DIGITAL GUARDIANS:
A Parent’s Legal Guide to Protecting Your Child’s
Digital Footprint under India’s DPDP Rules
By: Aafreen Kamil
Core Legal Domain: Digital Privacy Rights
Core Statutory Reference: Digital Personal Data Protection Act, 2023 & DPDP Rules, 2025
Part 1: Introduction
In today’s modern era, where a child’s digital footprint is created much before they are born through pregnancy announcements, after birth announcements, school photographs posted in online portals, and personal data harvested by education applications concerns about who controls the child’s digital identity becomes one of the most urgent question which needs answers. India, home to the world’s largest child population and one of its fastest-growing digital economies, has finally confronted this question through the enactment of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules).[1]
This article answers a central legal question: What rights do parents possess, under India’s new data protection framework, to protect their child’s digital footprint on social media and other online platforms? According to the DPDP Act, parental consent acts as the foundation for any processing of child’s personal data. It imposes a strict prohibition on tracking, profiling and targeted advertising emphasizing on minors, and prescribes penalties of up to ₹200 crore per violation.[2]
This article explains the statutory framework under the DPDP Rules and Act alongside the constitutional foundation laid by the Supreme Court in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)[3], and makes a comparative analysis of India’s approach with global frameworks including the European Union’s General Data Protection Regulation (GDPR)[4] and the United State’s Children’s Online Privacy Protection Act (COPPA)[5]. It concludes with a critical evaluation of enforcement gaps and proposes meaningful reforms to transform legislative intent into lived reality for India’s children.
Part II: Background and Legal Framework
The foundation for child data protection was laid by the Supreme Court in the landmark nine-judge bench case of Justice K.S. Puttaswamy (Retd.) v. Union of India. The decision held unanimously that the Right to privacy is a fundamental right protected under Articles 14, 19, and 21 of the Constitution of India. [6] The court held that right to privacy includes the right of individuals to control information about themselves – and expressly recognised that this right applies with particular force to vulnerable groups, including children[7].
Prior to the DPDP Act, India’s data protection landscape was fragmented. The Information Technology Act, 2000 (IT Act)[8] and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules)[9] provide limited and technically-oriented protections. Neither instrument contained specific provisions for the protection of children’s data or imposed parental consent requirements upon social media platforms.
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) marks India’s first comprehensive data protection legislation[10]. This Act was passed by both Houses of the Parliament in 2023 and notified along with DPDP rules on 13 November 2025[11]. It introduces a rights-based framework build around the concept of ‘Data Principals’ (individuals to whom data relates) and ‘Data Fiduciaries’ (entities that determine the purpose and means of processing). This act creates an additional protective layer for children, under section 9 which governs the processing of personal data of minors.
Under section 2(k) of the DPDP act, child is defined as any individual who has not completed eighteen years of age[12]. This definition is significantly broader than the thresholds adopted by comparable jurisdictions like COPPA and GDPR. COPPA in the United States sets the threshold at thirteen years, while the GDPR in the European Union permits Member States to set the age of digital consent between thirteen and sixteen years. India’s eighteen-year threshold, aligned with the Juvenile Justice (Care and Protection of Children) Act, 2015[13], places every teenager and adolescent squarely within the protective ambit of the Act.
Under Section 9(1) of the DPDP Act before processing any personal data of a child, a Data Fiduciary must obtain verifiable consent from the parent or lawful guardian.[14] Rule 10 of the DPDP Rules, prescribes mechanisms through which verifiable parental consent must be obtained, including identity verification through government-backed systems such as DigiLocker and Aadhaar-based authentication, as well as virtual tokens for secure consent documentation. [15]
Any processing of a child’s data that is likely to cause detrimental effect on the well-being of the child is prohibited under Section 9(3) of the Act. [16] The Act specifies three absolute prohibitions that apply even where parental consent has been obtained: (i) tracking or behavioural monitoring of children; (ii) targeted advertising directed at children; and (iii) profiling of children. These prohibitions reflect a ‘protection-first’ model that goes beyond consent-based frameworks.
The Information Technology Act, 2000 and the SPDI Rules, 2011 continue to operate as supplementary instruments until the full operational provisions of the DPDP Act take effect in May 2027, pursuant to the phased implementation schedule notified by the Ministry of Electronics and Information Technology (MeitY)[17].
