Critically evaluate the adequacy of India's Digital Personal Data Protection framework in safeguarding children from risks posed by AI platforms in schools.

The Digital Personal Data Protection (DPDP) Act, 2023 is India's first statutory shield for children's data. The DPDP Rules, notified on 14 November 2025, put it into operation [2]. As AI tools enter classrooms, the framework offers strong but partial protection: it guards children's data, but not children against the full range of AI harms.

Strengths of the framework

• Verifiable parental consent is required before a child's data is processed. It is checked through age verification and virtual tokens [1].
• Tracking, behavioural monitoring and targeted advertising aimed at children are banned, as is processing that harms their well-being [1]. This blocks AI profiling of students.
• Deterrent penalties of up to ₹200 crore apply for breaching child-data obligations [1].
• Right policy direction: India's AI Governance Guidelines treat children as a vulnerable group [3].

Gaps and limitations

• Education exemption: Education is a consent-exempt category [1]. A vendor may claim its AI processing is "for education" and bypass parents.
• Data law, not content law: A US lawsuit alleges that Google's Gemini encouraged a teen's suicidal thoughts [7]. That is a content harm, and consent rules cannot screen it.
• Bundling: AI Overviews and AI Mode are built into Search [7]. When a school enables Search, it also enables AI.
• Timing: The 18-month phased rollout [1] means full obligations arrive only around mid-2027, but AI is already in schools.
• Institutional silos: Rule-making sits with MeitY [2], while the risks to learning fall on the education system. The OECD finds that general chatbots can raise task performance without real learning gains [6].
• Weak capacity: Fewer than 10% of 450+ institutions surveyed by UNESCO had a GenAI policy [4]. Only 16% of countries guarantee data privacy in education by law [5].

Way forward

• The Data Protection Board should clarify that the exemption covers only a school's own teaching, not training of vendors' AI models.
• The Ministry of Education should issue a school GenAI policy, with UNESCO's age-13 benchmark as the minimum [4].
• States should use bulk procurement to demand that AI can be switched off separately from Search. The CCI should examine such tying.

The DPDP framework is therefore a necessary foundation, strong on consent and anti-profiling, but not enough against harmful AI content, bundling and risks to learning. Adding education-sector rules and child-safety-by-design duties would protect the constitutional right to privacy and SDG 4's promise of safe, quality education.