Even if a parent gives consent, a company generally cannot target advertisements at their child under India’s Digital Personal Data Protection (DPDP) Act.
Section 9 imposes separate obligations regarding children’s personal data.
These include:
- Obtaining verifiable parental consent.
- Preventing processing likely to harm a child’s well-being.
- Prohibiting tracking or behavioural monitoring of children.
- Prohibiting targeted advertising directed at children.
Consent doesn’t automatically override these restrictions.
The Act and Rules provide specific exemptions for certain Data Fiduciaries and purposes, but those exemptions have defined conditions.
The takeaway: Children’s privacy compliance requires more than an age-verification screen and a parental consent checkbox.
The organisation must also examine what its advertising, analytics and monitoring systems actually do.
This article is general information, not legal advice.