The Digital Personal Data Protection Act (DPDPA) 2023, along with the subsequent DPDPA Rule of 2025, marks a significant shift in how children’s data is handled by social media platforms and digital services in India. The key focus of this law is on verifiable parental consent, which ensures that parents or legal guardians must authenticate their relationship with their child before any data is processed. The principles of Parens patriae—where the state assumes a protective role over children—are foundational to this law, positioning it as a means of safeguarding minors from the various harms that can arise from digital exposure.
Key Points of DPDPA:
- Parental Control as Digital Gatekeepers: The law mandates that parents or guardians provide explicit, verifiable consent before a child’s data can be processed by any entity. This consent mechanism goes beyond simple checkboxes and demands an actual authentication of the relationship between the guardian and the child. This is crucial in an age where children’s exposure to digital spaces is rampant, and the risks of cyberbullying, exploitation, and privacy violations are rising.
- Global Context of Age Thresholds: The age of majority in India under DPDPA is set at 18 years, aligning with the national legal framework for civil and criminal laws. This is in contrast to other countries such as the U.S., where the Children’s Online Privacy Protection Act (COPPA) sets the age limit at 13, and the EU’s General Data Protection Regulation (GDPR) allows countries to set the age of consent anywhere between 13 and 16 years.
- Digital Predicament in India: According to the Annual Status of Education Report (ASER), a significant proportion of Indian children are using smartphones, not only for education but also for social media. This underscores the urgency of creating a legal framework to protect these vulnerable digital users. As India has over 100 million adolescents online, managing their digital health has become a priority. Excessive screen time is increasingly linked to negative mental health outcomes like sleep deprivation, anxiety, and reduced self-esteem.
- Exceptions and Balancing Act: The law introduces reasonable exceptions, allowing specific entities such as healthcare providers, educational institutions, and childcare centres to process children’s data without obtaining verifiable parental consent, but only for essential services. The Fourth Schedule further clarifies that processing activities like age verification and protecting children from harmful content are also exempt from the consent requirement. This strikes a balance between protecting minors and allowing necessary services to function effectively.
- Implementation Challenges: While the law’s goals are admirable, the practical challenges of verifying parental consent across India’s vast socio-economic landscape remain significant. Given the country’s diversity, issues like digital literacy, access to technology, and logistical difficulties in verifying parental relationships could pose serious roadblocks. Furthermore, ensuring awareness and compliance among data fiduciaries and organizations may prove challenging, especially without an effective educational outreach.
- The Path Forward: Moving forward, India faces the challenge of creating a framework that balances freedom of speech and expression with the protection of minors. While DPDPA aims to protect children from harmful content, it also needs to ensure that children’s digital growth and exploration are not unduly stifled. This delicate balance will shape the future of technology-driven environments for children in India.
In Conclusion:
The DPDPA 2023 is a bold step toward creating a safer digital space for children in India. The law aims to protect minors from the risks of the internet while ensuring their rights to growth and exploration are not hampered. However, this law’s success hinges on effective implementation, public awareness, and tackling the practical challenges in a diverse, developing nation like India. If executed well, it could serve as a model for other countries seeking to protect their young digital citizens while fostering an environment of healthy digital interaction.
Advocate Ankit Prasad
(Writer is a practicing lawyer at Hon’ble High Court of Delhi)
ankitprasad965@gmail.com
