Verifiable Parental Consent (VPC)
Verifiable parental consent checks that the person consenting to a child's data processing is an identifiable adult parent, subject to applicable exceptions.
Rule 10 describes reliable identity and age information or permitted identity-linked tokens. Aadhaar is not universally mandatory. Rule 12 has conditional exceptions for specified activities and fiduciaries.
Practical application
Choose proportionate verification that avoids unnecessary identity-document collection.
Common questions and examples
How is a parent's age and identity verified?
Rule 10 requires due diligence that the person identifying as the parent is an identifiable adult. It allows reference to reliable identity and age details already held, or voluntarily supplied details or an authorised identity-linked token. Choose a method appropriate to the service and retain evidence of the verification and consent without collecting unnecessary identity data.
Is an OTP or a child's declaration enough for parental consent?
An OTP can show control of a phone or email account; on its own it does not establish adulthood or the identity of the person consenting. A child's declaration alone is also insufficient. The Rules do not prescribe a universal combination of parent and child OTPs. The complete flow must satisfy the verification and consent requirements, subject to any applicable exception.
Official sources and editorial review
Prepared by DPDPA Shield. Explanations are plain-language summaries; the cited legislation controls. Last reviewed .
Put privacy knowledge into practice
Explore consent, data inventory and rights-request workflows with DPDPA Shield.