Adaptive Learning and DPDPA's Ban on Behavioural Monitoring of Children

The product watches the child. The law watches the product.

The scene

The engagement dashboard ranked students by ‘drop-off risk’: hesitation time, rewinds, late-night sessions. The sales team used the same signals to time upgrade offers to parents. Two teams, one data stream, one child.

Where the thinking breaks

The unclear thought What it breaks The clearer thought

Learning analytics aren't tracking.

Behavioural monitoring of children is restricted unless an exemption in the Rules applies.

Identify the exemption for each signal, or stop collecting it.

Ads to parents aren't ads to children.

Targeting built on a child's behaviour is still directed by that behaviour.

Never let child telemetry feed commercial targeting.

Proctoring

Camera and screen monitoring during exams is behavioural monitoring. Where used, limit it to the exam, keep it no longer than the result needs, and never repurpose it.

Monday morning

01 List every behavioural signal collected from under-18s.

02 Mark which feed learning and which feed revenue.

03 Cut the link between the two.

Questions, answered plainly

Does DPDPA ban adaptive learning for children? +

Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions notified in the Rules. Adaptive features must fit within an exemption or be redesigned.

Is online exam proctoring allowed under DPDPA? +

Proctoring involves monitoring. For children it must fit the Section 9 framework and any Rules exemption, be limited to its purpose, and be secured and erased appropriately.

Sector · EdTech A child's data is not a cookie. Stop treating it like one. Read →

EdTech & children's data · Deep dive A tick from a twelve-year-old is not a parent's consent. Read →

EdTech & children's data · Deep dive The exemption follows the purpose, not the product. Read →

Tell us where your data sits. We'll show you where the exposure is.

A partner replies within one working day, with a first view on your penalty exposure.

Speak to a partner →

Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).