A look at India's draft DPDP Rules, which require platforms to verify the age and identity of a parent when obtaining consent to process data of users under 18

The newly released draft Digital Personal Data Protection (DPDP) Rules, 2025 say that online platforms must check the age …

MEDIANAMA 2025-01-05 Kamya Pandey

Context & Ripple Effects

India’s DPDP rulemaking builds on the country’s earlier proposal to require consent for personal-data collection and processing. The newly released draft rules are the implementation layer for the DPDP framework, now opened for public comment.

The under-18 provision makes consent operational rather than merely declarative: platforms would have to establish both a user’s age and the consenting parent’s identity. That places the draft rules’ enforcement framework at the center of product design for youth-facing services.

First-order effects

Platforms processing minors’ data in India would need age-assurance and parental-identity verification steps before relying on parental consent, adding friction to signup and consent flows.
Parents become a separately verified participant in a child’s data-processing permission, while platforms take on responsibility for retaining a defensible consent record.

Second-order effects

Age- and identity-verification vendors, along with platforms’ identity, privacy, and trust-and-safety teams, gain a more central role in serving youth users.
Services that cannot make verification workable may limit data-driven features for under-18 users or redesign them around less personal-data processing.

Third-order effects

If finalized and enforced, the rules would push India’s privacy regime toward verifiable-consent governance, where proving who granted permission matters alongside obtaining it.
The approach could make age assurance a recurring access-control requirement across consumer internet services, with the eventual compliance burden shaped by how the final rules define acceptable verification.

The trend: This is part of a broader shift from notice-and-consent privacy rules toward identity-backed, age-aware controls for minors’ online data.

Discussion

@anjalib_ Anjali Bhardwaj on x
Govt has put out draft rules to operationalize the Data Protection Act 2023. The Act amends the RTI law & vests excessive powers in central govt including appointing the oversight body which can impose penalties of 500 crore. Re-upping our article on the perils of the DPDP Act. […
@nixxin Nikhil Pahwa on x
India released its draft Data Protection Rules yesterday, and my initial thoughts are that it appears to be disconnected from reality. I'm still reading and will add more, but first the positive change, then the rest. Btw, expect a complete overview of the Rules on @medianama
@internetfreedom @internetfreedom on x
.@GoI_MeitY has released the long awaited DPDP Rules 16 & a half months after the DPDP Act, 2024 was enacted. We are dismayed that after such a long wait the Rules have failed to rise to the occasion & meet our expectations. 🧵1/9 https://internetfreedom.in/...
@pib_india @pib_india on x
The draft Rules details about the various implementation aspects such as the notice by the Data Fiduciary to the individuals, registration and obligations of Consent Manager, processing of personal data for issuance of subsidy, benefit, service etc. by State, applicability of
@pib_india @pib_india on x
.@GoI_MeitY releases Draft Digital Personal Data Protection Rules, 2025 for public consultation; Feedback/comments sought from public by 18th February, 2025 Read here: https://pib.gov.in/...
@cnnnews18 @cnnnews18 on x
#BreakingNews |Government Of India releases Draft Of Digital Personal Data Protection Rules @AmanKayamHai_ shares more details @JamwalNews18 | #socialmedia #personaldataprotectionrules #children #privacy [video]
@digitaldutta Srinivas Kodali on x
Looks like 2025 is the year of data protection. MeITY released draft data protection rules.
@aditi_muses Aditi Agrawal on x
New: Key points from the draft Digital Personal Data Protection Rules. Some expected things, some new things, some scary things (data localisation, Section 36+Rule22). https://www.hindustantimes.com/ ...
@barandbench @barandbench on x
The Ministry of Electronics and Information Technology has published the draft rules for the Digital Personal Data Protection (DPDP) Act for public consultation. Suggestions and objections regarding the draft rules can be submitted through the MyGov portal until February 18, [ima…
@mirrornow @mirrornow on x
16 months after #DataProtectionAct, draft of digital personal data issued - ‘Child below 18 needs consent’ to create social media account - Draft: Consent needed from parents - Draft released for public consultation @anchoranjalip [video]
@ashwinivaishnaw Ashwini Vaishnaw on x
These draft rules will be finalised only after extensive consultation. Please do share your views. https://innovateindia.mygov.in/ ...
@ashwinivaishnaw Ashwini Vaishnaw on x
Draft DPDP rules are open for consultation. Seeking your views. https://innovateindia.mygov.in/ ...

Chronicles