Protection of Children’s Personal Data on Educational Applications: An Analysis of the Indian Legal Framework

Author: Bhoomi Shandeliya, Guru Gobind Singh Indraprastha University

---

Abstract

Rapid expansion in educational technology has changed the distribution of education by changing children’s way to access learning through digital means. Educational applications provides a lot of personalised learning experiences, interactive content, and improved accessibility, these apps also collects a vast number of children’s personal data which includes their name, class, parents name etc. since children are particular are not exposed to privacy risks, also they are unable to provide informed consent, protection of their personal data has been emerged as a critical legal and policy concern.

This research paper studies the legal regulation of children’s personal data on educational applications on comparative evaluation of international and national frame work. Its studies the crucial legal instruments which includes, the United Nations Convention on the Rights of the Child (UNCRC), India's Digital Personal Data Protection Act, 2023 (DPDP Act) and many more. This research paper also reviews statutes, judicial decisions, policy documents, and scholarly literature to evaluate the effectiveness of existing legal protections. It also stresses the emerging challenges such as artificial intelligence, algorithmic profiling, cross-border data transfers, cybersecurity threats, and the lack of uniform global standards. 

This paper also come to the conclusion that though there are many progresses which have been made in protecting children’s digital privacy, effective implementation and enforcement remain major challenges. 

Keywords

Children’s Personal Data, Digital personal Data Protection Act, 2023, Educational Applications, Informational Privacy

Introduction

The speedy growth in digital technology has transformed the education sector by making educational apps an important part of learning for children. These platforms help children by offering personalized learning, online assessments, virtual classrooms and interactive educational content. These things play an important role in making education easy for children by making them easy for children to learn. For providing these services educational apps collect and process a wide range of children’s personal data such as names, contact details records etc. 

Children are seen as defenseless in the digital environment as they are seen as not having maturity to understand the implications of sharing personal data. The growth in educational technology has highlighted the need for a legal framework that ensures the protection of children’s personal data. As in India the enactment of Digital Protection Data Protection Act,2023 makes an important step towards safeguarding their personal data like provisions relating to parental consent and many more. 

Regardless of the legal developments there and gaps which remained in the regulation of educational applications. The research investigates legal frameworks governing children’s personal data on educational apps, identifies existing regulatory challenges and evaluates if the law acceptably protects children’s privacy or not. 

Literature Review

The rapid growth in the use of educational technology has changed the way of giving education across the world, this rapid change came at the time of COVID-19 pandemic. T-educational applications have become a very important tool for providing online classes, personalized learning, digital assessment, and many more. Yet these applications also collect and process a number of children’s personal data like name, contact details, parents name etc. Therefore scholars, policy makers and legal experts have focused on the need to regulate the collection, processing and storage and sharing of children’s personal information. Basically, the literature states that while digital education offers many educational benefits, it also makes complex legal, ethical and privacy concerns that require complete intervention for its regulations.

A very large body of academic literature sees children as an unprotected category of data. Many scholars like Sonia Livingstone and Brian O’Neill have argued that “Children often lack in cognitive maturity to understand the privacy notice, consent mechanisms and long-term consequences of sharing personal information online” in simple words children are not mature enough to understand what will be the consequences after the act or work they do? Many scholars also say that privacy is not mainly about secrecy but its also about preventing excessive surveillance, profiling, identity theft and authorities' use of personal data. 

International scholarship has widely examined legal frame work for governing children’s personal data. The European Union’s General Data Protection Regulation (GDPR) is seen as one of the most comprehensive privacy laws in the world. Researches have acclaimed the GDPR for introducing principles such as lawfulness, privacy, transparency and many more. Especially, the Article 8 of the GDPR which says about requiring parents consent for personal data of younger children in relation to information society services while also seeing children as a vulnerability in their digital environment. Academic observers mull overs on the GDPR model as it balances technological innovations with the protection of children’s fundamental rights.

Likewise, the substantial literature examines United States' Children's Online Privacy Protection Act (COPPA) It controls the online collection of personal information of children under the age of thirteen. Scholars admitted that COPPA founded important obligations regarding parents’ consent, privacy notice, data security parental right to review and many more. However, many researches have criticized COPPA for being enacted before the coming of modern technology. As a result, debates have been continued with If there existing legislation adequately addresses the evolving risks joined with the digital platforms or not?

