DPDP for EdTech & Schools (2026): Age Gates, Parental Consent & No Child Ads

How Indian schools, universities, coaching, and EdTech platforms meet DPDP — age gates, verifiable parental consent, bans on behavioural tracking and targeted ads to children, LMS vendor maps, and parent DSRs.

Answer in one line: EdTech and education fiduciaries must age-gate learners, obtain verifiable parental consent for under-18s, disable behavioural tracking and targeted ads to children, map LMS/payment/proctoring vendors, and honour parent or learner DSRs with cascade to processors.

Drawn from the EdTech industry map in the DPDP Handbook.

Why education is a children's-data hotspot

Learning products routinely process minors' names, phones, performance, biometrics for proctoring, and parent contacts. Growth loops that copy consumer SaaS (pixels, retargeting) collide with DPDP duties for children.

Figure 1 — School / EdTech data streams

Figure 1. EdTech / school — age gate, parental consent, vendors, erase on exit

flowchart TD
  HUB([School / EdTech / coaching / university]) --> L1[Learner accounts]
  HUB --> L2[Parent / guardian contacts]
  HUB --> L3[Teachers / staff HR]
  HUB --> L4[Visitors / campus CCTV]
  HUB --> L5[Vendors: LMS / payments / proctoring]
  L1 --> AGE{Age gate}
  AGE -->|Under 18| PAR[Verifiable parental consent]
  AGE -->|18+| STD[Standard Sec 6 consent]
  PAR --> RULES[No behavioural tracking]
  RULES --> ADS[No targeted ads to children]
  STD --> VAULT[(Consent + age register)]
  ADS --> VAULT
  L2 --> VAULT
  L3 --> HR[Employment notice + basis]
  L4 --> VIS[Visitor / CCTV notice]
  L5 --> DPA[DPA + sub-processor map]
  HR --> VAULT
  VIS --> VAULT
  DPA --> VAULT
  VAULT --> DEL[Deliver learning - minimal data]
  DEL --> END{Exit / graduate / withdraw?}
  END -->|Yes| CAS([Erase or restrict + cascade])
  END -->|No| DEL
  class HUB,L1,L2,L3,L4,L5,PAR,STD,RULES,ADS,HR,VIS,DPA,DEL act;
  class AGE,END dec;
  class VAULT start;
  class CAS ok;
  classDef start fill:#DBEAFE,stroke:#2563eb,color:#0f172a;
  classDef act fill:#EFF6FF,stroke:#3B82F6,color:#1e3a8a;
  classDef dec fill:#FEF3C7,stroke:#D97706,color:#78350f;
  classDef ok fill:#D1FAE5,stroke:#059669,color:#064e3b;
  classDef stop fill:#FEE2E2,stroke:#DC2626,color:#7f1d1d;
  classDef note fill:#F1F5F9,stroke:#64748B,color:#334155;

Design rules for product and admissions

Age gate before account creation; store verification evidence.
Under 18: verifiable parental consent; no behavioural ads or tracking for children.
Parents and staff are separate streams with their own notices.
Proctoring and payments vendors need DPAs and a sub-processor map.
On graduate / withdraw / exit: erase or restrict and cascade.

Figure 2 — Parent / learner DSR handling

Figure 2. EdTech data principal rights — verify, fulfil, log, escalate

flowchart TD
  A([DSR from parent or learner]) --> B{Identity verified?}
  B -->|No| R[Ask for more info]
  R --> B
  B -->|Yes| C{Which right?}
  C -->|Access| D[Data summary + sharing list]
  C -->|Correct / Erase| E[Update or delete + notify LMS vendors]
  C -->|Grievance| F[Route to privacy officer]
  D --> H[Respond in published SLA]
  E --> H
  F --> H
  H --> I([Log outcome in DSR register])
  I --> J{Unsatisfied?}
  J -->|Yes| L([Escalate to Board])
  J -->|No| M([Closed - keep evidence])
  class A,D,E,F,H,R act;
  class B,C,J dec;
  class M ok;
  class L stop;
  classDef start fill:#DBEAFE,stroke:#2563eb,color:#0f172a;
  classDef act fill:#EFF6FF,stroke:#3B82F6,color:#1e3a8a;
  classDef dec fill:#FEF3C7,stroke:#D97706,color:#78350f;
  classDef ok fill:#D1FAE5,stroke:#059669,color:#064e3b;
  classDef stop fill:#FEE2E2,stroke:#DC2626,color:#7f1d1d;
  classDef note fill:#F1F5F9,stroke:#64748B,color:#334155;

EdTech checklist

Audit every analytics SDK on learner surfaces for under-18 traffic.
Rewrite notices in plain language for parents (and regional languages where needed).
Publish a parent-facing DSR / grievance form with SLA.
Contract-review LMS, payments, and proctoring for deletion APIs.
Align campus CCTV / visitor notices with short retention.

FAQ

Is school WhatsApp broadcasting parental consent?

Broadcast lists need a clear purpose and lawful basis. Prefer documented consent or school-official channels with opt-out — not scraped parent numbers.

Can we retarget drop-off students under 18?

Targeted advertising and behavioural tracking aimed at children is not a safe growth tactic under DPDP. Use parent-approved, purpose-limited messaging instead.

Who is the data principal — child or parent?

The child is the data principal; the parent/guardian provides consent and often exercises rights on their behalf until majority.

Where can we see the full education diagram?

DPDP Handbook and related training paths for school and EdTech operators.