Introduction
The EdTech and online gaming sectors have experienced explosive growth in India over the past decade. A significant portion of this user base consists of minors. However, the regulatory landscape governing how these platforms interact with young users has fundamentally shifted with the enactment of the Digital Personal Data Protection (DPDP) Act, 2023.
Unlike global standards such as the GDPR—which sets the age of digital consent flexibly between 13 and 16—the DPDP Act takes a strict, uncompromising stance: anyone under the age of 18 is legally considered a child. For platforms catering to this demographic, the compliance hurdles are among the highest in the Act, carrying severe penalties for non-compliance.
This article explores the stringent obligations placed on EdTech companies, schools, and digital platforms regarding children's data under the DPDP Act.
The Core Mandate: Verifiable Parental Consent
Section 9 of the DPDP Act clearly states that before processing any personal data of a child, a Data Fiduciary must obtain "verifiable consent" from the parent or lawful guardian of such child.
The Challenge of "Verifiable"
The keyword here is verifiable. A simple checkbox asking "Are you over 18?" or "I confirm I have parental permission" is no longer legally defensible. Platforms must implement robust mechanisms to ensure that the person granting consent is, in fact, an adult and holds legal guardianship over the child.
While the exact technical standards for verification will be defined in subsequent rules, EdTech companies must prepare for integrations involving:
- Digital ID verification (e.g., matching a parent's government ID with the child's school records).
- Credit card or micro-transaction verification (a common global standard to prove adulthood).
- OTP verification linked to a parent's registered mobile number.
The Twin Prohibitions: Tracking and Harm
Obtaining parental consent is only the first hurdle. The DPDP Act places two outright bans on how children's data can be used, regardless of whether consent was granted.
1. The Ban on Tracking and Targeted Advertising
The Act strictly prohibits Data Fiduciaries from undertaking tracking, behavioral monitoring, or targeted advertising directed at children. For many free EdTech or gaming apps that rely on advertising revenue based on behavioral profiles, this destroys their core business model in India. Platforms must pivot to contextual advertising (ads based on the content being viewed, not the user's history) or subscription-based models for users under 18.
2. The Ban on Causing "Likely Harm"
Data Fiduciaries must not undertake any processing of personal data that is likely to cause any detrimental effect on the well-being of a child. This is a broad, subjective clause that regulatory bodies could use to penalize platforms for algorithmic feeds that promote addictive behavior, cyberbullying, or inappropriate content.
Exemptions and the Road Ahead
The Government recognizes that the strict 18-year threshold could paralyze certain beneficial services (like counseling helplines or older teenagers using educational platforms independently). Therefore, the Act allows the Central Government to exempt certain entities from these strict conditions if they can prove their processing is "verifiably safe." However, EdTech platforms cannot operate on the assumption they will receive an exemption. They must build compliance architectures immediately.
Operational Steps for EdTech Platforms
- Age Gating: Implement immediate, robust age-gating mechanisms at the point of onboarding. Segment users into Under-18 and Over-18 streams.
- Redesign Onboarding: For Under-18 users, redirect the onboarding flow to require a parent's email or phone number to initiate the verifiable consent process.
- Audit Data Monetization: Immediately audit and disable any third-party SDKs (Software Development Kits) or ad networks that track users or serve targeted ads to the Under-18 segment.
- Privacy by Default: Ensure that the default settings for child accounts are set to maximum privacy (e.g., private profiles, disabled location tracking).
Conclusion
For EdTech and digital platforms in India, the era of frictionless onboarding for minors is over. The DPDP Act prioritizes the safety and privacy of children over digital convenience and targeted monetization. Platforms that adapt quickly by building secure, parent-friendly consent mechanisms will not only avoid the ₹200 Crore penalties but will also win the trust of the parents who ultimately control the purse strings.
