Section 9
Processing of personal data of children
Requires verifiable parental consent before processing a child’s data, and bans tracking, behavioural monitoring and targeted advertising directed at children.
Read this before you cite anything here
These pages are a plain-English restatement, written to help you find the right provision and understand what it asks of you. They are not the text of the statute, and nothing here should be quoted as though it were. Section and rule numbers are exact, and every page names its source.
What it says
- (1)
- Before processing the personal data of a child, or of a person with disability who has a lawful guardian, the Data Fiduciary must obtain the verifiable consent of the parent or lawful guardian, in the manner prescribed.
- (2)
- The Data Fiduciary must not undertake processing likely to cause any detrimental effect on the well-being of a child.
- (3)
- The Data Fiduciary must not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children.
- (4)
- Sub-sections (1) and (3) may be exempted for prescribed classes, purposes and conditions.
- (5)
- The Central Government may notify an age above which a Data Fiduciary that processes verifiably safely is exempt from sub-sections (1) and (3).
Amended
In sub-section (1), the word of was inserted before the reference to a person with disability. The duty now plainly covers two kinds of data: the personal data of a child, and the personal data of a person with disability who has a lawful guardian. A disability on its own does not call for guardian consent; the person must have a lawful guardian, verified under Rule 11.
Digital Personal Data Protection (Removal of Difficulties) Order, 2026 (S.O. 5458(E), 5 October 2026), in force from its publication in the Gazette of India dated 6 October 2026.
In practice
Sub-section (3) is a prohibition, not a consent gate. Parental consent under (1) does not unlock behavioural monitoring or targeted advertising, because (3) bans the activity itself. Any product that profiles users and has under-eighteens on it has a design problem rather than a consent problem, and Rule 12 with the Fourth Schedule is the only route out.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Section 9 is live and carries its own penalty band. When the Board starts issuing orders under it, we will tell you what they actually turned on, cited.