Verifiable parental consent
Also called: Parental consent under DPDP · Topic: Transparency, Accountability and e-Governance · NCERT: Beyond NCERT
Meaning
Verifiable parental consent is a rule in the Digital Personal Data Protection Act 2023 (DPDP Act). A Data Fiduciary is the company or body that decides how personal data is used. Before it uses a child's data, it must get the agreement of the child's parent or lawful guardian, and it must check that this agreement is real. Under the Act, anyone below 18 years is a "child". The DPDP Rules 2025, notified in November 2025, set out how the check is done: identity and age verification, or virtual tokens (digital proofs that confirm age without sharing full identity details). The rules come in step by step over 18 months.
Example
A 15-year-old in Pune tries to sign up on a social media app. Under the DPDP framework, the app must first find out that the user is under 18. It must then get a confirmed "yes" from a parent before it uses the child's data. Even with that consent, the app cannot track the child, watch the child's behaviour online or show the child targeted ads. Some essential services, such as healthcare, education and real-time safety, do not need parental consent.
Don't confuse with
- Consent manager: a body registered with the Data Protection Board that lets any person give, check and withdraw consent across platforms. Verifiable parental consent is a special extra condition that applies only to children's data.
- Ordinary consent of a data principal: an adult gives consent for their own data. For a child, the parent's checked consent is needed, and the child's own "yes" is not enough.