Part III: Main Analysis — Parental Rights, Platform Obligations, and the Digital Footprint
- What Constitutes a Child’s ‘Digital Footprint’ Under the DPDP Framework?
Digital footprint of a child consists every piece of personal data generated, shared, or collected during her interaction with online platforms. . Section 2(t) of the DPDP Act, defines ‘personal data’ as any data about an individual who is identifiable by or in relation to such data[18]. For a child’s social media presence, this includes her name, photograph, date of birth, location data, device identifiers, browsing behaviour, content interactions, biometric data (such as facial recognition data embedded in photographs), and even the metadata attached to uploaded images.
This definition is significantly broader in nature. . A parent who posts a child’s photograph on Instagram generates personal data that falls within the Act’s protective ambit. A school that uploads a class photograph to an online parent portal processes children’s personal data subject to Section 9 obligations. An EdTech application that collects a child’s learning patterns and behavioural data engages in profiling — an activity expressly prohibited under Section 9(3) even with parental consent[19].
2. The Parental Consent Mechanism — How It Works in Practice
Section 9(1) and Rule 10 of the DPDP Rules explains the verifiable parental consent requirement which operates as a mandatory pre-condition for any social media platform to process a child’s data[20]. The process of verification require the Data Fiduciary to : : (i) verify that the consenting individual is an adult; (ii) verify the legal relationship between the consenting adult and the child; and (iii) document the consent in a manner that satisfies the ‘verifiable’ standard prescribed under the Rules.
Rule 10 explains about permissible verification methods which includes identity verification through DigiLocker, Aadhaar-based OTP authentication, and virtual consent tokens[21]. The Rules also permit Data Fiduciaries to rely on identity and age data already held by them, provided the data is sufficient to establish that the consenting individual is an adult and the child’s parent or guardian. This framework has significant implications on social-media platform like Instagram, YouTube, and WhatsApp — platforms that are extensively used by Indian minors. .
These platforms qualify as Data Fiduciaries under the Act, and hence are legally obligated to implement age-gating mechanisms and parental consent workflows before processing any data of users under eighteen years of age. Failure to do so constitutes a violation of Section 9, attracting penalties of up to ₹200 crore under Schedule of the DPDP Act[22].
3. What Can a Parent Do? — The Practical Rights Framework
DPDP Act, provides several enforceable rights to parents, in respect of their child’s digital footprint:
Right to Withdraw Consent: Section 6 of the DPDP Act, allows the parents to withdraw their consent from processing their child’s data at any given time[23]. In case of withdrawal, the Data Fiduciary is required to cease processing the child’s data and, upon request, erase it within the timelines prescribed under the Act.
Right to Erasure: Section 12(3) of the DPDP Act grants Data Principals the right to erasure of personal data that is no longer necessary for the purpose for which consent was given[24]. To remove digital footprint of a child, this right provides legal mechanism to parents. Through this they can compel the platforms to delete such data. (Removing old photographs, account data, or behavioural records).
Right to Grievance Redressal: Section 13 of the DPDP Act¹⁵ requires every Data Fiduciary to establish a grievance redressal mechanism[25]. If a platform fails to respond adequately to a parental complaint about misuse of a child’s data, the parent may take the matter to the Data Protection Board of India under Section 27 of the Act, which possesses the authority to conduct inquiries, impose penalties, and direct remedial action.
Right to Nominate: Under Section 14 of the DPDP Act a Data Principal can nominate another individual to exercise data rights on their behalf in the event of death or incapacity[26]. This ensures continuity of data protection rights across life events.
4. The Triple Prohibition — Tracking, Profiling, and Targeted Advertising
Section 9(3) of the DPDP Act establishes three absolute prohibitions applicable to the processing of children’s data[27]. These prohibitions are unconditional — they apply even where the parent has granted consent — and represent the Act’s most child-protective provisions.
First, tracking and behavioural monitoring of children is categorically prohibited. Social media platforms that use tools to track a child’s online behaviour, for example: – likes, engagements, check ins etc., are strictly prohibited. Second, targeted advertising directed at children is prohibited.
