Protecting children in the digital age

“Privacy is not an option, and it shouldn’t be the price we accept for just getting on the Internet.” - Gary Kovacs

Children today are entering the digital world at an early age. Smartphones, online gaming platforms, social media applications and virtual classrooms have become an inseparable part of childhood. The COVID-19 pandemic further accelerated this transition, pushing millions of students towards online learning and digital interaction. While technology has undoubtedly expanded access to education and communication, it has also exposed children to unprecedented risks in the digital sphere.

A growing number of children are unknowingly sharing personal information across gaming platforms, social media applications and educational websites. In many cases, neither children nor parents fully understand how such data is collected, stored and used. The rise of targeted advertising, behavioural tracking and online fraud has made children one of the most vulnerable groups in the data-driven economy. In this context, the Digital Personal Data Protection (DPDP) Act, 2023, assumes critical importance.

The DPDP Act, 2023, is India’s primary law governing how personal data is collected, stored and used in the digital space. Under this framework, a Data Principal refers to the individual whose data is being processed, while a Data Fiduciary is the entity (such as an app, platform, or organisation) that collects and uses that data.

Under Section 9 of the said Act, special safeguards are provided for children’s online data. It mandates that digital platforms and data handlers must obtain verifiable consent from a parent or lawful guardian before processing any personal data of a child. It also restricts practices such as behavioural tracking, targeted advertising, and any processing that may adversely impact a child’s well-being. In principle, these provisions aim to ensure that children are not reduced to data sources for commercial exploitation and are protected from manipulative digital practices.

While the intent of the DPDP Act, 2023, is clearly protective, its implementation in the context of children raises practical concerns. The idea of “verifiable parental consent” assumes a level of digital awareness and supervision that may not exist uniformly across households. In reality, many parents themselves are not fully aware of how digital platforms collect and use personal data, and consent is often given mechanically through quick approvals rather than informed understanding.

At the same time, children today are active users of online games, social media platforms, and EdTech applications, many of which are designed to encourage constant engagement. In such an environment, distinguishing between meaningful consent and routine digital acceptance becomes increasingly difficult. This creates a gap between the law’s intention and its real-world effectiveness.

A significant part of this challenge emerges from the rapid digitisation of education itself. Schools and EdTech platforms today rely heavily on digital tools for attendance tracking, assignments, assessments, and communication with parents. While these systems have improved access and efficiency, they have also led to the large-scale collection of children’s personal data, often without a clear understanding among students or even parents of how this information is stored or used.

Many educational applications collect behavioural data such as login patterns, time spent on tasks, performance analytics, and interaction history. In some cases, this data is used not just for academic tracking but also for product improvement and user engagement strategies. This raises an important concern: data generated in the classroom is increasingly becoming part of a broader digital ecosystem, where the boundaries between education and data profiling are becoming blurred.

Beyond education platforms, children’s digital exposure is also shaped heavily by social media applications and online gaming environments. These platforms are designed around engagement-driven algorithms that encourage prolonged usage, often by analysing user behaviour and preferences. For children, this translates into continuous exposure to content tailored to keep them engaged, sometimes without a clear understanding of how these systems operate.

In such ecosystems, behavioural tracking becomes routine. Every click, interaction, and viewing pattern contributes to a digital profile that can be used to predict and influence future behaviour. The DPDP Act, 2023, seeks to restrict targeted advertising and tracking for children; however, enforcing these boundaries in fast-moving digital environments remains a significant challenge. The result is a space where children are active participants, yet largely unaware subjects of extensive data collection. The challenge, therefore, is not merely about the existence of a robust legal framework such as the Digital Personal Data Protection Act, 2023, but about ensuring its meaningful implementation in a rapidly evolving digital ecosystem. Protecting children online cannot depend only on formal consent mechanisms; it must also be supported by greater digital literacy among parents, educators, and children themselves. Schools and educational institutions must be encouraged to adopt transparent data practices, while platforms must be held accountable for designing child-centric and privacy-respecting systems by default. At the same time, awareness around digital footprints and data sharing must become an essential part of early education. Without these complementary measures, the idea of “verifiable consent” risks becoming a procedural formality rather than a genuine safeguard.

Safeguarding children’s digital presence requires a collective effort where law, education, and technology work in alignment. It is only then that India can ensure that its youngest internet users are not merely participants in the digital world but are also adequately protected within it.

The writer is a Post Graduate in Law (LLM) from NLSIU, Bangalore and pursuing PhD in Cyber Laws from RGNUL Patiala; Views presented are personal.