Scroll, swipe, shield: India's evolving approach to children's data in a comparative perspective

Child safety once meant making sure children looked both ways before crossing the road or that they didn't talk to strangers. But in today's digital world children have moved from the playground to online platforms, scrolling and swiping through digital spaces long before they can even read or understand the risks and responsibilities that come with being online. 

In India, where more than 700 million people age 2 and above are active internet users, as of December 2022, the question of how to protect children online has become an urgent one. 

India's Digital Personal Data Protection Act, 2023, has been a meaningful step toward a legal framework that recognizes children's digital vulnerabilities. While it primarily addresses children's privacy through Section 9, related provisions across the DPDPA and associated rules reinforce this focus, introducing an anticipatory design aware regulation. 

Enforcement is a critical part of any regulatory framework and India's DPDPA established the Data Protection Board of India to oversee and address grievances. Once seated, the board will have the power to investigate violations, issue directions and impose financial penalties. 

Defining and protecting children

Section 9 of the DPDPA prohibits behavioral tracking and targeted advertising for children. It also requires age verification and adds a layer of protection in the form of verifiable parental consent for processing children's personal data. Further, since verifiable parental consent is required, organizations cannot in effect rely on the deemed consent grounds under Section 7 when the data principal is a minor.

The DPDPA defines a child as anyone under age 18. India's age threshold stands higher than the EU General Data Protection Regulation's flexible 13 to 16 range and the U.S. Children's Online Privacy Protection Act's focus on children under 13.