Verifiable Consent for Children and Persons with Disability After the 2026 Order

The October 2026 Removal of Difficulties Order added a single word to Section 9(1) of the DPDP Act, but it settled an important point. Verifiable consent is required in two parallel cases:

• From the parent of a child (anyone under 18), and
• From the lawful guardian of a person with disability who has one.

Penalties for breaching the obligations relating to children go up to ₹200 crore. These provisions commence with the bulk of the Act in May 2027.

Children: Rule 10

Before processing a child's personal data, a Data Fiduciary must adopt appropriate technical and organisational measures to obtain the verifiable consent of the parent. In practice the Rule asks you to check that the person consenting is an identifiable adult. You can rely on:

• Reliable identity and age details already available to you, for example where the parent is already a verified user of your platform, or
• Identity and age details voluntarily provided by the parent, or a virtual token mapped to such details issued by an entity entrusted by law or by government, such as a DigiLocker-based token.

Section 9 also prohibits, for children:

• Processing that is likely to cause a detrimental effect on a child's well-being.
• Tracking, behavioural monitoring and targeted advertising directed at children.

Persons with disability: Rule 11

Where the user is a person with disability who has a lawful guardian, the Data Fiduciary must take due diligence to verify that the guardian has been appointed by a court, a designated authority or a local-level committee under the applicable law. The relevant laws are the Rights of Persons with Disabilities Act 2016 and the National Trust Act 1999.

Unlike age, guardianship cannot be inferred. You need evidence of the appointment, such as a court order or authority certificate, and you must keep a record that you checked it.

Exemptions (Fourth Schedule)

Some classes of Data Fiduciary and purpose are exempt from parts of Section 9, subject to conditions. Examples include clinical and healthcare establishments, educational institutions and child-care / crèche providers, processing only to the extent needed for their function and the child's safety. Other exemptions cover processing for real-time location tracking for safety, and for verifying that a user is not a child. Check the exact conditions before relying on any of them.

Designing compliant flows

1. Age assurance at entry. Ask for age in a neutral way, and where you have risk signals, use a stronger check.
2. A parent pathway. If the user is a minor, route them to a parent-consent flow: a verified adult account, a DigiLocker token or another reliable method. Keep the evidence.
3. A guardian pathway. This is a separate flow that collects and verifies the guardianship instrument, with a manual review queue.
4. Product controls by default. For accounts flagged as children, switch off behavioural tracking and targeted ads.
5. Log everything. Record the method used, the timestamp, the notice version and the reviewer. Without the record, you cannot show the consent was "verifiable".

Industries most affected

EdTech, gaming, social platforms, healthcare and e-commerce carry the most exposure. See our EdTech and healthcare pages and our earlier explainer on verifiable parental consent.

Sammati, our consent agent, supports age-gated, parent and guardian consent pathways with full evidence logs.

Position as of 15 October 2026. Not legal advice.