Interactive Checklist

C-07 Child Safety & Verification Product Manager & UX Designer

The Children's Product Gate

Statutory gate audit for child-facing services enforcing verifiable parental consent (VPC) and the flat ban on behavioral tracking under Section 9.

Statutory Source: Ch. 13: verify, well-being, no-tracking/no-targeting, SDK-gate, necessity

Total Verification Points: 6 Audit Checks

C-07Ch. 13: verify, well-being, no-tracking/no-targeting, SDK-gate, necessity

The Children's Product Gate

Five gates for anything a child can touch (₹200 cr exposure)

Readiness Score

0 / 6 checks

Age Gate & Age Assurance: Mechanism deployed to identify whether user is under 18 years of age.

Section 9(1)

Verifiable Parental Consent (VPC): Consent obtained from parent/guardian via government ID, DigiLocker, or banking token.

Section 9(1) & Rule 8

Detrimental Effect Prohibition: Processing does not cause any detrimental effect on the physical or mental well-being of the child.

Section 9(2)

Absolute Ban on Tracking & Profiling: All behavioral analytics, cookies, user profiling, and event telemetry disabled for minors.

Section 9(3)

Absolute Ban on Targeted Advertising: Zero targeted ads directed at children or served based on child personal data.

Section 9(3)

Third-Party SDK Verification: All embedded mobile/web SDKs audited to ensure no unauthorized background tracking of child data.

Section 9(3) & Section 8(2)

State automatically persisted in browser localStorage

Statutory Grounding & Legal Perimeter

Mandatory statutory clauses, rules, and gazette requirements enforceable under this checklist.

Enforceable Provisions:

Section 9(1)

Section 9(2)

Section 9(3)

Section 9(4)

Section 9(5)

Rule 8

Section 33

Statutory Context:

This checklist is directly anchored in Ch. 13: verify, well-being, no-tracking/no-targeting, SDK-gate, necessity. Failure to maintain verifiable affirmative proof of compliance exposes the enterprise to severe adjudication penalties under Section 33 (Schedule) of the DPDP Act.

Target Architecture & Impacted Systems

Enterprise applications, stores, and integration surfaces evaluated by this checklist.

View Full Systems Topology (SYS-001..014) →

In-Scope System Nodes:

SYS-001 Architecture Spec →

Customer App & Web Portal

Public client boundary & untrusted intake surface for notices and consent capture

SYS-002 Architecture Spec →

Core Lending Monolith & Transaction Store

Domestic production database and primary system of record for loan servicing

SYS-010 Architecture Spec →

Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

Associated Operational Controls (54 OBLs)

Control Master Matrix obligations directly tested by this checklist.

Open Control Matrix →

OBL-24 Workpaper →

Control Dossier OBL-24

OBL-05 Workpaper →

Control Dossier OBL-05

Audit & Implementation Guidance

Best practices for establishing evidence, avoiding traps, and conducting periodic assurance.

Evidence Retention Standard

Do not rely solely on policy documents or statements of intent. Ensure verifiable evidence artifacts (cryptographic logs, test manifests, signed DPA agreements, or automated crawler receipts) are archived for at least 1 year.

Common Implementation Trap

Avoid declaring compliance based on frontend UI alone. The Data Protection Board evaluates the full data pipeline, including database persistence, read replicas, cache invalidation, and third-party processor synchronization.

Previous Checklist

C-06 — The Breach Intimation Checklist

Next Checklist

C-08 — The Monthly Regulatory Watch Checklist