Chapter 1 · The scenario
Example: A Kota coaching institute's admissions number
A coaching institute in Kota runs admissions on WhatsApp. A 16-year-old taps a Click-to-WhatsApp ad and asks about the JEE batch. The bot answers the course question, but before the number is saved for follow-ups its Flow asks for a year of birth. Seeing 16, it sends the student a click-to-chat link to forward to a parent. When the father writes in, the institute explains what it will keep and why, and verifies him against details it already holds from an elder sibling's enrolment. The student's own number is tagged as a minor's, so no fee-discount campaign ever targets it; offers go to the verified parent, who opted in to them.
Chapter 2 · What is verifiable parental consent?
Verifiable parental consent is the requirement in section 9 of India's Digital Personal Data Protection Act (DPDP Act) that a business obtain the verifiable consent of a child's parent or lawful guardian before processing the child's personal data. In the Act a child is anyone under 18 — older than the minimum age many apps set for their own users — and the same rule covers a person with a disability who has a lawful guardian.
Rule 10 of the DPDP Rules 2025 sets how. The business must use appropriate technical and organisational measures to make sure consent really comes from a parent, and must check that the person identifying as the parent is an identifiable adult. It can rely on reliable identity and age details it already holds, or on details — or a virtual token mapped to them — that the parent provides through an entity entrusted by law or the government, such as a Digital Locker service provider. A tick-box saying "I am the parent" is not, on its own, verification.
Section 9 goes beyond consent. Even with a parent's agreement, a business may not process a child's data in a way likely to harm the child's well-being, and may not track or behaviourally monitor children or target advertising at them. The Fourth Schedule of the Rules exempts certain classes — such as healthcare providers, educational institutions and child-care services — and purposes such as a child's safety from some of these duties, within strict limits. This is a higher bar than Opt-in, which covers consent from adults to receive messages.
On WhatsApp the hard part is knowing who you are talking to. A number on a school admission form may belong to a parent or to a 16-year-old student, and a lead from a Click-to-WhatsApp ad carries no age at all. Businesses that serve children — coaching centres, schools, edtech and gaming apps, children's retail — need an age signal at the point of opt-in, a parent-verification step when it says under 18, and a rule that marketing never targets a child's own number.
Key takeaways
- Verifiable parental consent is the DPDP Act duty to get a verified parent's or guardian's consent before processing an under-18's personal data.
- Section 9 also bans tracking, behavioural monitoring and targeted advertising directed at children, even with a parent's consent.
- Rule 10 asks you to check the parent is an identifiable adult, using reliable identity and age details or a virtual token.
- The Fourth Schedule of the DPDP Rules 2025 exempts some providers and purposes, such as health services and child safety, within strict limits.
- Breaching the children's data duties can draw a penalty of up to 200 crore rupees; they apply from 13 May 2027.
Chapter 3 · How it unfolds
How does verifiable parental consent work?
Ask for age at opt-in
Capture an age signal — a year of birth is often enough — wherever a number is collected: web forms, ad lead forms, in-chat Flows. Store it in the Consent Record alongside the opt-in.
Route under-18s to a parent
If the person is under 18, ask for the parent or guardian and seek consent from them, not from the child. A click-to-chat link the parent opens lets the parent start the conversation.
Verify the parent is an adult
Check identity and age against reliable details you already hold, or accept a virtual token or details shared through a Digital Locker service. Record which method you used, not copies of documents.
Limit what you do with the child's data
Process only for the purpose the parent agreed to, and never use the data for tracking, behavioural monitoring or ads targeted at the child.
Check exemptions narrowly
If you are a school, clinic or child-care provider, confirm that a Fourth Schedule exemption covers this exact purpose before skipping a step; exemptions never cover marketing or profiling.
Chapter 4 · Where it goes wrong
Common mistakes with verifiable parental consent
Treating an app's minimum age as the rule
An app may let 13-year-olds sign up, but the DPDP Act treats everyone under 18 as a child. Your duty follows the Act, not the platform's age gate.
Accepting self-declared parents
A checkbox saying "I am the parent" proves nothing. Verify against reliable details or a token, and record the method used.
Marketing to the child's own number
Targeted advertising directed at children is prohibited even with consent. Tag minors' numbers, exclude them from every campaign, and send offers to the verified parent instead.
Collecting age and then ignoring it
If your form records an age of 15 and your CRM still treats the number as an ordinary lead, you knew and did not act. Wire the age field into routing and suppression.
Stretching an exemption
Exemptions are tied to specific classes and purposes, such as health services or a child's safety. They do not cover marketing, analytics or profiling.
Chapter 5 · The facts
Verifiable parental consent: key facts and limits
| Who is a child | Anyone under 18 (DPDP Act section 2(f)) |
|---|---|
| Legal basis | DPDP Act section 9; DPDP Rules 2025, rule 10 |
| Verification | Reliable identity and age details, or a virtual token (e.g. via a Digital Locker service) |
| Always prohibited | Tracking, behavioural monitoring and targeted ads directed at children |
| Exemptions | Fourth Schedule: listed classes and purposes only |
| Maximum penalty | Up to 200 crore rupees |
| Applies from | 13 May 2027 |
Chapter 6 · Why it matters
Why does verifiable parental consent matter?
Children's data carries some of the Act's heaviest duties: its schedule allows a penalty of up to 200 crore rupees for breaching section 9, and the ban on targeted advertising to children cannot be cured by consent. Coaching, school, edtech, gaming and kids' retail businesses run much of their customer contact on WhatsApp, often with numbers students typed in themselves. Building the age check and parent verification into opt-in before the duties apply on 13 May 2027 costs far less than re-consenting an existing list afterwards.
Chapter 7 · Verifiable Parental Consent FAQs
Verifiable Parental Consent FAQs
Who counts as a child under the DPDP Act?+
How do you verify parental consent under the DPDP Rules?+
Can a business send WhatsApp marketing to under-18s?+
When does verifiable parental consent become mandatory?+
Are schools and hospitals exempt from parental consent?+
Chapter 8 · What good teams do
Best practices for verifiable parental consent
- Ask for the least age data that works, such as a year of birth, and only where children are likely.
- Let parents start the WhatsApp chat themselves through a click-to-chat link, so the opt-in is theirs.
- Store the verification method and date in the consent record, not copies of identity documents.
- Review ad targeting so Click-to-WhatsApp campaigns are not aimed at under-18 audiences.