DPDP for Edtech: The Strictest Rules in the Act Apply to You
If your learners are under eighteen, you are operating in the most constrained part of the framework, and several standard growth mechanics are simply unavailable.
The constraint that changes the product
Section 9(3) prohibits a Data Fiduciary from undertaking tracking or behavioural monitoring of children, or targeted advertising directed at children. There is no consent that unlocks this. A parent cannot agree to it on the child's behalf.
For an edtech business this removes several standard mechanics: behavioural retargeting, engagement profiling used for advertising, and lookalike audience building on learner data.
Verifiable parental consent, done properly
Rule 10 requires appropriate technical and organisational measures to obtain verifiable parental consent, plus due diligence to check the person is an adult, by reference to reliable identity and age details already held, or details voluntarily provided, including through a virtual token issued by an authorised entity such as a Digital Locker Service Provider.
An email to a parent asking them to click a link is unlikely to satisfy due diligence on adulthood.
Section 9(2) is the quiet one
A Data Fiduciary must not undertake processing likely to cause any detrimental effect on the well-being of a child. That is a broad standard and it reaches product design: engagement mechanics, streak pressure and social comparison features are all processing decisions.
Edtech carries a two hundred crore penalty head and a design constraint that arrives before the regulator does. Parents notice a product that pressures their child long before an auditor asks.
Infosek Team
What to build
- Age assurance at sign-up, not an age declaration checkbox.
- A parental consent flow that verifies adulthood by the Rule 10 routes.
- Hard segmentation excluding child accounts from tracking, behavioural profiling and ad targeting, enforced in the pipeline rather than in a setting.
- A documented distinction between pedagogical analytics and behavioural monitoring.
Common questions
Can edtech companies use targeted advertising to students?
Not where the students are children. Section 9(3) prohibits tracking or behavioural monitoring of children and targeted advertising directed at children.
What consent does an edtech platform need for a student under 18?
Verifiable consent of the parent or lawful guardian under section 9(1), obtained in the manner Rule 10 sets out, including due diligence that the person identifying as the parent is an adult.
Building for under-18 learners?
Infosek handles the whole of DPDP: data mapping, consent and notices, security controls, vendor contracts, breach readiness and the audit itself. We do the work, not just the gap report.
Book Free 30-Min Assessment