In India the scholar's work on children’s data protection remains relatively limited but it has expanded the Digital Personal Data Protection Act, 2023. Extant studies mainly examine the statutory provisions verifiable parents’ consent, restrictions on behavioural monitors and targeted advertising, obligations imposed upon trustees and the protection of children’s wellbeing. They recognized a large number of challenges including the absence of detailed mechanisms, difficulties in age verifications and many more. Some authors also argued that India’s rapidly expanding educational technology sector requires sector specific privacy guidelines in addition to the general framework established under the DPDP Act. 

In spite of the growth of international scholarship, a meaningful research gap remains concerning the legal regulation of children’s personal data refined by the educational gaps in India. Present research broadly focuses on data protection laws or children’s online privacy without investigating unique operational practices of educational technology platforms. Moreover, few studies fairly undertake the examination of India's Digital Personal Data Protection Act, 2023, beside international frame work such as GDPR and COPPA to estimate whether the Indian legal administration addresses the privacy risks associated with educational applications. The research requests to bridge the gap by crucially examining the legal framework governing children’s personal data in educational apps, estimating its effectiveness in protecting children’s privacy rights, finding practical challenges in implementation and enforcement and proposing a legal framework and in policy recommendation to strengthen data protection in India with an evolving digital educational system. 

Research Methodology 

The research embraces a doctrinal (library-based) research methodology, it is quantitative and analytical in nature. The primary goal of the study is to investigate the legal framework governing the collection, processing, storage and protection of children’s personal data by educational applications. With the swift growth of the digital learning platforms educational apps are becoming an important part of the education system. Yet the increasing use of these platforms has also raised an important concern about children's privacy and their personal information. The research examines the adequacy of existing legal framework, finding the challenges in its implementation and recommend measures for reinforcing the protection of children’s data in the digital environment.

This analysis is primarily based on doctrinal legal research; it also involves the organized analysis and explanation of statutes, judicial decisions, government policies, regulations and legal principles. The research succeeds with a detailed plus an analytical approach. The descriptive method is used to clarify the existing legal framework, while analytical method is utilized to critically evaluate the effectiveness of the laws and identify the existing legal and regulatory gaps.

The research depends on both primary and secondary sources of information. The primary sources include constitutional provisions, statutory enactments, delegated legislation, judicial precedents, governments notifications and policy documents. This specifically highlights the Digital Personal Data Protection Act,2023, the Information Technology Act,2000, and relevant rules framed under it. The analysis also inspects international legal instruments and comparative legal frameworks like General Data Protection Regulation (GDPR) from the European Union, Children's Online Privacy Protection Act (COPPA) from the United States and Ons Convention on the Rights of the Child (UNCRC) along with other relevant recommendations. 

Secondary sources include textbooks, explanation, peer-reviewed, general articles, law review publications research papers, conferences proceedings, dissertations, reports published by organisations like UNICEF, OECD and the academic institutions also authentic legal databased including SCC online, Manu Patra, Hein online, JSTOR and Google scholar. The medium also provides scholarly opinions, comparative perspectives and critical analyse of contemporary developments on data protection law

The research consists of data which has been examined through comparative and critical legal analysis to evaluate the potency of existing regulatory mechanisms governing children’s personal data on educational applications. The research further recognizes defects in the current legal framework and suggests recommendations objecting at improving compliance, boosting accountability of educational technology providers and making certain stronger protection of children’s fundamental right to privacy in the digital age. 

Examining Existing Legal Frameworks

The rapid expansion in dependence on educational applications has basically transformed the manner in which children get education. The modern educational system intensely relies upon the collection and processing of personal data to provide individual learning experiences, monitor academic progress, facilitate communication between teachers and parents and improve educational outcomes through artificial intelligence and learning analytics. Though the technology's progress has improved accessibility and efficiency in education, at the same time they have generated significant legal concerns regarding the protection of children’s personal data. 

The constitutional foundation for protecting children’s personal data in India originated from Article 21 of the constitution, which guarantees the right to life and personal liberty. There is a supreme court landmark judgement in Justise K.S. Puttaswamy v/s Union of India (2017) In this case, acknowledging the right to privacy forms an essential part of Article 21. The court held that information privacy   shapes the necessary component of individual autonomy and human dignity, requiring the state to establish satisfactory safeguards against arbitrary collection, processing and distribution of personal information. Though the judgement did not specifically concern children or educational technology, the principle directs educational applications which collect sensitive personal information from minors. As children possess limited decision making capacity and are not capable of protecting their own privacy, constitutional duties to safeguard informational privacy assumes even greater importance in relation to educational platforms.

