#WhatsApp Shipped Teen Accounts on 30 September. The DPDP Act's Children's Data Rules Do Not Recognise Teenagers

Correction (1 November 2026). An earlier version of this article said the Chairperson and Members of the Data Protection Board of India were appointed in June 2026. That was wrong. On 6 June 2026 MeitY issued a further notice in its call for applications for those posts; it did not appoint anyone, and as of 1 November 2026 no appointments have been made. The affected passage has been corrected.

On Wednesday 30 September, WhatsApp began rolling out optional parental controls for users aged 13 to 17 — a product category Meta calls the Teen Account. Under the DPDP Act children's data regime, that category does not exist: India draws one line, at 18, and everyone below it is a child whose personal data cannot be processed at all without verifiable parental consent.

This is not a gap Meta can close with a settings menu. The distance between "a parent switched on some controls" and "an identifiable adult parent consented to processing" is the whole of Section 9, and the Indian features shipped this week sit on the wrong side of it.

#What WhatsApp Actually Shipped on 30 September

The rollout, reported by MediaNama on 1 October and covered the same day by Business Today, gives parents of 13–17 year olds a PIN-protected panel. According to WhatsApp's own parental controls page, a parent can:

• Set who sees the teen's profile photo, About and online status, and who may contact them or add them to groups
• Manage access to Channels and whose Status updates the teen can view
• Choose the Meta AI content setting — standard, or a "Limited Content" mode that disables features such as Incognito Chat and message summaries
• Receive activity notifications: new contacts added, contacts blocked or reported, groups joined or left, and alerts when a group crosses 30, 100 or 250 members

Two things the controls deliberately do not do. They do not touch message content — personal chats and calls remain end-to-end encrypted, so a parent cannot read them. And they are not switched on by default. For teens, WhatsApp describes them as "optional controls to help parents support their teens."

That sits alongside a separate tier announced in March and first reported by TechCrunch: parent-managed accounts for under-13s, where the parent approves contacts and group membership, the feature set is cut back to messaging and calls, and the controls are the required framework rather than an opt-in. When the child turns 13, the account converts to a standard one — with parents able to delay that transition by twelve months.

Read those two tiers together and you get Meta's model of childhood: supervised until 13, semi-autonomous with optional oversight from 13 to 17, adult at 18. It is a coherent model. It is also, in India, the wrong one.

#Why the DPDP Act's Children's Data Rules Have No Middle Path

Section 9 of the Digital Personal Data Protection Act, 2023 defines a child as an individual who has not completed 18 years. There is no second threshold, no graduated tier, no category of user who is old enough to consent for themselves but young enough to warrant extra care. Section 9(1) requires a Data Fiduciary to obtain verifiable consent of the parent before processing any personal data of a child, and Section 9(3) separately prohibits tracking, behavioural monitoring of children, and targeted advertising directed at children.

Compare that to the regimes the Teen Account was designed against. US COPPA bites below 13, which is exactly why 13 is the industry's default hinge. The GDPR sets the information-society-services threshold at 16 and lets member states lower it to 13, which is why a 15-year-old in Dublin and a 15-year-old in Berlin can face different rules. A comparative analysis by TLH Law sets out the divergence plainly: both regimes demand verification of the parent, but India fixes the age higher and leaves no room for a tiered teen product.

The practical consequence is stark. A 17-year-old in Pune using WhatsApp is, under Indian law, a child. Every message routed, every contact list synced, every Status view logged is processing of a child's personal data. The lawful basis for that processing is parental consent — not parental supervision, and not the absence of parental objection. If no parent has consented, the processing has no basis at all, whatever the privacy settings say.

#Parental Controls Are Not Verifiable Parental Consent

This is the distinction the week's coverage missed, and it is the one that matters for compliance teams.

Parental controls are a safety feature. They govern what a child can see and who can reach them. They are a product decision, they can be optional, and they are genuinely useful.

Parental consent is a lawful basis. It governs whether the fiduciary may process the child's data at all. It cannot be optional, because a legal basis that the user may decline to provide is not a legal basis — it is a preference.

WhatsApp's teen controls are explicitly the first thing. Nothing in the rollout suggests Meta is claiming otherwise; the company has not presented these controls as DPDP compliance, and it is not currently obliged to, because Section 9 and the children's provisions of the DPDP Rules commence on 13 May 2027. But the sequencing creates a real risk for the Indian market. This is the second consent-adjacent mechanism Meta has put in front of Indian users in two months, after the August age-declaration prompt, and thousands of Indian edtech, gaming, fintech and social products take their design cues from what WhatsApp does. If the reference implementation for "children's data" is an optional settings panel that starts at 13, a very large number of Indian companies will build a compliant-looking product with no lawful basis underneath it.

#The Linkage Meta Built, and the Rule 10 Question It Does Not Answer

Here is what makes this more than a complaint. To ship parent-managed accounts, Meta had to build the hardest engineering component of verifiable parental consent: a durable, authenticated link between a parent's account and a child's account, with the parent able to exercise rights over the child's experience. Most Indian fiduciaries do not have that and will spend 2027 building it.

Meta has it. It is just wired to the wrong question.

