Children celebrating annual day, holding trophies, at their desks or smiling at the camera have become staples of school websites and social media feeds.
Yet many of these photographs and videos are posted without verifiable parental consent, potentially violating the Digital Personal Data Protection (DPDP) Act, 2023, and exposing children to privacy breaches, online abuse and legal risks.
The DPDP Act governs how organisations collect, use, store and share personal data. It classifies anyone below 18 as a child and mandates verifiable parental consent before processing a child's personal data.
Schools, coaching centres, edtech companies, hospitals, banks, employers and social media platforms all fall within its ambit.
Yet compliance in India remains patchy.
“Only about 30–35% of schools take the regulation seriously,” said Sharmishtha Gupta, former head of schools and an independent education consultant based in Delhi NCR. “Even among those, there is little clarity about the scope of the consent obtained, as many rely on vague blanket permissions that do not specify commercial use or publicity.”
Globally, governments are tightening safeguards for children’s online lives as concerns extend beyond cyberbullying to grooming, harmful content, scams and the misuse of children's digital identities. Australia last year passed a law requiring major social media platforms to prevent children under 16 from having accounts, regardless of parental consent. France and the UK have advanced measures to curb children’s exposure to social media, while Karnataka has proposed restrictions on social media access for under-16s. The risks are no longer theoretical.
When an Uttar Pradesh student topped her Class X board examinations in 2024, her school’s celebratory posts quickly spiralled into online abuse as strangers mocked her appearance, created memes and subjected her to trolling. “In my case, no consent was obtained before publicising my academic achievement,” she told ET.
