act, 2023, and intermediary guidelines, several challenges remain. A closer look at the Indian framework, its limitations, and emerging global trends can help identify a more effective way forward.
Introduction
Children’s data encompasses any information related to a child that can identify them, whether directly (like names, addresses, biometrics) or indirectly (such as online behaviour, search history, school affiliations). As more services move online and data becomes a currency of interaction, children's data is increasingly at risk of being exploited, often without their knowledge or understanding.
Children often cannot comprehend terms of service or privacy policies, making consent largely symbolic. Their engagement with gamified platforms, social media, and educational apps can result in unintended sharing of sensitive information. When such data is misused, it can lead to identity theft, cyberbullying, surveillance, and the creation of permanent digital profiles that follow them into adulthood.
EdTech and Children’s Data
The surge in online education platforms has revolutionised learning for millions of Indian students. EdTech services, from learning management systems and test prep apps to gamified content platforms, now play an integral role in the daily academic lives of children. However, this growing reliance on digital education has also introduced significant privacy risks, particularly concerning how these platforms collect, store, and use children's personal data.
Many EdTech platforms gather vast amounts of data including students' names, school affiliations, academic performance, device identifiers, and even behavioral insights like time spent on modules or quiz patterns. While such data may help personalize learning experiences, the absence of robust data governance frameworks in the private EdTech sector raises serious concerns. In the absence of sector-specific standards, several platforms adopt opaque privacy policies, fail to take meaningful parental consent, and may share or monetize data without clear justification.
Moreover, children engaging with these platforms are rarely aware of how their data is being used. In some cases, data is linked to social logins or third-party analytics tools, resulting in cross-platform tracking. This not only undermines the principle of informed consent but also exposes children to long-term profiling. The problem is further exacerbated in rural or under-resourced areas where parents or guardians may lack the digital literacy to question or understand the implications of such practices.
Although the Digital Data Protection Act 2023 & Draft DPDP Rules 2025 is a step forward, it does not yet include specific compliance standards tailored for the EdTech sector. There is a pressing need for regulatory intervention to ensure that educational platforms comply with the principles of data minimisation, purpose limitation, and storage limitation. Additionally, a clear distinction must be made between data collected for pedagogical improvement and that used for marketing or commercial analytics.
In this context, the future of data privacy in education must strike a balance between innovation and protection. EdTech companies should be mandated to design systems with child-centric privacy principles at their core, including default opt-outs, clear notice mechanisms, and child-friendly interfaces. Given the intimate nature of educational data, safeguarding it must be a top priority in India’s broader digital transformation.
India’s Legal Framework on Children’s Data Protection
India has moved from a fragmented set of rules to a more structured approach with the introduction of the Digital Personal Data Protection Act, 2023 (Digital Data Protection Act 2023 & Draft DPDP Rules 2025). However, it is important to examine the scope and limitations of the laws that govern how children’s data is processed, protected, and managed.
-
Digital Personal Data Protection Act, 2023: This legislation marks India’s first comprehensive data protection regime. It explicitly recognizes children as a sensitive category of data subjects. The law defines a child as anyone under the age of 18 and places stringent obligations on data fiduciaries (i.e., entities processing personal data) when handling children’s information.
Key provisions include:
- Mandatory parental consent for processing data of individuals below 18.
- Prohibition of tracking, behavioural monitoring, or targeted advertising directed at children.
- Obligation to implement “verifiable consent mechanisms” to ensure the legitimacy of parental consent.
- Requirement for data minimisation, purpose limitation, and ensuring the best interest of the child during data processing.
While these are commendable steps, several legal scholars and child rights activists have flagged the overly broad age definition and the lack of flexibility in accommodating adolescents’ evolving capacities. For example, a 17-year-old seeking to engage with a learning app or a career platform must technically obtain parental consent, a requirement that may not reflect real-world scenarios.
-
IT Rules, 2021 (Intermediary Guidelines and Digital Media Ethics Code): Framed under the Information Technology Act, 2000, these rules impose content moderation and platform accountability requirements. Though not data-specific, they play a vital role in ensuring children are not exposed to harmful content or predatory behaviour online.
Relevant features include:
- Requirement for social media platforms to take down content harmful to minors upon notification.
- Recommendation for parental control mechanisms on digital media services.
- Age-based content classification systems on OTT platforms.
However, the absence of explicit penalties or enforcement timelines often results in non-compliance. Furthermore, platform self-declarations are not independently verified for child safety standards.
- Article 21 and the Right to Privacy: In the Puttaswamy v. Union of India (2017) judgment, the Supreme Court of India recognized privacy as a fundamental right under Article 21 of the Constitution. This landmark ruling forms the constitutional foundation for all data protection frameworks in India, including protections for children. Even though the ruling does not focus on children per se, the principles of dignity, autonomy, and informed consent extend to minors.
