DPDPA Compliance for EdTech Companies
Student data. Parental consent. Behavioural tracking. EdTech companies carry some of the strictest DPDPA obligations in India — and most have never verified whether their current practices meet them.
Why EdTech obligations under DPDPA are categorically different
Most DPDPA obligations apply uniformly across sectors. Section 9 creates a separate, stricter framework that applies specifically where platforms process data of minor users.
Section 9(1) requires verifiable consent from the parent or lawful guardian before processing any personal data of a child. A self-declared date of birth, a ticked checkbox, or a school enrolment form may not satisfy the verifiable standard — the verification must genuinely confirm the consenting adult is the parent or guardian.
Section 9(3) creates restrictions that apply even where valid parental consent has been obtained. Behavioural monitoring of minor users, tracking of online activity, and targeted advertising directed at children may fall within these prohibitions — meaning parental consent alone does not create a valid processing basis for these activities.
In many institutional deployment models, the school may act as the data fiduciary while the EdTech platform operates as a processor. The platform's Data Processing Agreement with the school must specifically address how Section 9 compliance is achieved — most school contracts used by EdTech companies do not address this at all.
What Section 9 requires — and what it restricts
Each requirement below maps to a specific operational obligation under the Act. These are not aspirational standards — they are current obligations that apply to any platform processing data of users under 18.
Verifiable consent from the parent or guardian must be obtained before the platform processes any personal data of a minor — including data collected during the signup process itself. Self-declared age fields and school enrolment do not satisfy this standard.
Parents and guardians have rights to access their child's data, request correction, and seek erasure. EdTech platforms must have operational processes for handling these requests — including a mechanism to verify parental identity and relationship to the child account.
Screen time tracking, keystroke logging, click pattern analysis, and session recording of minor users are likely to fall within Section 9(3)'s restrictions — regardless of whether parental consent has been obtained. Platforms using these for adaptive learning or engagement scoring need to assess their implementation carefully.
Restriction applies even where parental consent exists.
Serving targeted advertisements to minor users — whether based on behavioural data, demographic inference, or interest profiling — may fall within Section 9(3)'s prohibitions. This applies to platforms that monetise through advertising or serve third-party ad networks on student-facing pages.
Restriction applies even where parental consent exists.
The gaps Privara finds most consistently in EdTech assessments
Identified through review of live consent flows, analytics configurations, school contracts, and data principal rights processes.
A date of birth field where the user enters their own birth date — without any verification. A minor who enters a false date of birth does not thereby create a valid consent basis for the platform. Under Section 9(1), verification must genuinely confirm the consenting adult is the parent or guardian — self-declaration by the child does not satisfy this.
Behavioural analytics tools, session recorders, and engagement trackers operating on student-facing pages — processing minor user data without verifiable parental consent having been obtained, and potentially within the scope of Section 9(3)'s restrictions on behavioural monitoring regardless of consent status.
Data Processing Agreements between the EdTech platform and schools that do not specify how verifiable parental consent is obtained, who is responsible for obtaining it, or how Section 9(3) restrictions are observed in the platform's technical implementation. Without this, both the school and the platform carry unaddressed compliance exposure.
Using quiz performance, completion rates, and engagement signals to generate personalised content recommendations — without disclosing this processing in the privacy notice or assessing whether it falls within Section 9(3)'s restrictions on behavioural monitoring of minor users.
No operational process for parents to verify their relationship to a child account, access their child's personal data, or request erasure. This gap is consistently present across EdTech products reviewed — most platforms have no parent-facing rights portal or documented process for handling these requests.
No mechanism to identify when a child user reaches 18, transition them from parental consent to direct consent, and obtain fresh direct consent for all processing purposes. Most EdTech platforms have no age-tracking or consent transition workflow — meaning users who have aged out of the minor-user regime continue to be governed by parental consent that is no longer appropriate.
What a compliant EdTech consent flow requires
What a finding looks like in an EdTech assessment
During a review of an EdTech platform's student-facing product, a third-party behavioural analytics tool was found to be active on all student session pages — tracking page views, time-on-task, click patterns, and quiz interaction data at the individual user level.
The platform's registration flow asked students to enter their date of birth. Users under 18 were shown a message asking them to provide their parent's email address. A consent email was sent — but the parent's identity was not verified beyond email access. No documentation existed confirming that parents had actually completed the consent flow before the analytics tool began processing student data.
The finding was documented with the specific Section 9 obligations engaged, an assessment of whether the analytics processing was likely to fall within Section 9(3)'s behavioural monitoring restrictions, and the operational changes required to bring the consent flow into compliance.
Section 9 obligations affect every aspect of an EdTech product — consent architecture, analytics configuration, school contracts, and parental rights processes. This cross-functional complexity requires a comprehensive assessment that covers all eight DPDPA control areas with specific depth on Section 9 obligations, vendor contracts, and data principal rights processes.
For early-stage EdTech platforms with limited vendor complexity, the Readiness Review may be an appropriate starting point.
Questions from EdTech founders and product teams
Understand your EdTech platform's Section 9 compliance posture
The scoping conversation is focused and practical. We will identify where your platform's current practices may not meet Section 9's requirements — before anything is agreed.
Book a Scoping ConversationScope and pricing confirmed before work begins. No commitment required.