Protecting The Digital Child: Consent, Safety, And Regulatory Obligations Under The Dpdpa, 2023

Abstract

The Digital Personal Data Protection Act, 2023 (hereinafter DPDPA or the Act ) represents India s first comprehensive legislative response to the challenges of personal data governance in the digital age. While the Act introduces certain child-specific provisions, it falls considerably short of offering a robust, rights- based framework for the protection of children in the digital ecosystem. This chapter undertakes a critical doctrinal, comparative, and policy analysis of three interrelated dimensions of child data protection: the consent mechanism under the DPDPA, the regulatory obligations imposed upon data fiduciaries in relation to children s online safety, and the significant legislative gaps that leave the digital child inadequately protected. Drawing upon constitutional jurisprudence, comparative frameworks from the European Union, the United States, and the United Kingdom, and the normative standards of the United Nations Convention on the Rights of the Child, the chapter argues that the DPDPA treats child data protection as a peripheral concern rather than a foundational imperative. It calls for the enactment of a dedicated children s online safety and data protection legislation, the institutionalisation of a Children’s Digital Rights Commissioner, and the adoption of age-appropriate design standards as legally binding obligations in India.