Second, targeted advertising directed at children is prohibited. Second, targeted advertising directed at children is prohibited. Platforms may not use a child’s personal data to serve personalised advertisements.
Third, profiling of children — the automated processing of personal data to evaluate, predict, or analyse a child’s behaviour, preferences, or characteristics — is expressly forbidden.
Violations attract penalties of up to ₹200 crore per instance under Schedule I of the Act. [28]
Part IV: Critical Analysis and Evaluation
Despite the progressive structure of DPDP Act, there are still some critical gaps, which threaten threaten to undermine the effective protection of children’s digital rights in practice.
The verification gap is the structural weakness of this framework. The DPDP Act and Rules place the burden of age verification upon Data Fiduciaries but provide no mandatory technical standard for how age is to be verified[29]. Current industry practice has evolved. It relies primarily on self-declaration — users simply state that they are adults, or that they are parents. This is easily circumvented: children can lie about their age, access a parent’s account, or create accounts using fictional details. Without a mandatory, government-backed age verification standard, the parental consent requirement risks becoming a checkbox exercise rather than a genuine protective mechanism.
The ‘verifiable consent’ standard, while conceptually robust, imposes significant practical burdens on both platforms and parents. Aadhaar-based verification, while theoretically available, raises its own privacy concerns — linking a child’s social media presence to a parent’s Aadhaar number creates a permanent, government-traceable digital record that itself raises data minimisation concerns under the Act’s own principles[30]. The tension between child safety and privacy-by-design has not been adequately resolved by the current framework.
Data Protection Board of India — the body responsible for adjudicating complaints and imposing penalties under the DPDP Act — remains in an early stage of operationalization[31]. The Board has not yet developed a robust child-specific complaints mechanism. A parent seeking redress for a platform’s misuse of their child’s data faces the prospect of navigating a nascent institutional framework with limited precedent and uncertain timelines.
DPDP Act’s prohibitions on tracking and profiling, while absolute in their statutory terms, do not address the phenomenon of ‘sharenting’ — the practice of parents themselves voluntarily sharing their children’s personal data on social media. . The Act places all protective obligations upon Data Fiduciaries but does not regulate what parents share about their children. A child whose parent routinely posts photographs, location tags, and personal details on public social media platforms has no statutory mechanism to protect their own data from parental disclosure. This lacuna represents a significant oversight in the framework’s child-centric design.
Digital literacy among Indian parents remains deeply inadequate. Research consistently indicates that the majority of Indian parents are unaware of what constitutes ‘personal data’, what ‘consent’ means in a data protection context, or what rights they possess under the DPDP Act[32]. The Act contains no provision mandating digital literacy programs or awareness campaigns — a significant omission that the government must address through subordinate legislation or policy initiatives[33].
Part V: Conclusion
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 represent a landmark moment in India’s legal relationship with the digital world[34]. For parents, this framework provides a meaningful and constitutionally grounded set of rights — the right to grant and withdraw consent, the right to erasure, the right to grievance redressal, and the right to invoke the Data Protection Board against non-compliant platforms[35]. The absolute prohibitions under this act, reflect a genuine commitment to placing child welfare above commercial interests[36].
The effectiveness of the parental consent framework depends upon robust age verification standards that do not yet exist, an institutional adjudicatory body that is still maturing, and a digitally literate parent population that has yet to be cultivated. The challenge ahead is not legislative — it is infrastructural, institutional, and educational.
Some of the most urgent reforms include: the introduction of a mandatory technical standard for age verification, developed by MeitY in consultation with the Data Protection Board and civil society. The establishment of a dedicated child data protection division within the Board with expedited complaint resolution timelines is also important. The provisions of ‘sharenting’ and parental oversharing must be properly defined and the digital literacy programs must be conducted in school curricular under the National Education Policy framework. India’s children deserve not merely the protection of the law but the effective operation of that protection in their daily digital lives.
The digital world is not the future — it is the present reality of every Indian child. The law must keep pace with that reality. The DPDP Act has taken the first step. The harder work of ensuring that every parent knows their rights, every platform honours its obligations, and every child’s digital footprint is genuinely theirs to control — that work has only just begun.
