DPDPA Section 9: Children's data

For anyone under 18, you must obtain verifiable consent from a parent or lawful guardian before processing. A child simply self-asserting an adult age with no check does not meet the verifiable standard.

Design an age-gate at the point of collection and a parental-consent flow that records who consented and how, so the consent is verifiable later. ConsentX includes an age-gate and parental flow built for this requirement.

Section 9 prohibits processing likely to cause a detrimental effect on the well-being of a child, and specifically bans tracking, behavioral monitoring and targeted advertising directed at children.

That means your analytics and advertising trackers must stay blocked for any user identified as a child, not merely de-personalised. Pre-consent blocking plus a child flag that keeps trackers inert is the safe pattern.

The Act allows the Government to exempt certain classes of fiduciaries or processing (for example, where processing is verifiably safe) and to lower the age threshold for specified purposes. Until such exemptions apply to you, treat the under-18 rule and the advertising ban as binding.