Identify where age changes the journey
Map direct sign-up, invited users, household accounts, school or employer deployments and offline-to-online journeys. The right age-assurance method depends on the context and the risk of processing.
Avoid collecting excessive identity data merely to establish age. The verification method should be proportionate and designed with security, retention and accessibility in mind.
Verify the parent or lawful guardian
Section 9 requires verifiable parental consent before processing a child's personal data, subject to notified exemptions. Rule 10 describes due diligence using reliable identity and age details or an authorised entity or virtual-token mechanism.
Keep evidence that connects the verified adult, the child, the notice version, the purpose and the consent action without retaining unnecessary identity material.
Enforce the prohibitions in the product
The Act prohibits processing likely to cause detrimental effect on a child's well-being and restricts tracking, behavioural monitoring and targeted advertising directed at children.
These are data-flow controls. Review analytics SDKs, advertising audiences, recommendation systems, experimentation platforms and processor defaults. A policy cannot override what the product continues to send.
Sources and editorial review
Prepared by DPDP Academy Editorial (Legal education and implementation guidance). Reviewed by DPDP Academy Source Review using the sources below on 2 August 2026. Statutory text, notified Rules and practical interpretation are kept distinct. Educational content, not legal advice.