References and Citations
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), Ministry of Electronics and Information Technology, available at: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf
- Justice K.S. Puttaswamy (Retd.) v. Union of India, Writ Petition (Civil) No. 494 of 2012, (2017) 10 SCC 1, available at: https://www.casemine.com/judgement/in/599ec2f64a932638c63eef1e .
- Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), Article 8, available at: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng .
- Children’s Online Privacy Protection Act, 1998 (COPPA), 15 U.S.C. §§ 6501–6506, available at: https://www.ftc.gov/legal-library/browse/statutes/childrens-online-privacy-protection-act .
- Constitution of India, Articles 14, 19 and 21, available at: https://www.legislative.gov.in/constitution-of-india .
- Digital Personal Data Protection Rules, 2025, Ministry of Electronics and Information Technology, Gazette Notification dated 13 November 2025, available at: https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf .
- Juvenile Justice (Care and Protection of Children) Act, 2015 (Act No. 2 of 2016), available at: https://www.indiacode.nic.in/bitstream/123456789/2148/1/a2016-2.pdf .
- Information Technology Act, 2000 (Act No. 21 of 2000), available at: https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf .
- Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, available at: https://www.dataguidance.com/sites/default/files/in098en.pdf .
- PwC India, ‘Only 16% consumers in India understand the Digital Personal Data Protection Act’ (2024), available at: https://www.pwc.in/assets/pdfs/aware-prepared-indian-consumers-businesses-navigate-new-era-digital-privacy.pdf .
- DPO India, ‘Protecting Children’s Data in the Digital Age: India’s Legal Framework and Policy Imperatives’ (2025), available at: https://www.dpo-india.com/Blogs/protecting-child-data .
- White Black Legal, ‘Children Data and Parental Consent vis-a-vis Digital Personal Data Protection Act, 2023’ (2024), available at: https://www.whiteblacklegal.co.in/details/children-data-and-parental-consent-vis-a-vis-digital-personal-data-protection-act-2023-by—dr-harpreet-kaur-asmi-sharma
- TechPolicy Press, ‘Parental Consent is a Conundrum for Online Child Safety’ (2025), available at: https://www.techpolicy.press/parental-consent-is-a-conundrum-for-online-child-safety/ .
- Niti Tantra, ‘Protecting Children’s Privacy in the Digital Age: Indian Regulations and Challenges’ (2024), available at: https://nititantra.com/wp-content/uploads/2024/08/Protecting-Childrens-Privacy-in-the-Digital-Age_-Indian-Regulations-and-Challenges.pdf .
- UNICEF India, ‘Online Safety in Education: Guidance Note 2026’, available at: https://www.unicef.org/india/media/18011/file/Children%E2%80%99s%20Online%20Safety%20in%20Education.pdf .
Frequently Asked Questions
. Q1. What is a child’s digital footprint?
A child’s digital footprint refers to all personal data generated through her online activity — including photographs, location data, browsing behaviour, device identifiers, and account information collected by social media platforms and applications.
Q2. What age does the DPDP Act consider a child?
Under Section 2(f) of the DPDP Act, 2023, any individual below 18 years of age is considered a child. This is broader than COPPA (13 years) and GDPR (13–16 years).
Q3. Can a social media platform process my child’s data without my consent?
No. Section 9(1) of the DPDP Act mandates that no Data Fiduciary can process a child’s personal data without obtaining verifiable parental consent beforehand.
Q4. Can I withdraw my consent after giving it?
Yes. Section 6 of the DPDP Act grants parents the right to withdraw consent at any time. Upon withdrawal the platform must stop processing the child’s data immediately.
Q5. Can I ask a platform to delete my child’s data?
Yes. Section 12(3) of the DPDP Act grants the right to erasure. A parent can compel any platform to permanently delete her child’s personal data once the purpose for which consent was given no longer exists.
Q6. Can platforms show targeted advertisements to my child?
No. Section 9(3) of the DPDP Act absolutely prohibits targeted advertising directed at children — even where parental consent has been obtained.
Q7. Can platforms track or profile my child online?
No. Section 9(3) imposes absolute prohibitions on both tracking and profiling of children regardless of consent.
Q8. What happens if a platform violates these rules?