The enactment of Digital Personal Data Protection Act, 2023 (DPDP Act) represents India’s first complete statutory framework governing digital personal data. The act groups individuals below the age of eighteen years as children and presents information about duty upon data fiduciaries processing children’s personal data. In India educational applications fall within the scope of the act whenever they collect or process identifiable information about students. 

One of the most important provisions of DPDP Act is the necessity of confirmable parental consent before processing a child’s personal data. This demand acknowledges that children may not have sufficient legal or cognitive capacity to provide informed consent regarding digital processing activities. Though placing decisions in the hands of parents or lawful guardians the legislation seeks to strengthen accountability and reduce the chances of unauthorized processing. However practical applications increase several concerns. This act also outlawed behavioral monitoring and aimed advertising at children. Educational companies progressively employ algorithms to examine students' learning behavior, preferences, attention spans and online interactions to improve educational contents. Although these analytics may serve legitimate learning advertising and long-term data monetization. By stopping such practices, the DPDP Act confesses that children deserve greater protection from commercial influences than adult users. Still differences between legitimate educational analytics and restricted profiling remains legally challenging. Controllers will thus need to develop detailed guidance by clarifying the permitted scope of learning analytics within the educational platform. 

Similarly, another remarkable aspect of DPDP Act is it focuses on securing that data processing does not adversely change the well being of children. This symbolizes an important withdrawal from traditional privacy regulation, which mainly focuses on consent and procedural appliance. The notion of children’s wellbeing extending beyond data security to include psychological development, educational interests and protection from manipulation. However, the Act thoroughly does not define what constitutes detrimental effects upon a child’s well-being. This deficiency of statutory clarity may produce irregular interpretations during enforcement proceedings and judicial review. Hence, additional rules and regulatory guidance will be important to ensure uniform application of these principles. 

The Digital Personal Data Protection Rules, 2025 this act strengthens the legal framework by giving procedures related to parental consent verification, record maintenance, security safeguards and organizational compliance. The rules also seek to give a broad objective of DPDP Act into practical duty’s capable of execution by digital service providers, it also included educational applications. Their efficiency however depends largely upon institutional capacity. regulatory supervision and awareness among educational institutions. Numerous small educational technology providers may also face financial and technical challenges in implementing sophisticated compliance mechanisms.  

The constitutional recognitions of privacy together with DPDP Act and the attending rules, undoubtedly represents important legislative growth. However numerous practical limitations remain. Educational applications process highly sensitive information, like attendance, biometric identifiers, behavioral assessments and many more. This type of information process long term implementations on children’s educational and professional opportunities. Therefore, a general data protection framework would be insufficient to regulate the unique risks associated with educational data ecosystems. The lack of detailed standards regarding algorithmic transparency, artificial intelligence, automated decision making, cross border data transfer educational profiling shows the need for more specialized regulatory guidance. In the absence of these rules companies and educational institutions may continue to interpret their legal obligations. 

International Frameworks

A relative examination of the international framework further illustrates both limitation and strength of India’s regulatory approach. The European Union’s General Data Protection Regulation (GDPR) is broadly considered as a global benchmark for personal data protection. Unlike the DPDP Act the GDPR assumes a risk based approach that merges the principle of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, confidentiality and accountability. Article 8 of the GDPR specifically addresses children’s consent in relation to information society services and requires parental authorization for younger children although allowing member states to establish the applicable age between thirteen to sixteen years. Additionally, Recital 38 acknowledges that children deserve precise protection as they may be less aware of the risks, consequences and safeguards associated with the processing of personal data. Educational applications which are operating within the European Union are specifically needed to adopt privacy by design measures, plus they need to conduct a data protection impact assessment in which appropriate and implement strong security mechanisms. 

The United States adopts a different legislative model by the Children’s Online Privacy Protection Act (COPPA). COPPA mainly focuses on protecting children below the age of thirteen years of age by requiring manipulators of online services to secure verifiable parental consent before collecting personal information. It also awards parents the right to inspect, correct or delete their children’s data and binds service providers to maintain fair security safeguards. Though   COPPA represents an innovative effect in children’s online privacy regulation, numerous scholars argue that no longer adequately addresses contempered digital technologies. Educational applications increasingly rely upon artificial intelligence, cloud computing behavioral analytics and cross platform data sharing. Many observers advocate legislative reforms to modernize the Act and extend its protections to newer forms of digital learning.  

