Verifiable Parental Consent

Section 9 of India's DPDP Act requires a Data Fiduciary to obtain verifiable consent from a parent or lawful guardian before processing the personal data of a child (defined as a person who has not completed 18 years of age) or — as reworded by the DPDP (Removal of Difficulties) Order 2026, S.O. 5458(E) of 5 October 2026 — of a person with disability. The same section prohibits behavioural tracking of children, targeted advertising directed at children, and processing likely to cause detrimental effect on a child's wellbeing.

Rule 10 of the DPDP Rules 2025 (in force from 13 May 2027) defines verifiable parental consent as consent given by a parent or lawful guardian using a method that provides reasonable confidence in the identity of the adult and in the parent-child or guardian-ward relationship. The Rule lists illustrative methods: government-ID verification coupled with a sworn declaration, financial-instrument verification such as a credit-card micropayment, video-call verification, or verification through a government-issued digital-identity service. The methods are illustrative rather than mandatory, which gives Fiduciaries flexibility but also leaves open the regulator's view of what counts as 'reasonable confidence' until Board decisions develop.