Learn
Your child's data and AI apps: India's DPDP Act in plain words
When your child types a question into a study app, talks to a chatbot or uploads a photo of their homework, they hand over personal data: their name, their voice, what they find hard, sometimes their location. India now has a law about what companies may do with it: the Digital Personal Data Protection Act, 2023 (the DPDP Act), and the DPDP Rules, 2025 that explain how it works.
We read both in the official Gazette of India, and this guide quotes them directly. The links are at the end. This is a plain-language summary for parents, not legal advice.
The short version
- Every child is under 18. The Act defines a child as "an individual who has not completed the age of eighteen years". Not 13, not 16.
- A parent must agree first. A company must get "verifiable consent of the parent" before processing any personal data of a child.
- No tracking, no targeted ads. Companies must not do "tracking or behavioural monitoring of children or targeted advertising directed at children", and must not process a child's data in a way "likely to cause any detrimental effect on the well-being of a child".
- You act for your child. For a child, the "Data Principal" (the person whose data it is) includes the parents or lawful guardian. So the rights below are yours to use on your child's behalf.
- Serious penalties. Breaking the children's duties can bring a penalty of up to ₹200 crore.
- The detailed rules start in 2027. The parental-consent procedure (Rule 10) comes into force eighteen months after the Rules were published in the Gazette dated 13 November 2025, so in May 2027. Good companies will not wait.
Who the law applies to
The Act calls a company or organisation that decides why and how personal data is used a Data Fiduciary. An AI tutor app, a homework chatbot, an online coaching platform and a school's own app can all be Data Fiduciaries. The duties in this guide are theirs, not yours.
Parental consent: what "verifiable" means
Section 9(1) of the Act says the company must get the parent's consent "in such manner as may be prescribed". Rule 10 of the DPDP Rules prescribes it. The company must take "appropriate technical and organisational measures" so that verifiable consent of the parent is obtained before processing any personal data of a child, and must check that the person saying they are the parent is an adult, using either:
- reliable identity and age details the company already holds (for example, because the parent already has an account with it), or
- identity and age details the parent provides, or a "virtual token" linked to them, issued by an authorised entity. The Rules mention a Digital Locker service provider as one way to share these.
The Rules give worked examples. In each, the child says she is a child and names her parent, the company lets the parent identify themselves, and the company checks that the parent is an identifiable adult before creating the child's account.
What this means in practice: an app where a child can sign up alone by typing any age, with no step for a parent, does not meet this standard. Once Rule 10 is in force, it is not allowed.
No tracking, no ads aimed at children
Section 9(3) is short and strong: a company "shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children."
For AI study apps, that matters. An app that builds a profile of your child's behaviour to sell, or shows your child adverts chosen for them, is doing what the Act forbids. Section 9(2) adds a broader duty: no processing "likely to cause any detrimental effect on the well-being of a child".
The exceptions, so you are not surprised
The Act allows some exceptions to the consent and no-tracking duties, and the Rules list them in the Fourth Schedule. The ones parents meet most often:
| Who or what | What they may do without the usual parental consent and no-tracking duties |
|---|---|
| Hospitals, clinics, health professionals | Process a child's data as needed to protect the child's health |
| An educational institution | Tracking and behavioural monitoring for its educational activities, or for the safety of children enrolled with it |
| Crèches and child day-care centres | Tracking and behavioural monitoring for the safety of children in their care |
| School or crèche transport | Tracking children's location during travel to and from the institution, for their safety |
| Government functions, subsidies and benefits for a child | Processing only to the extent necessary |
| Creating an email-only account | Only to the extent needed for that account |
| Real-time location for a child's safety | Only for safety and protection |
Each exception has conditions: the processing is "restricted" to that purpose. A school may track attendance for its own teaching; that is not a licence for a private app to profile your child.
Your rights, and how to use them
Because you count as the Data Principal for your child, you can:
- Ask what data is held. Section 11 gives a right to a summary of the personal data being processed and what is being done with it.
- Correct or erase it. Section 12 gives a right to "correction, completion, updating and erasure" of personal data you consented to.
- Withdraw consent at any time, "with the ease of doing so being comparable to the ease with which such consent was given" (section 6). If signing up took one tap, leaving should not take ten emails.
- Complain to the company first. Section 13 gives a right to grievance redressal by the company. Under Rule 14 the company must publish its grievance process and respond within a period it states, of no more than ninety days. You must use this route before going to the Data Protection Board of India.
Five questions to ask any app before your child uses it
- How do you get a parent's consent, and how do you check I am an adult?
- What data do you collect from my child, and why? (Typing, voice, photos, location?)
- Do you show adverts, or use my child's data to profile them? The answer should be no.
- How long do you keep it, and how do I get it deleted?
- Who do I contact with a complaint, and how fast do you reply?
A company that answers these clearly, in writing, is taking your child's data seriously. If an app asks for location, contacts or photos it does not need, say no, or choose another app. For a broader check of an app's quality and safety, see our 15-minute test for AI study apps and the parent's checklist for AI tutors.
Simple habits that help today
- Use a parent's account, not the child's own, wherever an app allows it.
- Teach the rule: never type your full name, phone number, address, school or photo into a chatbot.
- Turn off location and microphone permissions unless the app truly needs them.
- Check the app's privacy page for the words "advertising", "third parties" and "retention".
Where CMDLearn fits
We are building CMDLearn, an AI tutor for Classes 1 to 10 in Hindi, Marathi and English, and we have designed it to meet these duties before they are enforced: an adult starts every session for younger children, the tutor hides phone numbers, email addresses, Aadhaar-style ID numbers and PIN codes before anything reaches the AI (it does not detect names, so children are told not to type them), there are no adverts and no profiling for sale, and the adult sees a summary. It is not available yet; join the waitlist to hear when early access to the AI tutor opens.
Sources (official texts)
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette of India, Extraordinary, Part II, Section 1, 11 August 2023 (definitions in section 2; consent in section 6; children in section 9; rights in sections 11 to 13; penalties in the Schedule): meity.gov.in: the Act as published by MeitY (PDF)
- The Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette of India, Extraordinary, Part II, Section 3, Sub-section (i), dated 13 November 2025 (commencement in rule 1; parental consent in rule 10; exemptions in rule 12 and the Fourth Schedule; rights in rule 14), published by MeitY: www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf
- Press Information Bureau, DPDP Rules, 2025 Notified (17 November 2025): static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf
Quotes are from the official texts above, read on 12 October 2026. This guide is general information for parents, not legal advice. For a specific situation, consult a lawyer.