Guardian Consent

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), guardian consent refers to the consent provided by a parent or lawful guardian when a Data Fiduciary processes the personal data of a child. The Act recognizes children as individuals requiring additional protection and places specific obligations on organizations handling children’s personal data.

The DPDP Act defines a child as an individual who has not completed eighteen years of age. Before processing a child's personal data, a Data Fiduciary must obtain verifiable consent from the parent or lawful guardian. This ensures that processing involving children’s personal data is carried out with appropriate authorization and safeguards.

The DPDP Act includes specific obligations for processing children’s personal data, including obtaining verifiable parental consent and restrictions on certain types of processing that may harm the well-being of children. Organizations handling children’s personal data need to establish appropriate mechanisms to verify consent, maintain records, and ensure compliance with applicable obligations.

In practice, gaps emerge when:

• Organizations process children’s personal data without verifying parental consent.
• Consent mechanisms cannot distinguish between adult and child users.
• Parent or guardian verification processes are unclear or inconsistent.
• Consent records do not capture proof of authorization.
• Child-specific privacy requirements are not integrated into product workflows.

Organizations address these challenges by implementing age verification processes, establishing verifiable consent workflows, maintaining consent records, and applying child-specific privacy controls. Within Privy, capabilities such as consent management, consent tracking, workflow automation, and compliance reporting help organizations manage consent processes and maintain records related to Data Principal interactions.