Rule 10 — DPDP Rules, 2025
(1) Before processing the personal data of a child, a Data Fiduciary shall obtain verifiable consent of the parent or lawful guardian of the child. (2) For the purposes of sub-rule (1), verifiable consent means consent obtained after due verification of the identity of the parent or lawful guardian by the Data Fiduciary.
Source: Digital Personal Data Protection Rules, 2025. Official text available at truconsent.io/resources/dpdp-rules.pdf.
Rule 10 operationalises Section 9(1)'s verifiable parental consent requirement. The key word is 'verified' — verifiable consent is not a tick-box by the parent. The Data Fiduciary must actually verify that the consenting individual is the parent or lawful guardian of the child in question. Rule 10(2) makes this explicit: 'due verification of the identity of the parent or lawful guardian'. What verification method is sufficient is not prescribed — this gives Data Fiduciaries flexibility, but also responsibility. A flip-side ticket-the-box confirmation does not pass.
Before Rule 10 can be applied, the Data Fiduciary must know the user is under 18. This requires age verification at onboarding. Common approaches: date of birth declaration (low assurance), credit card verification (parent's card on file), government ID cross-check. The adequacy of the age verification method is a question the Board will eventually test.
Minimum approach: parent provides their name, email, and phone, clicks a confirmation link sent to that email. More robust: parent provides Aadhaar-linked mobile number and completes an OTP verification. The 'due' standard suggests the verification must be proportionate to the sensitivity of the child's data being processed — a gaming platform collecting a child's username has lower verification requirements than an edtech platform collecting detailed learning and behavioural data.
Even with valid verifiable parental consent under Rule 10, a Data Fiduciary cannot track, behaviourally monitor, or direct targeted advertising at a child. Section 9(3)'s prohibition on these activities is absolute — parental consent does not override it.