Abstract
The
fast enlargement of social media, online gaming, digital training, and
artificial intelligence has elevated kid’s publicity to the gathering and
processing of private information. Although virtual platforms offer academic
and social blessings, in addition they create dangers concerning profiling, unauthorized
disclosure, behavioural tracking, targeted marketing, and data breaches. In
India, the Digital Personal Data Protection Act, 2023 (DPDP Act), collectively
with the Digital Personal Data Protection Rules, 2025, establishes a framework
for protective kid’s non-public information. This article examines the felony
duties of on-line structures, relevant statutory safeguards, implementation
challenges, and measures required to strengthen kid’s virtual privateness.
Introduction
The
net has become a crucial part of children’s training, conversation, leisure,
and social development. Children use educational applications, social
networking websites, online games, and video-sharing platforms at an
increasingly early age. However, these services can also gather private
facts, including names, photographs, location details, browsing behaviour,
device identifiers, and study preferences.
Children
won’t completely recognise how their data is amassed, stored, analyzed,
or shared with 1/3 events. Such records can be used to create behavioural profiles, influence online picks, or expose youngsters to inappropriate
content material and privacy violations.
Children’s
privacy is consequently now not simply a technical situation but a human rights issue. Online structures have to make certain that
technological innovation does not undermine kids’ safety, dignity, autonomy, and
free pursuits.
Legal
Framework for Children’s Digital Privacy in India
- Digital
Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023, is
India’s most important law governing the processing of virtual non-public data.
Section 2(f) defines an infant as a person who has not finished eighteen years
of age.
Section 9 establishes unique safeguards for kid’s
non-public statistics. It requires a Data Fiduciary to attain verifiable
consent from a parent or lawful dad or mum earlier than processing an infant’s
non-public records, challenge to relevant statutory exemptions. It additionally
prohibits processing that could have an unfavourable effect on a toddler’s
well-being and
Restricts tracking, behavioural tracking, and focused
advertising directed at children, subject to the exceptions supplied by the law.
These responsibilities are extensive because they
place responsibility on organisations that decide the purposes and manner
of processing private information. A platform can’t deal with children’s
statistics as a normal industrial useful resource without considering the extra
statutory protections relevant to minors.
- Digital
Personal Data Protection Rules, 2025
The Digital Personal Data Protection Rules, 2025,
provide operational info for implementing the Act. Rule 10 addresses verifiable
parental consent, including due diligence concerning the identification and
adult status of the data subject. The Rules also prescribe designated exemptions
for positive lessons of Data Fiduciaries and functions, concerning relevant
situations.
However, the Act and Rules have phased graduation provisions.
Consequently, the legal duties relevant on a selected date need to be assessed
against the relevant graduation notifications in preference to assuming that
every provision became enforceable immediately upon enactment.
- Information
Technology Act, 2000
The Information Technology Act, 2000, offers extra
safety in opposition to positive forms of online exploitation. Section 67B
addresses special activities involving sexually explicit fabric depicting
youngsters in electronic form, including publishing, transmitting,
developing, accumulating, or facilitating such material in the circumstances
included with the aid of the supply.
The Information Technology (Intermediary Guidelines
and Digital Media Ethics Code) Rules, 2021, also establish due-diligence duties
for intermediaries. These provisions complement data-protection legislation by addressing illegal online content material and
intermediary duties.
Legal
Responsibilities of Online Platforms
- Obtaining
Verifiable Parental Consent
Platforms need to enforce suitable structures to
obtain verifiable parental consent earlier than processing children’s private
records where Section nine applies. A simple tick-box announcement may
not, by means of itself, establish compliance with the prescribed verification
requirements.
Organizations have to explain their data processing practices in clean, plain language and make sure that consent mechanisms are
meaningful, secure, and appropriate to the occasions. They have to additionally
avoid gathering useless information simply to verify parental identification.
- Preventing Harmful Data Processing
Section 9(2) prohibits processing that is possibly
to have a detrimental effect on a toddler’s nicely-being. Platforms should
consequently examine whether their data practices create risks to children’s
protection or well-being.
For example, applications that use kids’ personal
records to expose them to harmful suggestions or take advantage of their
vulnerabilities may also increase severe felony and ethical concerns. Data
safety needs to expand beyond preventing unauthorized access to examining the
effects of records use.
- Restricting Tracking and Targeted Advertising
Section 9(3) restricts monitoring and behavioural tracking of kids, and targeted advertising and marketing directed at them,
with statutory exceptions. Platforms must take a look at their
advertising structures, analytics tools, ad-serving algorithms, and 1/3-party
integrations to discover practices which could violate those regulations.
Commercial hobbies have to know not to override
children’s statutory privacy protections. Businesses should examine whether
or not their technologies are well suited to the relevant restrictions
before deploying them.
- Ensuring Data Security and Accountability
Section 8 of the DPDP Act establishes preferred
duties for Data Fiduciaries, consisting of obligations for compliance, suitable
technical and organizational measures, reasonable security safeguards, and
prescribed breach-associated obligations.
Platforms should undertake get right of entry to
controls, encryption wherein appropriate, safety trying out, retention limits,
and incident-reaction techniques. Children’s statistics ought to not be
retained indefinitely without a lawful purpose.
Where a statistics breach takes place, corporations
have to comply with the applicable notification requirements. They must also
establish available complaint mechanisms through which mothers, fathers, and
affected people can raise issues and are looking for appropriate remedies.
- Responsible Content Moderation
Privacy safety is carefully related with online
protection. Platforms should preserve effective reporting mechanisms for
unlawful content material, impersonation, exploitation, and unauthorized
disclosure of children’s non-public statistics.
The Information Technology Act and applicable
intermediary policies offer a framework for addressing certain classes of unlawful
content material. Platforms ought to reply to legally valid orders and reports
in accordance with applicable regulation, whilst maintaining appropriate safeguards
towards arbitrary elimination of lawful material.
Challenges
in Protecting Children’s Privacy
Despite
the developing felony framework, numerous challenges remain.
First, age verification and parental consent can be
difficult to implement accurately. Weak verification may additionally permit
children to get admission to offerings without appropriate safeguards, while
intrusive verification can create extra privacy dangers.
Second, limited attention prevents many
youngsters and parents from understanding how complicated privacy guidelines. Long,
technical notices rarely communicate risks successfully to younger customers.
Third, algorithmic profiling and artificial
intelligence create new concerns. Systems may infer a child’s preferences,
emotional responses, or behaviour from sizeable virtual interactions, on
occasion without the kid knowing how the inferences are used.
Fourth, cross-border information processing complicates
enforcement when structures, providers, and storage facilities operate in distinct jurisdictions.
Finally, regulatory compliance can be particularly
demanding for smaller corporations and educational generation providers.
Nevertheless, real problems ought to be addressed without weakening
children’s fundamental privacy interests.
Conclusion
Children’s privacy in the digital age requires
more than standard data-safety guidelines. It demands precise safeguards that
recognise kids’ vulnerability and evolving capacity to recognise virtual dangers.
India’s DPDP Act, 2023, and the DPDP Rules, 2025, provide a critical criminal
framework through parental consent requirements, regulations on dangerous
processing, and safeguards against tracking and targeted advertising.
However, legislation on its own cannot guarantee
effective protection. Online systems need to integrate privacy into their
layout, business practices, algorithms, and protection structures. Effective
enforcement, public awareness, and accountable innovation are similarly
essential. Ultimately, the goal needs to be to create a virtual environment in
which kids can learn, talk, and take part safely without their personal
information being exploited.
