Digital Personal Data Protection Act — Children's Provisions
Digital Personal Data Protection Act — Children's Provisions in India: pending, effective Phased: Nov 13, 2025 (board established); May 13, 2027 (full provisions). Applies to All data fiduciaries (businesses) processing digital personal data of children in India. Age range: Under 18. Verifiable pare
Key facts
| Jurisdiction | India |
|---|---|
| Category | International |
| Status | pending |
| Effective date | Phased: Nov 13, 2025 (board established); May 13, 2027 (full provisions) |
| Age range | Under 18 |
| Applies to | All data fiduciaries (businesses) processing digital personal data of children in India |
Key requirements
- Verifiable parental consent mandatory before processing any personal data of a child under 18
- Prohibition on tracking, behavioural monitoring, or targeted advertising directed at children
- Data Protection Board of India established November 13, 2025
- Consent managers must register starting November 13, 2026
- All consent, privacy notice, and security requirements fully effective May 13, 2027
- Penalties up to ₹200 crore (~US$24M) for violations relating to children's data
Notes
DPDP Act 2023 with rules published November 13, 2025. India defines "child" as under 18, broader than COPPA's under 13. Phased implementation. One of the broadest age thresholds globally.
Frequently asked
What does Digital Personal Data Protection Act — Children's Provisions require?
Verifiable parental consent mandatory before processing any personal data of a child under 18 Prohibition on tracking, behavioural monitoring, or targeted advertising directed at children Data Protection Board of India established November 13, 2025 Consent managers must register starting November 13, 2026 All consent, privacy notice, and security requirements fully effective May 13, 2027 Penalties up to ₹200 crore (~US$24M) for violations relating to children's data
Who must comply with Digital Personal Data Protection Act — Children's Provisions in India?
All data fiduciaries (businesses) processing digital personal data of children in India
When does Digital Personal Data Protection Act — Children's Provisions take effect and what is its status?
Effective Phased: Nov 13, 2025 (board established); May 13, 2027 (full provisions). Current status: pending. DPDP Act 2023 with rules published November 13, 2025. India defines "child" as under 18, broader than COPPA's under 13. Phased implementation. One of the broadest age thresholds globally.
Related laws
| Law | Jurisdiction | Category | Status | Effective |
|---|---|---|---|---|
| Social Media Minimum Age Law | Australia | International | active | December 10, 2025 |
| Online Safety Act — Age Verification Requirements | United Kingdom | International | active | July 25, 2025 |
| Online Safety Act — Child Safety Regime | United Kingdom | International | active | July 25, 2025 |
| Under-16 Social Media Ban (Children's Wellbeing and Schools Act 2026 regulations) | United Kingdom | International | pending | Spring 2027 (expected) |
| Digital Services Act — Guidelines on Protecting Minors | European Union | International | active | July 14, 2025 |
| EU Digital Minimum Age & Mandatory Age Assurance Initiative | European Union | International | pending | TBD (Commission proposal expected; Digital Fairness Act 2026) |
| GDPR — Children's Consent Requirements | European Union | International | active | May 25, 2018 |
| Under-15 Social Media Ban (2026 Law) | France | International | blocked | N/A (struck down August 14, 2026) |
Put it into practice
- Generate the policy: EU AI Act policy generator (generatepolicy.com)
- Buy the policy pack: EU AI Act Compliance Policy (cyberpolicy.shop)
- Build it yourself: Pillar 06 Companion — The 2026 AI Risk Register (ciso.diy)