A child is an individual who has not completed eighteen years (section 2). Before processing a child's personal data, a Data Fiduciary must obtain verifiable consent of the parent (section 9).
How parental consent is verified
The Data Fiduciary must check that the person identifying herself as the parent is an adult who is identifiable, by reference to reliable identity and age details it already holds, or to details or a virtual token issued by an authorised entity, including through a Digital Locker service provider (rule 10).
What is not allowed
- Processing likely to cause any detrimental effect on the well-being of a child (section 9).
- Tracking or behavioural monitoring of children, or targeted advertising directed at children (section 9).
Exemptions
The parental consent requirement and the tracking and advertising ban do not apply to certain classes, such as clinical establishments, healthcare professionals, educational institutions, creches and child transport providers, or to certain purposes, such as real-time location for safety, subject to conditions in the Fourth Schedule (rule 12, Fourth Schedule). The detrimental effect rule in section 9(2) is not exempted by rule 12.
Persons with disability who have a lawful guardian are covered by the same consent requirement; rule 11 sets how to verify the guardian (rule 11).
These provisions come into force on 13 May 2027.