The Ed-Tech Industry is structurally different from most of the sectors regulated by the Digital Personal Data Protection Act, 2023 (hereinafter “the act”) as its primary user base comprises children. Section 2(f) of the DPDP Act, 2023 defines “Child” as an individual who has not completed the age of 18 years of age and accords children a higher degree of protection under the statutory framework. Thus, the compliance obligations applicable to Ed-Tech platforms are primarily governed by Section 9 of the Act read with Rules 10 and 12 and the Fourth Schedule of the Digital Personal Data Protection Rules, 2025 (hereinafter the rules), which together constitutes the operative legal framework for processing of children's personal data. The provisions directly intersects with the manner in which Ed-Tech platforms are designed, particularly their user-registration processes, identity-verification mechanisms, data architectures, and analytics systems. This creates a distinct compliance challenge for B2C platforms, which commonly operate through frictionless digital onboarding and unified data environments containing both adult and minor users. At the same time, the exemptions applicable to educational institutions create a different compliance position for B2B Ed-Tech platforms operating as Data Processors.

1. Obligations of the Ed-Tech Platform and mechanics of verifiable Parental Consent.

Section 9(1) states that before processing any personal data of a child the Data Fiduciary (DF) must obtain verifiable consent of the parent, or of the lawful guardian, where the child is a person with disability. The mechanics of obtaining a verifiable parental consent are prescribed under Rule 10 of the rules. The said rule requires DF to adopt “appropriate technical and organisational measures” to obtain parental consent and observe due diligence in checking that the person identifying as a parent is an identifiable adult.

Rule 10 further provides two methods for carrying out this due diligence. The first method relies on existing reliable records available with the DF to verify that parent is an identifiable adult. This will apply when the parent is already a verified registered user of the platform, for instance a parent who completed a KYC-equivalent verification for a paid subscription. The second method relies on the details voluntarily provided by the parents, either directly or via a virtual token mapped to identity and age details, issued by an authorised entity. Rule 10(2)(b) defines an entity legally entrusted by the Central or State Government and expressly includes details verified and made available by a Digital Locker Service Providers, such as DigiLocker.

Apart from obtaining parental consent, Section 9 of the act imposes two additional obligations on Ed-tech platforms. First, the DF must not undertake processing which is likely to cause any detrimental effect on the well-being of a child. Secondly, the DF is prohibited from tracking or behavioural monitoring of children and targeted advertising at them, except when an exemption is available under the act and the rules.

2. Operational Reality of the compliance.

Unlike fintech or Health tech, Ed-Tech has no adjacent regulator whose identity verification it can borrow for section 9 compliance. Further UGC or AICTE are not concerned with identity verification, thus there is little possibility of sectoral overlap with this provision. The act applies to both B2B Ed-Tech Platforms, such as LMS, and B2C Ed-tech platforms, but the compliance requirements for both differ significantly due to the exemption from application of certain provisions of Section 9 provided in the Fourth Schedule to the rules. Part A, item 3 of the said schedule exempts education institutions from the obligations under section 9 when processing children's data for teaching and safety related purpose. Therefore, if a B2B Ed-Tech platform acts solely as Data processor for such institution, the obligation to obtain parental consent under Rule 10 shifts to Education Institution as the DF.

On the other hand, B2C Ed-Tech platforms face a qualitatively more difficult compliance challenge than B2B Ed-Tech companies as they do not have an institutional relationship that enables them to benefit from the exemptions provided under section 9. Consequently, this is likely to create several operational burdens for such platforms.

First, Section 9 read with Rule 10, require a verified and government-anchored proof of the consenting adult before any processing of the child's personal data. However, the exisiting B2C Ed-Tech model is built on the premise of a frictionless sign-up process, which is generally completed by the student rather than the parent through OTP-based login. Most Platforms do not have an existing integration with a government identity API (Application Programming Interface) or an alternative verification mechanism for parents who do not have access to Digilocker. As a result, compliance would require a complete redesign of the product architecture from the very first point of interaction with the user.

Second, Section 9 (3) read with the Fourth Schedule, requires that the behavioural data of the children must be kept separate from any processing done for tracking, profiling or targeted advertisement. This means that platforms must be able to identify children's data at every stage of processing and ensure that such data is excluded from the activity. A Large share of B2C Ed-Tech companies serves users spanning roughly from the age of 14-25, that is a mix of adults and minors.

However, most of the Ed-Tech platforms are built on unified data architecture where information of all the users is stored and analysed together for product development and machine learning purposes. Thus, separating children's data from the rest of dataset would not be a simple technical modification but would require a platform to identify and reclassify previously collected data, redesign their data management systems and review existing access control mechanisms. Therefore, complying with the requirement would require substantial changes to the existing data management infrastructure.

Lastly, Section 9(3) also prohibits DF from undertaking behavioural monitoring or tracking of children, except where the exemptions of Fourth Schedule apply. Further the platforms must ensure that the children's data is excluded from analytics, profiling or other behavioural tracking. However, since most of the Ed-Tech platforms are designed to collect behavioural data from all the users through a unified architecture without differentiating between adults and children. As a result, complying with the prohibition under section 9(3) would require platforms to redesign their analytical framework so that children's data is identified and excluded before any behavioural tracking happens. The conflicts between the requirements of Section 9 and the operational realities of the Ed-Tech platforms indicate towards a broader transformation required in the industry.

3. Future of Data Governance in the Ed-Tech Industry

The Indian Ed-Tech market was valued at USD 3.63 Billion in 2025 and is expected to reach USD 33 Billion by 2034. This growth is further supported by government initiatives like Digital India and increasing cost of accessing quality offline education. However, such growth cannot come at the cost of children or students' data being collected, processed and used without any adequate safeguards. In this regard Section 9 read with Rule 10 and 12, provide an important legal framework to ensure that children's personal data is processed responsibly and is likely to play a significant role in shaping the future of Ed-Tech industry.

The Legal paradigm will require the structural changes in the manner in which Ed-Tech platforms are designed to collect and process children's personal data. Rule 10 permits the use of tokens issued by government authorities to verify that the consenting individual is both an adult and the parent of the child. Accordingly, a parent may establish their identity and parental status through a DigiLocker-issued token, without requiring the Ed-Tech platform to access or retain the underlying identification document. For parents who do not have access to DigiLocker, Ed-Tech platforms may provide assisted verification mechanisms, including video-based verification similar to processes employed in e-KYC. Further, platforms should apply the principle of data minimisation throughout the data lifecycle, ensuring that only data strictly necessary for the relevant purpose is processed. This would help prevent the use of children's data that, while potentially useful for behavioural analytics, is not necessary for the provision of the educational service.

the effectiveness of Section 9 and the corresponding paradigm will depend on whether this transition from procedural compliance to privacy-by-design can be achieved without undermining the accessibility and utility of digital education. The regulatory objective should be to allow Ed-Tech platforms to use data for legitimate educational purposes while preventing the excessive collection, profiling and commercial exploitation of children's information. As the Indian Ed-Tech sector continues to expand, integrating these safeguards into the technological and organisational architecture of platforms will be essential to ensuring that digital innovation in education develops alongside, rather than at the expense of, meaningful protection of children's personal data.

Author is an Advocate practicing in Delhi. Views are personal.