Section 9 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
Section 9(2) bars any processing of a child's personal data that is likely to cause a detrimental effect on the child's well-being. Section 9(3) bars tracking or behavioural monitoring of children and targeted advertising directed at children. These apply on top of parental consent under section 9(1). For a review of your child-facing features, see our legal consultation service.
A Data Fiduciary shall not undertake processing of a child's personal data that is likely to cause any detrimental effect on the well-being of a child (section 9(2)), and shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children (section 9(3)). Parental consent does not cure these prohibitions. Breach may attract a penalty up to Rs 200 crore (Schedule, item 3).
Sub-sections (2) and (3) at a glance
| Sub-section | Prohibition | Can section 9(4) or (5) lift it? |
|---|---|---|
| 9(2) | Processing likely to cause any detrimental effect on the well-being of a child | No. Section 9(4) and (5) refer only to sub-sections (1) and (3) |
| 9(3) | Tracking or behavioural monitoring of children; targeted advertising directed at children | Yes, by prescription under 9(4) or notification under 9(5) |
Section 9(2): detrimental effect on well-being
The wording is broad: "such processing of personal data that is likely to cause any detrimental effect on the well-being of a child". Four points:
- "Likely". The fiduciary does not have to wait for actual harm. The test looks at the processing and what it is likely to cause.
- "Any detrimental effect". No minimum level of harm is stated.
- "Well-being" is not defined. The Act does not say whether it means physical, mental, emotional, financial or social. Read it widely and by ordinary meaning.
- Consent is no defence. Section 9(1) asks for the parent's consent; section 9(2) is a separate bar. Even if the parent has consented, processing likely to harm the child's well-being is still prohibited.
Unlike many other obligations, this one is framed as an outcome to be avoided, not a procedure to be followed. So design choices matter: features that push a child towards compulsive use, expose her to strangers, or share data in ways that can harm her are the kinds of thing a fiduciary should assess. The Act does not list them, so the examples here are illustrations of how to think about the test, not statutory categories.
Section 9(3): three separate prohibitions
Section 9(3) reads: "A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children." That gives three things:
- Tracking of children.
- Behavioural monitoring of children.
- Targeted advertising directed at children.
The Act defines none of the three terms. Ordinary meaning suggests: tracking is following a child's activity or location; behavioural monitoring is observing and recording what she does and how, usually to build a profile; targeted advertising is selecting advertisements to show her based on her data or behaviour. Advertising is not banned as such. A general advertisement, shown to everyone on a page regardless of who the viewer is, is not "targeted" in that sense. The prohibition is about targeting advertisements at children using data about them. The statute leaves the line for the Board or rules to draw, so be conservative.
Note that the prohibition is on the Data Fiduciary undertaking these activities "of children". A service aimed at children, or one that knows a user is a child, is the clear case. A general-audience service faces the harder question of whether it can identify child users, and section 9(1) already requires it to have a way to find out, since it must obtain parental consent before processing their data.
Why this differs from consent
Most DPDP obligations turn on consent or notice. A Data Principal's consent can legitimise a great deal of processing. Section 9(2) and (3) are prohibitions. They reduce the value of consent in the child context: a parent cannot, in the text of the Act, authorise tracking or targeted advertising directed at her child, unless an exemption applies under section 9(4) or (5).
Exemptions: which sub-sections, and what the Act says
Section 9(4) says that sub-sections (1) and (3) do not apply to processing of a child's personal data by such classes of Data Fiduciaries or for such purposes, subject to such conditions, as may be prescribed. Section 9(5) lets the Central Government, if satisfied that a Data Fiduciary has ensured that its processing of children's data is done in a manner that is verifiably safe, notify an age above which that Data Fiduciary is exempt from all or any of the obligations under sub-sections (1) and (3).
The key reading: neither provision mentions sub-section (2). Even where an exemption from tracking or parental consent exists, the ban on processing likely to cause a detrimental effect on the well-being of a child remains on the text. See exemptions for children's processing. The DPDP Rules, 2025 (notified November 2025) prescribe the detail and different provisions commence on different dates; check the Rules for any class or purpose they provide.
Who it binds
The Data Fiduciary, for its own processing and for processing on its behalf by a Data Processor under section 8(1). Processors should be told by contract not to profile or target child users.
Consequence of breach
Item 3 of the Schedule covers breach in observance of additional obligations in relation to children under section 9, and the penalty may extend to two hundred crore rupees. The Board imposes it only after an inquiry, a hearing and a finding that the breach is significant (section 33(1)), weighing the section 33(2) factors, such as the nature of the data affected, the gain realised and mitigation. See penalties and the overview on children's data protection.
Practical examples
Example 1: kids' game with personalised ads. A game for children shows adverts chosen using each child's play patterns. That is targeted advertising directed at children under section 9(3), unless an exemption applies.
Example 2: location sharing. A children's app tracks live location and shares it in a public feed. That raises section 9(3) on tracking and possibly section 9(2) on well-being.
Example 3: parent consents to tracking. A parent ticks a box agreeing to behavioural monitoring of her child. The text of section 9(3) does not make an exception for parental consent.
Common mistakes
- Thinking parental consent allows tracking or targeting.
- Assuming the ban applies only to apps labelled "for kids".
- Overlooking analytics and ad-tech software development kits that profile users.
- Forgetting that section 9(2) is not removed by any exemption in section 9(4) or (5).
Need help reviewing child-facing features?
If your product may be used by children, a review of tracking, analytics and advertising tools against section 9 is worth doing early. We can do this with you through our legal consultation service.
Key takeaways
- Section 9(2) prohibits processing likely to cause any detrimental effect on a child's well-being.
- Section 9(3) prohibits tracking, behavioural monitoring and targeted advertising directed at children.
- Parental consent under section 9(1) does not authorise either.
- Section 9(4) and (5) exemptions refer to sub-sections (1) and (3), not (2).
- Penalty may extend to Rs 200 crore (Schedule, item 3).
Read next
- Section 9 of the DPDP Act, 2023: verifiable parental consent
- Section 9 of the DPDP Act, 2023: exemptions for children's processing
- Section 33 of the DPDP Act, 2023: monetary penalty and factors to consider
- Children's data protection under section 9
Disclaimer: Based on the Digital Personal Data Protection Act, 2023 (official text as enacted, No. 22 of 2023) as on 30 September 2026. The DPDP Rules, 2025 were notified in November 2025 and different provisions commence on different dates; this article does not state rule-level detail. Verify the current position in the Rules and the commencement notifications before acting.