The Digital Personal Data Protection Act, 2023 (DPDP Act) mandates that ed-tech platforms must obtain 'verifiable parental consent' for processing personal data of children under 18, going beyond mere consent. The Act imposes strict obligations on Data Fiduciaries to ensure children's data is not processed in a manner detrimental to their well-being, as highlighted by LiveLaw's analysis.
Ratio Decidendi · Legal Principle Established
Under the Digital Personal Data Protection Act, 2023, 'consent' for processing personal data of a child (under 18 years) must be 'verifiable parental consent'. Data Fiduciaries are prohibited from undertaking tracking, behavioural monitoring, targeted advertising, or any processing detrimental to a child's well-being.
Advocates advising ed-tech companies must ensure robust mechanisms for verifiable parental consent are in place, not just standard consent forms. Litigants and parents can challenge data processing practices that lack verifiable consent or are detrimental to children. Companies must review data processing policies to comply with the heightened protection for child data.
Key Legal Takeaways
1Verifiable parental consent is mandatory for processing child data under the DPDP Act.
2Ed-tech platforms face strict prohibitions on tracking, behavioural monitoring, and targeted advertising for children.
3Data Fiduciaries must ensure data processing does not harm a child's well-being.
4The age of 'child' is uniformly 18 years under the DPDP Act for data protection purposes.
The Legal Issue
LiveLaw's analysis highlights the stringent requirements of the Digital Personal Data Protection Act, 2023 (DPDP Act) concerning the processing of personal data belonging to children, particularly within the ed-tech sector. The core legal issue revolves around the interpretation and implementation of Section 9 of the DPDP Act, which specifically addresses the processing of children's personal data. The Act moves beyond a simple 'consent' requirement, mandating 'verifiable parental consent' for any data fiduciary processing the personal data of a child, defined as an individual under 18 years of age.
Court's Reasoning
While this is an analysis of the Act and not a court's reasoning, the legislative intent behind Section 9 of the DPDP Act is clear: to provide enhanced protection for children's personal data. The Act places a significant burden on Data Fiduciaries to not only obtain consent but to verify that such consent comes from a parent or lawful guardian. Furthermore, it explicitly prohibits certain activities deemed harmful to children, including tracking, behavioural monitoring, targeted advertising, and any other processing of personal data that is likely to cause detriment to a child's well-being. This reflects a proactive approach to safeguard minors in the digital space.
Why It Matters
This development is highly significant for ed-tech platforms and any other online service providers that interact with users under 18. It necessitates a complete overhaul of existing data collection and processing practices to ensure compliance with the 'verifiable parental consent' standard. The prohibitions on tracking and targeted advertising for children will fundamentally alter business models reliant on such practices. Failure to comply could lead to substantial penalties under the DPDP Act. For parents and child rights advocates, this provides a robust legal framework to protect children's privacy and digital well-being, empowering them to hold Data Fiduciaries accountable for non-compliance. This marks a critical shift towards a more secure digital environment for children in India.