Children Online

In one line

Indian law now says that a child is anyone under eighteen, that nothing may be done with their data without a parent's verified consent, and that they may not be tracked or advertised to at all.

In the wording a student can write in an exam: section 2(f) of the Digital Personal Data Protection Act 2023 defines a child as an individual who has not completed the age of eighteen years; section 9(1) requires a Data Fiduciary, before processing any personal data of a child or a person with disability who has a lawful guardian, to obtain verifiable consent of the parent or the lawful guardian; section 9(2) forbids processing likely to cause any detrimental effect on the well-being of a child; and section 9(3) forbids tracking or behavioural monitoring of children or targeted advertising directed at children.

The three regimes that apply

A child online is protected by three different bodies of law, and an answer that gives only one is incomplete.

Data protection, in section 9 of the 2023 Act, which governs what may be done with a child's information.

The criminal law, principally section 67B of the Information Technology Act 2000, which punishes material depicting children and the conduct that produces and spreads it, and which reaches grooming.

And the intermediary obligations, in the 2021 Rules, under which every intermediary must make reasonable efforts to cause its users not to host information that is harmful to child, and must remove specified content on complaint.

Section 9 of the 2023 Act

9(1). Before processing any personal data of a child, or of a person with disability who has a lawful guardian, the Data Fiduciary shall obtain verifiable consent of the parent or the lawful guardian, in the prescribed manner. The Explanation provides that consent of the parent includes the consent of lawful guardian, wherever applicable.

9(2). A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child.

9(3). A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children.

9(4). Sub-sections (1) and (3) may be made inapplicable to prescribed classes of Data Fiduciaries, for prescribed purposes, subject to prescribed conditions.

9(5). The Central Government may, if satisfied that a Data Fiduciary's processing of children's data is done in a manner that is verifiably safe, notify the age above which that fiduciary is exempt from all or any of the obligations in sub-sections (1) and (3).

The penalty. Item 3 of the Schedule fixes a penalty for breach of the additional obligations in relation to children extending to two hundred crore rupees, the second heaviest in the Act.