1. Executive Summary: Protecting Digital Childhood

Section 9 represents a paradigm shift in how Indian law views children in the digital ecosystem. For the first time, statutory law recognizes that children are not simply "small adults" - they are a vulnerable population requiring heightened protection in the data economy.

1.1 The Five-Layer Protection Framework

Section 9 creates a multi-layered shield around children's data:

1.2 Critical Point: Section 9 Applies to ALL Data Fiduciaries

Common Misconception: "Section 9 only applies to services 'for children' like gaming apps or educational platforms."

Reality: Section 9 applies to ANY Data Fiduciary processing data of ANY child, regardless of whether the service is child-directed.

Examples:

• E-commerce site that allows 17-year-olds to shop → Section 9 applies
• Social media platform with users of all ages → Section 9 applies to underage users
• Banking app used by minors (with parental account) → Section 9 applies
• General news website visited by children → Section 9 applies

2. Philosophical Foundations: Children's Rights Theory

2.1 UN Convention on the Rights of the Child (1989)

India ratified the UNCRC in 1992, committing to protect children's rights, including in emerging contexts like digital spaces.

Four Core Principles:

1. Non-discrimination (Article 2): All children have equal rights
2. Best Interests (Article 3): Child's best interests must be primary consideration
3. Right to Life, Survival, Development (Article 6): Includes psychological and social development
4. Respect for Views of Child (Article 12): Children's opinions matter

Section 9 Implementation:

• 9(1): Best interests - parents act as decision-makers
• 9(2): Right to development - no detrimental processing
• 9(3): Protection from exploitation - no commercial manipulation

2.2 Parens Patriae Doctrine

Legal Maxim: "The State as Parent" - Government has duty to protect those who cannot protect themselves.

Origin: English common law, adopted in Indian jurisprudence.

Application to Section 9: State (through DPDPA) steps in to protect children from data exploitation that they (and often parents) cannot understand or prevent.

2.3 Developmental Psychology: Piaget & Kohlberg

Jean Piaget's Cognitive Development Theory:

• Ages 7-11 (Concrete Operational): Logical thinking about concrete situations, but not abstract concepts like "data processing"
• Ages 12+ (Formal Operational): Abstract thinking emerges, but still developing

Lawrence Kohlberg's Moral Development:

• Children under 13 typically at "Conventional Level" - follow rules to please others or maintain social order
• Vulnerable to manipulation through social pressure

Section 9's Age 18 Threshold: Recognizes that full capacity for informed consent develops gradually, erring on side of protection.

2.4 Academic Research on Children and Digital Media

Key Studies:

Livingstone & Third (2017) - "Children and Young People's Rights in the Digital Age" New Media & Society.

Found that children face "privacy paradox" - desire privacy but lack skills to protect it. Parental mediation necessary but insufficient.

Twenge (2017) - "iGen: Why Today's Super-Connected Kids Are Growing Up Less Rebellious, More Tolerant, Less Happy"

Documented mental health crisis among children with high social media use. Data-driven algorithmic amplification of harmful content.

Auxier et al. (2020) - Pew Research: "Parenting Children in the Age of Screens"

71% of parents concerned about child's online privacy, but only 39% feel equipped to protect it.

Section 9 addresses these research findings through mandatory parental consent and absolute prohibitions.

3. Constitutional Framework: Best Interests of the Child

3.1 Article 21: Right to Life and Personal Liberty

Supreme Court has consistently held that Article 21 includes right to healthy development for children.

MC Mehta v. State of Tamil Nadu, (1996) 6 SCC 756 (Child Labour Case):

Application to Section 9: Right to healthy development includes protection from digital exploitation, surveillance, and manipulation.

3.2 Article 39(f): Child Protection Directive

Article 39(f) (Directive Principle): "That children are given opportunities and facilities to develop in a healthy manner and in conditions of freedom and dignity and that childhood and youth are protected against exploitation..."

Section 9 implements this constitutional directive in the digital sphere.

3.3 Bachpan Bachao Andolan v. Union of India (2011)

Bachpan Bachao Andolan v. Union of India, (2011) 5 SCC 1:

Supreme Court held that child rights are fundamental, not merely aspirational. State must take proactive measures to protect children from exploitation.

Section 9's Proactive Measures:

• Mandatory parental consent (not optional)
• Absolute prohibitions (not negotiable)
• Criminal penalties for violations

4. Who is a "Child" Under DPDPA?

Definition (Section 2(k)): "Child" means an individual who has not completed the age of eighteen years.

4.1 Bright-Line Rule: Under 18 = Child

DPDPA adopts a bright-line rule: Anyone under 18 is a child, period. No exceptions.

4.2 Why 18? Comparative Analysis

India's Choice of 18:

• Aligns with age of majority for contracts (Indian Contract Act, 1872)
• Matches voting age (Constitution)
• Consistent with other child protection laws (POCSO, JJ Act)
• Higher protection = safer approach

5. Section 9(1): Verifiable Parental Consent

Statutory Language: "The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian..."

5.1 Three Key Requirements

1. BEFORE processing: Consent must precede data collection
2. VERIFIABLE consent: Must actually verify it's the parent/guardian
3. OF THE PARENT: Not the child's own consent

5.2 What is "Verifiable" Consent?

Rule 10 (DPDP Rules 2025) prescribes verification methods:

5.3 Inadequate Verification Methods (Non-Compliant)

5.4 The Consent Process Flow

5.5 Challenges and Solutions

6. Section 9(2): No Detrimental Effect on Well-Being

Statutory Language: "A Data Fiduciary shall not undertake such processing of personal data that is likely to cause any detrimental effect on the well-being of a child."

This is a harm-based prohibition. Processing that harms children is categorically forbidden, even with parental consent.