Case Laws/ Judicial Decisons

Judicial decisions have played an important role in shaping the legal framework for privacy and children’s rights in India. In Justice K.S. Puttaswamy vc Union of IndiaThe supreme court acknowledged the right to privacy as a fundamental right under Article 21. The court held that informational privacy is an important aspect of personal liberty and that any interference with the right must satisfy the principles of legality, necessity and proportionality. These all principles are relevant to educational application, which secure children’s academic, behavioral and biometric data.

Before this case there was a case of M.P. Sharma v/s Satish Chandra (1954) and Kharak Singh v/s State of Uttar Pradesh (1963) has embraced a narrow view of privacy but the puttaswamy judgment expanded constitutional protection to address the challenges posed by the digital age. 

Many government policies have provided in regulating educational technology. The National Education Policy, 2020 it encourages digital learning while highlighting the need for safe inclusive and secure educational environment. Though the policy dose not particularly regulates children’s personal data, it supports responsible use of technology and protection of student’s interests. Government mentors have also recommended that educational institutions strengthen cybersecurity, maintain confidentiality of student information and adopt secure digital platforms. Yet these measures remain broadly advisory and lack force of legislation. 

Drawbacks and Loopholes

Scholars have continually argued for the strong protection of children’s personal data. Sonia Lvingstone puts stress upon children’s rights; she also included protection from surveillance, profiling and commercial exploitation. Likewise. Daniel J Solove also argues about the modern privacy harms which comes not only from in authorizing disclosure but also from excessive collection, profiling and secondary use of personal information. All the views by all scholars suggest that educational applications should follow principles of data minimization, transparency and secure data management throughout the data lifecycle. 

In spite of the enactment of Digital Personal Data Protection Act, 2023, India’s legal framework carries on to face implementation challenges. Effective protection needs stronger regulatory oversight, sector specific guidelines for educational applications, privacy by design practices, regular security audits and meaningful penalties for non-compliances. Educational technology carries on to evolve, balancing technological innovation with children’s fundamental rights to privacy remain essential. An overall healthy legal framework reinforced by effective

enforcement, judicial oversight and public awareness is necessary to ensure that digital education develops without compromising the digital, safety and privacy of children. 

Discussion 

The swift growth of educational applications has changed the learning processes by making education more accessible, interactive, and personalized. Yet these platforms gather a large number of children’s personal data including academic records, behavioral information, photographs and device details. As children are less mindful of consequences of sharing information, they need stronger legal safeguards than adult users. Thus, regulating collection, processing, and storage of children’s personal data has become a critical legal concern. 

The passing of the Digital Protection Act, 2023 symbolizes an important step towards protecting children’s personal data in India. This act needs educational applications to secure verifiable parental consent before processing a children’s personal data and also it prohibits behavioral monitoring and targets advertising directed at children. These provisions identify children’s vulnerability and objective to ensure that digital platforms process their information responsibly. Yet the effectiveness of these safeguards depends upon proper implementation, reliable age verification mechanisms and strict regulatory rules. 

International frameworks like the European Union’s General Data Protection Regulation (GDPR) and the United States Children’s Online Privacy Protection Act (COPPA) furnish precious guidelines for strengthening India’s legal Framework. In the DPDP Act introduces important protections, it also has less provisions regarding algorithmic transparency, artificial intelligence and sector specific regulation for educational technology. Reinforcing these areas would improve accountability and reduce privacy tasks. 

Scholars have stressed that privacy protection should expand in securing parental consent. Educational technology companies should also implement privacy by design principles, minimize unnecessary data collection, maintain strong cybersecurity measures and ensure transparency in their data processing practices. Generally, India’s legal framework represents an important start in protecting children’s personal data. Yet continuous legislative reforms, effective enforcement and increased awareness among parents, schools and technology providers is important to ensure that digital education develops in a manner that respects children’s privacy, digital, and fundamental rights. 

Conclusion

The quick growth of educational applications has transformed the educational sector by making learning more accessible, interactive and personalized for children. As these platforms have enhanced educational opportunities, it has also led to a large-scale collection and processing of children’s personal data, making an important concern about privacy, security and ethical use of information. As children are particularly vulnerable in the digital environment and they often lack the capacity to understand the consequences of data sharing, the law should mandatorily provide safeguard to protect their fundamental rights. 

