Section 9 — DPDP Act, 2023
(1) A Data Fiduciary shall, before processing any personal data of a child, obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be. (2) A Data Fiduciary shall not undertake such processing of personal data of a child that is likely to cause any detrimental effect on the well-being of a child. (3) A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children. (4) The Central Government may, by rules, exempt any Data Fiduciary or class of Data Fiduciaries from the application of all or any of the provisions of sub-sections (1) to (3). (5) In the case of a person with disability, consent under sub-section (1) may be given by her lawful guardian.
Source: Digital Personal Data Protection Act, 2023. Official text available at truconsent.io/resources/dpdp-act.pdf.
Section 9 places three distinct obligations on any Data Fiduciary processing a child's data: verifiable parental consent (not a checkbox), no processing detrimental to child wellbeing, and an absolute prohibition on tracking, behavioural monitoring, and targeted advertising directed at children. 'Verifiable' is the operative word — a parent simply ticking a box on behalf of a child is not verifiable consent. Rule 10 operationalises the verification requirement. The prohibition on tracking and targeted advertising is absolute — there is no consent that unlocks it.
A school productivity app used by students under 18 must obtain verifiable parental consent before processing any student personal data. 'Verifiable' means the platform must confirm the consenting individual is actually the parent — typically through identity verification. A tick-box from the student themselves does not satisfy Section 9(1).
A gaming platform popular with teenagers cannot run targeted advertising to under-18 users under any circumstances — not with parental consent, not under a legitimate use. Section 9(3) is an absolute prohibition, not a default that consent can override. The platform must implement age verification robust enough to actually filter out under-18 users from targeted advertising systems.
Section 9(5) allows a lawful guardian to give consent on behalf of a person with a disability. But Rule 11 requires verifying that the guardian appointment is itself legally valid — not merely that the guardian is an identifiable adult. This is a stricter standard than Rule 10's parental verification.