The DPDP Act, 2023 protects children's data but not children's minds. Critically evaluate this statement in the context of generative AI chatbots.

AI companions now act as emotional confidants for children because they are always available and seem to care. India's DPDP Act, 2023 and DPDP Rules, 2025 protect a child's personal data [1]. They do not regulate what a chatbot says to that child. Broadly, the statement holds, but with some qualifications.

How DPDP does protect children

• Verifiable consent from a parent or lawful guardian is needed before a child's data is processed, using age verification and virtual tokens [1].
• Tracking, behavioural monitoring and targeted advertising aimed at children are banned. Breaching duties towards children can attract penalties of up to ₹200 crore [1].
• Because profiling is restricted, platforms have less data with which to manipulate children.

Why it misses children's minds

• One-time consent: the parent's consent is checked once, at sign-up. Harm that builds up over months of conversation goes unnoticed. The 2025 death of US teenager Adam Raine was linked to his long conversations with ChatGPT [4].
• Wrong business model: the ad ban targets the sale of a child's attention. A companion bot can show no ads at all and still create emotional dependence.
• Content outside its scope: DPDP has no rules on crisis detection, self-harm referrals or manipulative replies.
• Parents left uninformed: after consenting, parents get no alerts about risky conversations.
• Policy choice: India's AI Governance Guidelines rely on existing laws and do not propose a standalone AI law [2]. Those laws were built for public content, not private one-to-one conversations.

Closing the gap

• India's framework already does not allow unrestricted use of high-risk AI [3]. MeitY could classify child-facing companion bots as high-risk.
• California's SB 1119 (Adam's Law) offers a model of design duties: crisis protocols with parental alerts, parental controls on by default, and independent audits [4].
• The AI Safety Institute proposed in the Guidelines [2] could set the audit standards. Crisis referrals could be linked to Tele-MANAS.

Overall, DPDP protects children's data well, but it was not designed for harms that build up inside a conversation. India can add design duties to its risk-based approach, choosing privacy-light age checks over a ban. That would put the best interests of the child at the centre of safe and trusted AI.