TALAMANA · THE AI LITERACY MAP FOR ARCHITECTURE AND DESIGN · Foundations · AGE 11—17 · FACTUAL · EVOLVING
You are a child in the data law
India's data law calls you a child until eighteen and needs a parent's consent.
The idea
India has a law about personal data: the Digital Personal Data Protection Act, 2023. It says a child is anyone who has not completed eighteen years. If you are at school, the law is talking about you. Before a company uses a child's personal data — stores it, studies it, shares it — it needs checkable consent from a parent or guardian. Companies must not track what children do or aim advertisements at them. The Act was passed in August 2023. The Rules came in November 2025, and the duties on companies are scheduled to start in May 2027.
Why it matters
Every app you sign up for asks for something — a name, a birthday, a photo. Today most of them ask you, not your parent. The law says that should change. Knowing the rule is how you notice when it is not being followed.
See it in the studio
Your class is using an image tool for a model-making project. The sign-up page asks for your date of birth. You type it in. Nobody asks your parents anything. Under the Act, the tool is supposed to get a parent's consent first. From May 2027 that rule is scheduled to have teeth.
Watch for this
Hearing "the law protects you" and thinking "so I am protected today". The law was passed in 2023. The duties on companies start in 2027. In between, the habit from YOUR DATA still does the work: think before you upload.
Try it
Pick one app you use. Find the age it asks you to be. Then ask a parent: did anyone ask you before I signed up? Write the two answers next to each other.
Prove it
Say what the law calls a child, what a company needs before it uses a child's data, and whether that rule has started yet.
How it works
The Act defines a child in section 2(f): an individual who has not completed eighteen years. Section 9 does three things. A company that handles your data (the law calls it a Data Fiduciary) must get verifiable consent from the parent or lawful guardian before processing a child's personal data. It must not process that data in a way likely to harm the child's well-being. And it must not track children, monitor their behaviour, or target advertising at them. The Rules of November 2025 say how a parent's consent is checked — from identity details the company already holds, from details the parent gives, or from a digital token issued by an authorised provider — and they exempt some people, such as schools and doctors, for specific purposes. Section 1(2) of the Act lets the government start different parts on different dates. The Rules give companies eighteen months from publication for their duties, which lands in May 2027. That is why this card is EVOLVING: the words are settled, the start date is ahead of us, and a date can move. Check the law as it stands, not this card's note about it.
What this idea builds on
What this idea opens up
- Nothing yet names this as a foundation.
Sources
Open this idea on the map · The complete map · Logika · RBDS AI Lab, India · revised every edition.