Consent and lawful basis
Do I need parental consent for users under 18?
- Short answer
- Yes. Under DPDP a child is anyone below eighteen, and processing a child's personal data requires verifiable consent from a parent or lawful guardian. Tracking, behavioural monitoring and targeted advertising directed at children are prohibited outright.
The eighteen year threshold is higher than the thirteen to sixteen range used in several other regimes, which is why imported templates commonly get this wrong and under protect Indian users.
Verifiable is doing real work in that sentence. You must take reasonable steps to be satisfied that the person consenting is an identifiable adult, not merely tick a box saying a parent agreed.
The prohibition on tracking and targeted advertising is not curable by consent. A limited set of exemptions exists by notification for specified purposes and classes, for example certain health or educational activities, and those are narrow.
Where this comes from
- Section 9, DPDP Act 2023
- Rule 10 and Rule 12, DPDP Rules 2025
The mistake people make
Applying a thirteen year age gate copied from an American service to an Indian user base.