Children's data: what Section 9 asks of you

If anyone under eighteen can use your service, the DPDP Act adds three duties, and one of them cannot be satisfied by collecting consent. Answer four questions to see which apply to you, and what each one is based on.

Free, no signup. Nothing you answer leaves your browser.

WHAT THIS COVERS

9(1)
Verifiable parental consent
9(2)
A child's well-being
9(3)
Tracking and targeted ads
R10
Verifying the parent
R12
Fourth Schedule exemptions

Question 1 of 4

Can anyone under eighteen use your service?

A child under the Act is anyone who has not completed eighteen years: not thirteen, not sixteen (Section 2(f)). A CBSE or state-board school knows the answer from its admission records; a gaming or content app usually has never checked.

Are you one of these kinds of organisation?

The Fourth Schedule to the DPDP Rules 2025 disapplies parts of Section 9 for these classes, for specific activities only. It covers the institution's own conditioned activity — not an EdTech vendor selling into it.

Does your product run behavioural advertising or profiling analytics?

Ad SDKs, retargeting or lookalike audiences, engagement profiling, streaks and personalised recommendations built on behaviour. Anything that tracks a user to target them. Common in Indian gaming, social and regional-language content apps.

Do you already hold verified identity and age details for the parent?

An Indian school holds it from the admission form; a consumer app usually holds nothing about the parent at all. This decides which of Rule 10's three routes is open to you.

YOUR OBLIGATIONS

What Section 9 asks of you

General information, not legal advice. Verify against the notified text for your own business. The Act is published in full on our annotated copy, and the obligations commence on 13 May 2027 (as of September 2026).

Read the full guide

Before and after this check

This tool assumes the DPDP Act applies to you and works out what Section 9 adds. If you are not yet sure the Act reaches your business at all, start with the checker; if you want the reasoning behind every answer here, the guide works through it in full.

What does this children's data check actually tell me?

Which of the Section 9 duties attach to your business, and why. It covers verifiable parental consent under Section 9(1), the well-being limit under 9(2), the outright ban on tracking and targeted advertising under 9(3), whether a Fourth Schedule exemption applies to you and how far it reaches, and which of Rule 10's three verification routes is open to you. Every result carries the provision behind it.

Is this tool free, and does it store my answers?

It is free with no signup. Everything runs in your browser, so your answers are never sent to us and are never stored anywhere. Close the tab and they are gone.

What should I pick if I do not know whether under-18s use my service?

Choose "not sure". The tool treats that as a yes, because Section 9 has no knowledge qualifier: there is no actual-knowledge standard of the kind COPPA uses, and no safe harbour for a self-declared age. If a child in fact used your service the duties applied, whatever you believed at the time.

Does being a school or a clinic make me exempt from the children's data rules?

Only partly. Rule 12 and the Fourth Schedule disapply Sections 9(1) and 9(3) for certain classes (healthcare providers, educational institutions, crèches and child transport operators), but each carve-out is tied to a stated activity. An educational institution's exemption covers tracking for educational activities or the safety of children within the institution. It does not cover an advertising SDK in the school app, or sharing data with a vendor for that vendor's own purposes.

Can I run ads to under-18s if I have parental consent?

No. Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, and unlike Section 9(1) it contains no consent proviso. Rule 12 confirms the reading by exempting the two sub-sections separately. For an ad-funded product that means the exposure sits in the ad and analytics stack rather than in the consent screen.

Is this legal advice?

No. It is general information that points you at the provisions that apply to your situation, so you can act on them or take them to your adviser. For an unusual data practice, or where a wrong call is expensive, get a professional opinion.