The exemption schools have does not travel to their vendors

EdTech is the sector where the DPDP Act's children's provisions stop being a compliance annexe and become the product question. If your learners are at school, nearly all of them have not completed eighteen years, which makes them children under Sec. 2 — and children are the case Sec. 9 is written about.

What Sec. 9 actually forbids

Three things, and the third is the one that reshapes a roadmap.

Verifiable parental consent is required before processing a child's personal data. Processing likely to have a detrimental effect on a child's well-being is prohibited. And tracking, behavioural monitoring and targeted advertising directed at children are prohibited outright — not consented around, prohibited.

That last one has no consent switch. A parent cannot authorise behavioural monitoring of their child by ticking a box, because Sec. 9(3) is not a consent requirement.

The exemption, and where it stops

Sec. 9(4) lets the Rules carve out classes of Data Fiduciary, and Rule 12 with the Fourth Schedule does. Educational institutions are relieved of verifiable parental consent and of the tracking prohibition, confined to processing for educational activities and the safety of enrolled students. Crèches, childcare centres and school transport providers get similar, equally narrow relief.

Read the shape of that carefully, because it is the commercial fact in this page. The exemptions are drawn by entity and by purpose. A school inside the carve-out is doing something the Rules name. A vendor processing the same children's data for engagement scoring, retention modelling, recommendation tuning or product analytics is doing something the Rules do not name, for a purpose that is not the child's education or safety.

"Our customer is an exempt institution" is not a defence available to the vendor. The question is what you are processing and why.

What this leaves you able to build

Plenty, and it is worth stating rather than only listing prohibitions. Delivering lessons, marking work, reporting progress to a school or a parent, keeping a learner safe, and operating the service the institution bought — all of that sits inside educational activity. Aggregate and de-identified analysis that does not amount to monitoring an identifiable child is a different matter from behavioural monitoring.

What has to change is usually the same three things: personalisation engines that profile individual children, third-party analytics and advertising SDKs in a product used by under-eighteens, and data flowing to partners on a contract written before anyone read Sec. 9.

Age is a data problem before it is a legal one

The obligation follows the individual. A platform selling to both schools and universities has children and adults in one database, and cannot apply Sec. 9 to the right subset without knowing which is which — reliably, at the record level, with the answer recorded rather than assumed.

Most edtech systems were not built to hold that. Adding it late means backfilling age or school context across every learner, and every downstream system that received their data.

Where the notice actually has to appear

To the parent or lawful guardian, before processing, in a language they read — Sec. 5 with the Eighth Schedule right. Not to the school as a proxy. Where an institution collects on your behalf, the arrangement between you needs to say who gives the notice and who holds the evidence that it was given, because the Board will ask one of you for it.