Critically evaluate whether the 'verifiable parental consent' model under the DPDP Act, 2023 and Rules, 2025 adequately protects children in the age of AI and attention-driven platforms.

Section 9 of the DPDP Act, 2023 requires a Data Fiduciary to obtain verifiable parental consent before processing a child's data. The Act defines a child as anyone under 18 [1]. The DPDP Rules, 2025 bring this into force through an 18-month phased rollout [2]. The model is strong against data exploitation. It is only partly adequate against harms from AI and attention-driven design.

Strengths

• Profiling barred: platforms cannot track, behaviourally monitor or target ads at children. They also cannot carry out processing "likely to cause any detrimental effect" on a child's well-being [1].
• Deterrence: breaches of the child-related duties can attract penalties of up to ₹200 crore [2].
• Access preserved: processing for healthcare, education and real-time safety is exempt from consent [2].
• Flexibility: the government can notify a lower age threshold for platforms proven "verifiably safe" [1].

Gaps

• Data, not dose: autoplay, infinite scroll and late-night alerts need no personal data. So constant exposure, the core developmental harm, stays unregulated.
• One-time gate: a single consent click sets no limit on how many hours a child spends online, or at what time.
• Blunt 18-year line: teenagers may simply misstate their age, which switches off every safeguard. The OECD found that only two of 50 services used by children check age systematically at sign-up [3].
• Privacy paradox: to find the children, platforms must verify everyone's age, which piles up identity data.
• Education loophole: AI homework tools may shelter under the education exemption without any test of learning value.
• Consent literacy: first-generation users and shared devices weaken truly "informed" parental consent.

Way forward

• Design duties: MeitY rules for child-safe defaults, such as autoplay off and limits on notifications at night.
• Graded age bands with privacy-preserving age checks, drawing on the OECD's comparative review [4].
• Learning test: endorse EdTech and AI tools only where they clearly support learning outcomes [5].
• Parent literacy through schools and anganwadis.

Verifiable parental consent is therefore a necessary floor that blocks commercial exploitation of children's data, but it is not enough for the AI era. Adding design duties, age-graded protection and digital literacy would turn a privacy safeguard into a child-development safeguard. That would honour the Article 21 privacy right affirmed in Puttaswamy [2] and the child's best interests.