6.1 What is "Detrimental Effect on Well-Being"?

Well-being includes:

• Physical well-being: Health, safety, bodily integrity
• Mental well-being: Psychological health, self-esteem, emotional development
• Social well-being: Relationships, social skills, peer interactions
• Educational well-being: Learning, cognitive development, academic progress
• Moral well-being: Values, ethics, character development

6.2 The "Likely to Cause" Standard

Section 9(2) uses "likely to cause" - not "actually causes."

This is a PRECAUTIONARY standard:

• Don't need to prove actual harm occurred
• Don't need to wait for children to be harmed
• If processing is likely (probable, foreseeable) to harm children, it's prohibited
• Burden is on Data Fiduciary to prove processing is NOT likely to harm

7. Section 9(3): Absolute Prohibitions

Statutory Language: "A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children."

This is the "triple lock" on children's data - three activities that are ABSOLUTELY FORBIDDEN, even with parental consent.

7.1 Prohibition #1: Tracking

What is "Tracking"?

Following a child's activities across websites, apps, or online services over time to build a profile of their behavior.

Permitted (Not "Tracking"):

• ✓ Session cookies (functional, not tracking)
• ✓ Within-app analytics (e.g., which game levels completed - as long as not shared cross-app)
• ✓ One-time location lookup (e.g., "Where are you?" for local content) if immediately discarded
• ✓ Parent-initiated location sharing for safety (Find My Phone) if parent controls it

7.2 Prohibition #2: Behavioral Monitoring

What is "Behavioral Monitoring"?

Observing, analyzing, and recording a child's behavior patterns to predict or influence future behavior.

7.3 Prohibition #3: Targeted Advertising

What is "Targeted Advertising"?

Showing ads to a child based on their personal data, behavior, or profile.

7.4 Critical Question: "Even With Parental Consent?"

YES. Section 9(3) prohibitions apply even if parent consents.

Why? Some harms are so severe that parents cannot waive protection.

Legal Principle: Volenti non fit injuria (to one who consents, no harm is done) does NOT apply when:

• Consent involves rights of third party (child's future rights)
• Activity is against public policy
• Harm is irreparable

Analogy: Parents cannot consent to child labor, even if family needs income. Some protections are non-waivable.

8. Sections 9(4) & 9(5): Exemptions and Age Flexibility

8.1 Section 9(4): Limited Exemptions

Statutory Language: "The provisions of sub-sections (1) and (3) shall not be applicable to processing of personal data of a child by such classes of Data Fiduciaries or for such purposes, and subject to such conditions, as may be prescribed."

Rule 11 (DPDP Rules 2025) prescribes exemptions:

8.2 Section 9(5): Age Flexibility Mechanism

Statutory Language: "The Central Government may, if satisfied that a Data Fiduciary has ensured that its processing of personal data of children is done in a manner that is verifiably safe, notify for such processing by such Data Fiduciary the age above which that Data Fiduciary shall be exempt from the applicability of all or any of the obligations under sub-sections (1) and (3)..."

This is a "regulatory sandbox" for child data protection - a reward mechanism for exemplary Data Fiduciaries.

Key Points:

• Age flexibility is entity-specific and service-specific
• Can be revoked if standards slip
• Incentivizes best-in-class child protection
• Recognizes that 16-17 year-olds have more capacity than younger children

9. Persons with Disability: Guardian Consent

Section 9(1) also covers "person with disability who has a lawful guardian."

9.1 Who Qualifies?

Rights of Persons with Disabilities Act, 2016: Defines disabilities including:

• Intellectual disability
• Mental illness
• Autism spectrum disorder
• Cerebral palsy
• Multiple disabilities
• Others affecting decision-making capacity

Key Requirement: Person must have a LAWFUL GUARDIAN appointed by court or recognized by law.

Not All Persons with Disabilities Need Guardian Consent:

• Person with physical disability (no cognitive impairment) = regular consent
• Person with intellectual disability WITH guardian = guardian consent required
• Person with intellectual disability WITHOUT guardian = can self-consent if capable

9.2 Guardian Verification

Data Fiduciary must verify:

1. Person has disability affecting consent capacity
2. Guardian is legally appointed (court order, disability certificate, etc.)
3. Guardian's identity (same verification methods as parental consent)

10. Comparative Analysis: DPDPA vs GDPR vs COPPA

India's Approach: Most Protective

• Highest age threshold (18 vs 13-16 elsewhere)
• Absolute prohibitions on tracking, profiling, targeted ads
• Explicit harm prevention standard
• Specific protection for persons with disabilities

11. Practical Compliance Guidance

11.1 Section 9 Compliance Checklist

11.2 Common Section 9 Violations

11.3 Design Principles for Child-Safe Services

12. Conclusion: Reclaiming Digital Childhood

Section 9 is not just about data protection - it's about protecting childhood itself in the digital age.

For too long, children have been treated as "data products" - tracked, profiled, manipulated, and monetized. Their vulnerabilities exploited, their development harmed, their privacy invaded.

Section 9 says: ENOUGH.

Key Principles to Remember:

1. Age 18 is the Bright Line: No exceptions, no "mature minor" doctrine
2. Parents are Gatekeepers: Verifiable consent required BEFORE processing
3. Well-Being First: Processing harmful to children is forbidden
4. Triple Lock: NO tracking, NO profiling, NO targeted ads - EVER
5. No Consent Override: Section 9(3) prohibitions apply even with parental consent
6. Proportionate Penalties: Up to ₹200 crores for violations - protecting children is serious
7. Reward Good Actors: Age flexibility (9(5)) incentivizes best-in-class protection

Section 9 is India's commitment to ensuring that children can be children - even in the digital world.