Dhristhi DPDP
Legal Register
Visual Infographic
I-26 Child Safeguards 👤 Product Managers, Mobile App Engineers & Trust & Safety Leads
← All 27 Infographics

The Child-Data Runtime Gate

Section 9 Flat Prohibitions: Age Verification, Verifiable Parental Consent, and Ad Tracking Blocks

Section 9 of the DPDP Act imposes strict flat prohibitions regarding personal data of children (defined as individuals under 18 years of age). Fiduciaries must enforce a 4-stage runtime gate: (1) Age Gate Classification, (2) Verifiable Parental Consent (VPC) via government ID tokens or parent-linked accounts, (3) Hard Runtime Enforcement (zero behavioral tracking, zero targeted advertising, zero processing harmful to child well-being), and (4) Telemetry Audit Logging. Breach of Section 9 carries up to a ₹200 Crore statutory penalty.

Statutory Source: Ch. 13, Topic 05
Archetype: child gate
I-26 DiagramArchetype: CHILD GATE

The Child-Data Runtime Gate

Section 9 Child Data Four-Stage Runtime Gate
Step 1: Age Classification
Rule: Verify whether user is under 18 years old.
Action: Trigger Child Mode if age < 18.
Step 2: Parental Consent (VPC)
Rule: Obtain Verifiable Parental Consent under s.9(1) & Rule 8.
Action: Verify parent via DigiLocker / Aadhaar / OTP.
Step 3: Runtime SDK Lockdown
Rule: Enforce s.9(3) flat statutory prohibitions.
Action: Kill tracking SDKs, analytics pixels, and targeted ad engines.
Step 4: Well-Being Monitoring
Rule: Ensure processing causes no detrimental effect (s.9(2)).
Action: Content safety filters and screen time limiters.

💡 Core Architectural Insights & Takeaways

Key technical and regulatory takeaways established by this architecture diagram.

✦ India defines a child as anyone under 18; there is no lower 13-year COPPA threshold unless gazetted under s.9(5).
✦ Behavioral tracking and targeted advertising to children are flatly illegal under Section 9(3).
✦ Parental consent must be verifiable via reliable authentication mechanisms.

📜 Statutory Grounding & Legal Perimeter

Primary Act and subordinate Rule provisions establishing the enforceable legal mandate for this diagram.

Enforceable Provisions:
Section 9(1)Section 9(2)Section 9(3)Section 9(4)Section 9(5)Rule 8Rule 9

🏗️ Target Architecture & Impacted Systems

Enterprise nodes and store topologies impacted by this architectural pattern.

View Complete Topology (SYS-001..014) →
SYS-001 Details →
Customer App & Web Portal

Public client boundary & untrusted intake surface for notices and consent capture

SYS-005 Details →
Analytics & AI/ML Training Environment

Model training and algorithm development node gated against unconsented data

SYS-010 Details →
Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

SYS-012 Details →
SIEM & Security Telemetry Store

Security log repository preserving tamper-evident dual-clock audit trails

⚙️ Associated Operational Controls

Control Master Matrix obligations enforcing the standards illustrated in this infographic.

Open Control Matrix →
OBL-09 Workpaper →
Control Dossier OBL-09
OBL-10 Workpaper →
Control Dossier OBL-10
OBL-23 Workpaper →
Control Dossier OBL-23

🛠️ Implementation Guidance & Traps

Recommended technical sequencing and operational failure modes to avoid.

Recommended Implementation Sequence

  1. Implement an age-gating screen on user onboarding flows.
  2. Integrate DigiLocker / Aadhaar parent-child verification for VPC.
  3. Hardcode feature flags in mobile SDKs to disable all tracking pixels when child flag is active.

Enterprise Traps & Failure Modes

  • ⚠️ Using US COPPA 13-year age gates in India (violating DPDP's 18-year statutory definition).
  • ⚠️ Serving contextual ads that utilize user behavioral profiling data for child users.

📁 Verifiable Evidence Artifacts Vault

Required evidentiary workpapers for regulatory inspections and SDF audits.

📄 Verifiable Parental Consent Verification Log (SYS-012)
📄 Mobile SDK Tracking Disablement Audit
📄 Child Data Protection Impact Assessment
← Previous Infographic
I-25: Derived-Data & AI Reach Map
Next Infographic →
I-27: DPDP Product Portfolio Architecture