Regulatory Gaps and Practical Challenges
Despite the legal advancements, significant gaps persist in the implementation and design of children’s data protection in India.
Key issues:
- Overbroad Age Definition: Treating all individuals under 18 as children ignores the maturity of teenagers. Globally, most frameworks (like the EU's GDPR and the US COPPA) set the age of consent between 13 and 16.
- Parental Consent as a Gatekeeper: In many low-income or digitally unskilled households, parents may be unaware of the nature of consent they are providing, or may not be present to give it at all.
- Lack of Child-Centric Design Obligations: Unlike other jurisdictions, India has no mandatory requirements for privacy-by-design for children, nudging mechanisms, or age-appropriate interfaces.
- Inadequate Age Verification Tools: Current systems rely on self-declaration or generic IDs, which are easily circumvented or may violate the child’s privacy.
- Pending Institutional Framework: The Data Protection Board, responsible for redressal and oversight under the Digital Data Protection Act 2023 & Draft DPDP Rules 2025, is yet to be fully operationalized.
Brief Comparison:
Though India is early in its journey, international norms offer guidance:
- EU’s GDPR (Article 8): Age of digital consent is 16 (can be lowered to 13 by Member States); emphasizes clear, child-friendly consent and the “right to be forgotten.”
- USA’s COPPA (Children’s Online Privacy Protection Act): Protects children under 13; mandates verifiable parental consent, data minimisation, and prohibition of targeted ads.
- UK’s Age Appropriate Design Code: Requires services likely to be accessed by children to apply privacy-by-default, prohibit nudging, and offer clear, child-centric communication.
Way Forward
To truly safeguard children’s data online, India must go beyond foundational legislation and adopt a more nuanced, implementation-focused approach. This includes reconsidering the current age threshold by introducing a tiered consent model for adolescents aged 13–17, aligning with global practices. A dedicated Children’s Data Protection Code should be developed to mandate privacy-by-design, discourage manipulative design elements, and enforce strict data minimisation. Strengthening enforcement through the timely operationalisation of the Data Protection Board, with a clear mandate for child data issues, is also essential. Additionally, digital literacy must be promoted through school curricula and targeted awareness programs for parents and children. Finally, tech platforms must take greater responsibility by designing ethical, child-centric services that incorporate strong default protections and transparent consent mechanisms. Together, these steps can help create a safer, more empowering digital ecosystem for India’s youngest users.
Conclusion
The digital age offers children unparalleled access to learning, creativity, and global connection. However, the same tools that empower them can also expose them to profound privacy harms if left unchecked. India’s legal framework, spearheaded by the Digital Data Protection Act 2023 & Draft DPDP Rules 2025, has laid the foundation for a protective environment, but much more remains to be done.
We at Data Secure (Data Privacy Automation Solution) DATA SECURE - Data Privacy Automation Solution can help you to understand EU GDPR and its ramificationsand design a solution to meet compliance and the regulatoryframework of EU GDPR and avoid potentially costly fines.
We can design and implement RoPA, DPIA and PIA assessments for meeting compliance and mitigating risks as per the requirement of legal and regulatory frameworks on privacy regulations across the globe especially conforming to GDPR, UK DPA 2018, CCPA, India Digital Personal Data Protection Act 2023. For more details, kindly visit DPO India – Your outsourced DPO Partner in 2025 (dpo-india.com).
For any demo/presentation of solutions on Data Privacy and Privacy Management as per EU GDPR, CCPA, CPRA or India DPDP Act 2023 and Secure Email transmission, kindly write to us at info@datasecure.ind.in or dpo@dpo-india.com.
For downloading the various Global Privacy Laws kindly visit the Resources page of DPO India - Your Outsourced DPO Partner in 2025
We serve as a comprehensive resource on the Digital Personal Data Protection Act, 2023 (Digital Personal Data Protection Act 2023 & Draft DPDP Rules 2025), India's landmark legislation on digital personal data protection. It provides access to the full text of the Act, the Draft DPDP Rules 2025, and detailed breakdowns of each chapter, covering topics such as data fiduciary obligations, rights of data principals, and the establishment of the Data Protection Board of India. For more details, kindly visit DPDP Act 2023 – Digital Personal Data Protection Act 2023 & Draft DPDP Rules 2025
We provide in-depth solutions and content on AI Risk Assessment and compliance, privacy regulations, and emerging industry trends. Our goal is to establish a credible platform that keeps businesses and professionals informed while also paving the way for future services in AI and privacy assessments. To Know More, Kindly Visit – AI Nexus Your Trusted Partner in AI Risk Assessment and Privacy Compliance | AI-Nexus