Children and persons with disability

Under 18 is a child under the Act

Anyone under 18 is a child. If teenagers use your app, game or platform, these rules apply to you.

s.9(5) lets the Government notify an age above which a fiduciary that processes children's data in a verifiably safe way may be exempted from some duties. Unless and until such a notification applies to you, treat 18 as the line.

Three rules for children's data

Three rules apply. Breaking any of them can cost up to ₹200 crore.

The ban on tracking, behavioural monitoring and targeted advertising directed at children applies even if a parent consents. Review ad tech, analytics SDKs and recommendation engines for child users.

How to verify the parent

Rule 10 asks you to take due care that the person giving consent is an identifiable adult who is the child's parent or guardian.

Rule 10 accepts reliable details already available with you (for example, a parent who is already a verified user), identity and age details provided voluntarily, or a virtual token mapped to such details issued by an authorised entity, such as Digital Locker. The Rules include illustrations for each case.

Some exemptions, within limits

Some organisations and purposes get relief from the parental consent and tracking rules, but only for the specific purposes listed.

Each exemption is tied to a purpose: a hospital, for providing health services; a school, for education and safety of its students. Whether ed-tech companies qualify as 'educational institutions' is unclear, so take legal advice before relying on it.

Persons with disability

For a person with a disability who has a lawful guardian, the guardian gives consent. Rule 11 asks you to verify that guardianship.

The relevant laws include the Rights of Persons with Disabilities Act, 2016 and the National Trust Act, 1999. Keep a record of the document you relied on.

In one line

Next: the rights people can use against your business.