Red Flag for India: Children’s Data Exposed to Exploiters on AI Platforms

A recent report released by the Centre for Law and Critical Emerging Technologies at the Advanced Study Institute of Asia (ASIA), titled “DPDP Compliance in Respect to Children Data,” highlights alarming gaps in how leading AI platforms handle children’s data in India.

 

The report raises urgent concerns regarding the lack of compliance with the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act), particularly in relation to minors (individuals under 18 years of age). It calls for stronger regulatory oversight and immediate corrective measures to ensure the safety and privacy of young users.

India’s DPDP compliance framework follows a phased implementation of the DPDP Rules 2025 over an 18-month timeline, expected to conclude by May 2027. While initial efforts focus on regulatory bodies, subsequent phases mandate the deployment of consent managers, data auditing systems, and breach notification mechanisms. The report critically evaluates the preparedness of platforms as the compliance deadline approaches.

 

The study analysed 14 widely used AI platforms, including government-backed educational tools such as DIKSHA and SATHEE, as well as global services like ChatGPT, Khan Academy, WhatsApp, and Instagram. The findings reveal that over 70% of key compliance requirements are currently unmet—particularly in areas such as verifiable parental consent, robust age verification, and child-sensitive data practices.

 

Platforms were categorized into four risk tiers based on their level of compliance:

 

Very High Risk (89–100%): Instagram, xAI Grok, Canva, ChatGPT, Perplexity, WhatsApp

High Risk (79–86%): Gemini, NotebookLM, Microsoft Math Solver, Claude (Anthropic)

Medium Risk (64–75%): Photomath, Khan Academy, SATHEE (IIT Kanpur)

Low Risk (46%): DIKSHA (Ministry of Education)

A majority of platforms fall within the high and very high-risk categories, indicating widespread systemic non-compliance. DIKSHA remains the only platform in the low-risk category, reflecting relatively better alignment with its educational mandate.

 

The report identifies several critical concerns, including:

 

A significant mismatch between platform-defined minimum age limits and India’s legal definition of a child (under 18), resulting in a regulatory gap

Over-reliance on self-declared age inputs rather than robust verification mechanisms

Weak parental consent frameworks that fail to meet legal standards

Limited availability of privacy notices in regional languages, reducing accessibility for non-English-speaking users

Gaps in government platforms that serve millions but lack adequate child protection safeguards

The findings also highlight that core platform features such as behavioural tracking, personalization, and analytics may directly conflict with DPDP provisions that restrict monitoring of children’s online behaviour.

 

The report underscores that these systemic shortcomings pose serious risks to millions of young users in India. It urges regulators, industry stakeholders, and policymakers to take immediate action by issuing clear compliance directives, implementing stronger verification systems, and prioritizing the protection of children’s digital rights.

 

As India accelerates its adoption of AI-driven platforms in education and social engagement, ensuring the safety and privacy of minors must remain a top priority. This report serves as a critical wake-up call for both regulators and technology companies to strengthen accountability and safeguard the digital future of children.

 

About Advanced Study Institute of Asia (ASIA):

The Advanced Study Institute of Asia (ASIA) is an interdisciplinary research center based in New Delhi, focusing on South and Southeast Asia. Established in 2023 and affiliated with SGT University, ASIA conducts research across domains such as international relations, law, health, and society, and disseminates insights through publications, podcasts, and policy engagement initiatives.