India has made significant growth in the enactment of the Digital Personal Data Protection Act,2023, which establishes significant safeguards like verifiable parental consent, restriction on behavioral monitoring and enhanced responsibility for data fiduciaries processing children’s data. The recognition of the right to privacy as a fundamental right in Justice K.S. Puttaswamy v/s Union of India moreover provides a strong constitutional foundation for protecting children’s personal information. Comparable analysis of international frameworks like European Union’s General Data Protection Regulation (GDPR) and the United States Children’s Online Privacy Protection Act (COPPA) demonstrates that India has adopted several important protections but still needs greater regulatory clarity, sector-specific guidelines for educational technology platforms and stronger enforcement mechanisms. 

To guarantee through protection, policymakers should strengthen cybersecurity standards, encourage privacy by design principles, improve parental awareness and set up effective oversight of educational applications. Cooperation between the government educational institutions, technology companies and parents is needed to create a safe digital learning environment. A balanced regulatory framework which promotes technological innovation, yet safeguarding children’s privacy, dignity and best interests which is important for making a secure, transparent and trustworthy digital education eco system for future generations.  

References 

Statutes 

• The Digital Personal Data Protection Act, No. 22 of 2023 (India).

• Information Technology Act, No. 21 of 2000 (India).

• Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501–6506 (2018).

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), 2016 O.J. (L 119) 1.

Cases 

• Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 S.C.C. 1 (India).

• M.P. Sharma v. Satish Chandra, AIR 1954 SC 300.

• Kharak Singh v. State of Uttar Pradesh, AIR 1963 SC 1295.

• Gobind v. State of Madhya Pradesh, (1975) 2 S.C.C. 148.

• People's Union for Civil Liberties (PUCL) v. Union of India, (1997) 1 S.C.C. 301.

International Conventions 

• Convention on the Rights of the Child art. 16, Nov. 20, 1989, 1577 U.N.T.S. 3.

• Universal Declaration of Human Rights art. 12, G.A. Res. 217 (III) A, U.N. Doc. A/810 (Dec. 10, 1948).

Government Polices 

• Ministry of Education, Government of India, National Education Policy 2020 (2020).

• Ministry of Electronics and Information Technology, Draft Digital Personal Data Protection Rules, 2025.

• Ministry of Electronics and Information Technology, IndiaAI Mission (2024).

• National Cyber Security Policy, 2013, Ministry of Communications & Information Technology.

• Books 

• Daniel J. Solove, Understanding Privacy (Harvard Univ. Press 2008).

• Daniel J. Solove, Nothing to Hide: The False Tradeoff Between Privacy and Security (Yale Univ. Press 2011).

• Sonia Livingstone & Alicia Blum-Ross, Parenting for a Digital Future (Oxford Univ. Press 2020).

  
  

Journal Articles 

• Sonia Livingstone, Children's Privacy Online: Experimenting with Parents and Platforms, 10 Int'l J. Comm. 1 (2016).

• Brian O'Neill, Protecting Children's Privacy in the Digital Environment, 15 Int'l Data Privacy L. Rev. 45 (2021).

• Daniel J. Solove, A Taxonomy of Privacy, 154 U. Pa. L. Rev. 477 (2006). 

Reports 

• UNICEF, Policy Guidance on AI for Children (2021).

• UNICEF, Children's Data Governance Manifesto (2021).

• OECD, Recommendation on Children in the Digital Environment (2021).

• UNESCO, Guidance for Generative AI in Education and Research (2023)

• World Economic Forum, Digital Trust Framework (2024).

Policies 

Indian Policies 

• National Education Policy (NEP) 2020 

• Digital Personal Data Protection Rules, 2025 

• National Cyber Security Policy, 2013 

• IndiaAI Mission (2024) 

• National Digital Education Architecture (NDEAR)

International Policies 

• UN Convention on the Rights of the Child (UNCRC), Article 16 

• General Data Protection Regulation (GDPR) 

• Children's Online Privacy Protection Act (COPPA) 

• OECD Recommendation on Children in the Digital Environment (2021) 

• UNICEF Policy Guidance on AI for Children (2021) 

• UNESCO Guidance for Generative AI in Education and Research (2023)