One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

Mr. X approached me when his tech startup XYZ Learning Pvt Ltd faced regulatory scrutiny over their children’s educational app. They had launched a beta version targeting kids aged 6-14 in City A, using a privacy policy drafted by copying competitors’ policies. Within months, they received a notice from data protection authorities questioning their compliance with children’s data protection norms under the Digital Personal Data Protection Act 2023. The company had collected extensive user data including learning patterns, device information, and parental contacts without proper consent mechanisms. Mr. X realized their DIY approach to legal compliance had exposed them to potential penalties and reputation damage, requiring immediate legal intervention to restructure their data practices.

Advice in Such Cases

Consult with Lawyer: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation to come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think.

• Conduct immediate privacy audit of your app’s data collection practices
• Implement age verification mechanisms and parental consent systems
• Draft legally compliant privacy policies specific to children’s apps
• Establish data minimization practices and secure storage protocols

Applicable Sections of Law

The Digital Personal Data Protection Act 2023 governs this matter comprehensively. Section 9 specifically addresses children’s data protection requiring verifiable parental consent. Section 8 mandates data minimization principles. Under BNSS provisions, Section 194 covers digital evidence handling while Section 195 addresses electronic record authentication. The Information Technology Act 2000 Section 43A also applies for compensation regarding negligent data handling. Companies must ensure compliance with all applicable data localization and cross-border transfer requirements under the DPDP framework.

If You Are the Complainant

• File complaint with Data Protection Board highlighting specific violations
• Document all instances of unauthorized data collection from children
• Gather evidence of inadequate consent mechanisms or policy violations
• Request data deletion and cessation of processing activities
• Seek compensation for any misuse or breach of children’s personal data

If You Are the Victim

• Immediately cease all non-compliant data processing activities
• Engage qualified data protection counsel specialized in children’s privacy
• Implement robust parental consent verification systems
• Conduct comprehensive privacy impact assessments
• Establish transparent data deletion and portability mechanisms
• Create child-friendly privacy notices explaining data usage

How the Police Behave in Such Cases

Police typically treat data protection violations involving children seriously, especially when complaints involve unauthorized data collection or misuse. They collaborate with cyber crime cells and data protection authorities. Investigation usually focuses on technical evidence gathering, server data examination, and compliance documentation review. Police may conduct searches of company premises and seize digital devices for forensic analysis if criminal violations are suspected under IT Act provisions.

FAQs People Normally Have

• Can parents sue for privacy violations? Yes, parents can seek compensation and file complaints with data protection authorities for unauthorized processing of children’s data.
• What penalties apply? DPDP Act prescribes penalties up to Rs. 250 crores depending on violation severity and company turnover.
• Is parental consent always required? Yes, verifiable parental consent is mandatory for processing data of children below 18 years.
• Can apps collect anonymous data? Even anonymous data collection requires transparent disclosure and minimal necessary processing principles.

What Evidence Is Required?

• App source code and data collection mechanisms
• Privacy policy versions and consent flow documentation
• User registration logs and parental consent records
• Data processing logs and storage location details
• Third-party integrations and data sharing agreements
• Communication records with users and parents
• Technical security measures and encryption protocols

How Long Will the Investigation Take?

Data protection investigations typically take 3-6 months depending on case complexity. Simple compliance violations may resolve faster, while cases involving data breaches or extensive violations require longer investigation periods. Timeline depends on company cooperation, evidence availability, and regulatory authority workload. Appeals processes can extend resolution by additional 6-12 months.

Advocate Sudhir Rao, Supreme Court of India