Child Data Rules Redraw the Duties of India’s Ed Tech Platforms

Consent alone no longer appears sufficient to govern the use of children's data by ed tech platforms in India. The Digital Personal Data Protection rules have created a more demanding standard for companies whose services collect information from children or are used by them. The immediate rupture is contractual and operational: businesses must reconsider what information they collect, how they use it and what safeguards they can demonstrate to parents, schools and regulators.

The underlying tension arises from a mismatch between the commercial reach of digital learning and the limited capacity of children to evaluate privacy risks. Consent may be formal without being meaningful, especially when it is bundled into terms of service or supplied by adults who do not know precisely how the data is handled. The rules therefore place institutions and platforms under a broader obligation to account for age, context and power. Parents gain a stronger basis for questioning intrusive collection, while providers face systems designed to establish informed consent and restrict uses that cannot be justified.

The downstream cost will divide the market between firms prepared to redesign their products and those that continue to depend on weakly governed data practices. The winners may be platforms able to prove their compliance; the casualties may include smaller services unable to absorb legal review, consent systems and security controls. Within a year, ed tech companies are likely to make age assurance, parental controls and data minimisation central features of their offer, while families and schools gain leverage over services that once treated children's information as ordinary commercial material.