EdTech platforms are the highest-risk category for DPDPA S.9 violations. Children's data carries a ₹200 crore per-violation penalty — the highest in the Act. No age gate, no verifiable parental consent, no defence.
A checkbox that says 'I confirm I am 18 or above' is not age verification under DPDPA S.9. The Act requires verifiable parental consent before processing any personal data of a child — meaning the parent's identity must be verifiable, not just claimed by the child. Every minor who creates an account without verifiable parental consent is a ₹200 crore risk.
DPDPA S.9(3) is an absolute prohibition — regardless of parental consent, you cannot track children's behaviour online, build profiles of children, or target advertising to children. If your learning analytics platform tracks engagement, session time, and content preferences for users who may be minors — you have an absolute prohibition violation.
Students — or their parents for minors — have the full suite of DPDPA rights: access to their learning data, correction of inaccurate academic records, erasure when they leave the platform. An EdTech company that ignores a parent's erasure request for their child's data is not just in breach of DPDPA — it's a complaint waiting to happen.
User declares age at signup. Under-18 triggers the parental consent flow automatically — no manual configuration per user.
Parent's phone or email OTP verifies their identity. Consent record stored with parent's verified identifier, timestamp, and purposes — cryptographically immutable.
Once a minor flag is set: behavioural analytics disabled, ad tracking pixels blocked, data processing restricted to course delivery and account management only.
Parents can view their child's data, request corrections to academic records, and request erasure at platform exit — all via the DPDPA Shield rights portal, OTP-verified.
Configurable minimum age. Under-18 automatically triggers parental consent flow.
Parent identity verified before any data is processed for a minor account.
Platform-level block on behavioural analytics and ad profiling for flagged minor accounts.
Minor accounts restricted to course delivery and account management — no expansion without fresh parental consent.
Parents can access, correct, and erase their child's data — OTP-verified, SLA-enforced.
Record of processing for student engagement, assessment, and completion data — with retention period per course lifecycle.
Student data breaches classified as High severity. 72-hour Board notification package pre-generated.
When you add new course features that change data processing — automatic re-consent campaign to affected parents.
See what a children's data violation or missed parental consent would cost your EdTech platform under DPDPA.
Children's data compliance requires the Enterprise module. Book a demo to discuss your user volume and pricing.