Violations of Section 9 attract penalties of up to ₹200 crore under the Schedule of the DPDP Act.
Q9. Where do I complain if a platform misuses my child’s data?
First escalate to the platform’s grievance officer under Section 13. If unresolved, file a complaint with the Data Protection Board of India under Section 27 of the DPDP Act.
Q10. What is ‘sharenting’ and is it regulated under the DPDP Act?
Sharenting refers to parents voluntarily sharing their children’s personal data on social media. Currently the DPDP Act does not regulate sharenting — this is identified as a significant gap in the framework.
[1] Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), available at: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf .
[2] DPDP Act, 2023, Schedule 1 (Penalties) and s.9 (3).
[3] Justice K.S. Puttaswamy (Retd.) v. Union of India, Writ Petition (Civil) No. 494 of 2012, (2017) 10 SCC 1, decided on 24 August 2017, available at: https://www.casemine.com/judgement/in/599ec2f64a932638c63eef1e.
[4] Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation), Article 8- Conditions applicable to child’s consent in relation to information society services, available at: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng .
[5] Children’s Online Privacy Protection Act, 1998 (COPPA), 15 U.S.C. §§ 6501–6506, available at: https://www.ftc.gov/legal-library/browse/statutes/childrens-online-privacy-protection-act .
[6] Justice K.S. Puttaswamy (Retd.) v. Union of India, (supra note 3).
[7] Constitution of India, Articles 14, 19 and 21 available at: https://www.legislative.gov.in/constitution-of-india.
[8] Information Technology Act, 2000 (Act No. 21 of 2000), available at: https://www.indiacode.nic.in/bitstream/123456789/13116/1/it/act 2000 updated.pdf.
[9] Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, G.S.R.313 (E) dated 11 April 2011, available at: https://www.dataguidance.com/sites/default/files/in098en.pdf .
[10] DPDP Act, 2023, supra note 1.
[11] Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025, Gazette Notification dated 13 November 2025, available at: https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf
[12] DPDP Act, 2023, s. 2(f), supra note 1.
[13] Juvenile Justice (Care and Protection of Children) Act, 2015 (Act No. 2 of 2016), available at: https://indiakanoon.org/doc/9677640/ .
[14] DPDP Act, 2023, s9 (1), supra note 1.
[15] Digital Personal Data Protection Rues, 2025, Rule 10, available at: https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301 .
[16] DPDP Act, 2023, s.9 (3), supra note 1.
[17] MeitY, Phased Implementation Notification, supra note 11.
[18] DPDP Act, 2023, s.2 (t), supra note 1.
[19] DPDP Act, 2023, s.9 (3), supra note 1.
[20] DPDP Act, 2023, s.9 (1), supra note 1; DPDP Rules, 2025, Rule 10, supra note 16.
[21] DPDP Rules, 2025, Rule 10, supra note 15.
[22] DPDP Act, 2023, Schedule (Penalties), supra note 1.
[23] DPDP Act, 2023, s.6, supra note 1.
[24] DPDP Act, 2023, s.12 (3), supra note 1.
[25] DPDP Act, 2023, s.13, supra note 1.
[26] DPDP Act, 2023, s. 14, supra note 1.
[27] DPDP Act, 2023, s.9 (3), supra note 1.
[28] DPDP Act, 2023, Schedule (Penalties), supra note 22.
[29] DPDP Act, 2023, s. 9(1), supra note 1.
[30] DPDP Rules, 2025, Rule 10, supra note 15.
[31] DPDP Act, 2023, s. 18 (Constitution of Data Protection Board of India), supra note 1.
[32] PwC India, ‘only 16% consumers in India understand the Digital Personal Data Protection Act (2024), available at: https://www.pwc.in/assets/pdfs/aware-prepared-india-onsumers-business-navigate-new-era-digital-privacy.pdf .
[33] DPDP Act, 2023, supra note 1 (no provision for mandatory digital literacy programs exists within the Act).
[34] DPDP Act, 2023, supra note 1; DPDP Rules, 2025, supra note 15.
[35] DPDP Act, 2023, ss. 6, 12(3), 13 and 27, supra note 1.
[36] DPDP Act, 2023, s. 9(3), supra note 1.