Rule 10 of the DPDP Rules, 2025 requires a Data Fiduciary to adopt appropriate technical and organisational measures to ensure verifiable parental consent is obtained, and to observe due diligence to check that the individual identifying herself as the parent is an adult who is identifiable if required to be so identified. The Rule points at concrete methods: identity and age details the fiduciary reliably holds already, or a virtual token issued by an entity such as a DigiLocker service provider.

Apply that test to the WhatsApp linkage. The parent is an adult because their own WhatsApp account says they are 13 or older and they asserted 18+ — a self-declaration resting on a self-declaration. The parental relationship is asserted, not evidenced. And WhatsApp holds no government-issued identity for either party. The link is real and technically robust; what it establishes is that someone with the device and the PIN configured the account. Rule 10 asks for something harder: that the consenting adult be identifiable to the fiduciary if the Data Protection Board later asks.

That is a solvable problem, and India has the plumbing — the DigiLocker virtual token route exists precisely so platforms do not have to warehouse Aadhaar numbers to verify a parent. It is not solved by what shipped this week.

#Section 9(3), Meta AI, and the Monitoring Problem

The Meta AI setting deserves its own look, because it is where the Teen Account design runs hardest into Section 9(3).

The new controls let a parent restrict Meta AI to "Limited Content" for a 13–17 year old. Useful — but note the default. Absent a parent opting in, an Indian 16-year-old gets standard Meta AI inside WhatsApp. Section 9(3) prohibits tracking and behavioural monitoring of children and targeted advertising directed at children, and those prohibitions are not consent-waivable in the way Section 9(1) processing is; Section 9(4) allows the Central Government to relax them for notified classes of fiduciary, but no such notification exists yet.

An AI assistant that retains conversational context, infers interests and personalises responses is doing something that at minimum needs to be assessed against "behavioural monitoring." The honest answer is that nobody knows precisely where the line falls, because the Data Protection Board of India — which still has no Chairperson or Members — has issued no guidance on it. That uncertainty is itself the finding: the single largest children's-data design decision on India's biggest messaging platform currently has no regulatory answer, nineteen months before it becomes enforceable.

The same logic applies to the activity notifications. Telling a parent that their teen joined a group or added a contact requires WhatsApp to generate and transmit a behavioural event stream about a minor. Doing it on parental instruction is defensible. What the fiduciary retains, and for how long, is the part Section 9(3) will test.

#The Ageing-Out Mechanic Breaks at the Wrong Number

One more structural mismatch. WhatsApp converts a parent-managed account to a standard account when the child turns 13, with an optional twelve-month parental delay.

Under Indian law, 13 is not a meaningful age and 14 is not either. The conversion that matters is at 18. A platform that releases a child from parental consent architecture at 13 — or at 14 with the delay — has, under Section 9, released them four or five years early. Any Indian fiduciary copying that state machine inherits the defect, and it is the kind of defect that is cheap to fix in a design document and expensive to retrofit across a live user base.

Build the age-gate transition at 18 from the start, and let product decide separately whether to offer a softer experience at 13. The legal boundary and the product boundary do not have to be the same number, but the legal one cannot be missing.

#What Indian Businesses Should Do Now

The children's provisions commence on 13 May 2027 — a date MeitY Secretary S. Krishnan told a Startup Policy Forum compliance clinic on 31 August will not be extended. Nineteen months is not long for identity infrastructure. Four concrete steps:

Separate controls from consent in your architecture. Build them as two systems. One governs experience; one governs lawful basis and must be auditable, timestamped and withdrawable. Teams that conflate them will discover at audit that they cannot produce evidence of consent, only evidence of settings.

Set the line at 18 and make it a constant. Not 13, not 16, not a per-market config value copied from a US or EU implementation. If your codebase has an AGE_OF_CONSENT that varies by region, India's value is 18 and it drives Section 9(1), 9(3) and the ageing-out transition alike.

Pick your parent-verification route this quarter. Rule 10 gives you two realistic paths: identity and age details you already hold reliably, or a DigiLocker-issued virtual token. The second is the data-minimising option for most consumer products and the one least likely to create a fresh breach surface. Either way, the integration work is not a sprint, and the vendors capable of delivering it will be oversubscribed through 2027.

Audit your ad and analytics stack against Section 9(3) separately. Consent does not cure a 9(3) problem. If a user is flagged under 18, behavioural profiling, interest inference and targeted advertising must be off — including through SDKs and third-party processors you may not currently inventory.

Organisations still mapping obligations will find the fiduciary and processor breakdown in our resources library, and teams designing consent capture ahead of the 13 November 2026 registration window should start with the consent manager framework — the same consent ledger that records adult consent will need to record parental consent, and retrofitting that later is painful.

#The Bigger Point

Meta did not do anything wrong this week. Teen Accounts are a reasonable product built against the regulatory regimes that currently bind the company, and shipping safety features before a law requires them is better than the alternative.

The problem is that India's law is not a stricter version of COPPA or the GDPR — it is a differently shaped law, and the shape is binary. Section 9 carries penalties of up to ₹200 crore, and it will be enforced against a market that has spent a decade importing product patterns calibrated to 13.

The Teen Account is the clearest example yet of the mismatch, precisely because it is thoughtful. When the well-designed version of a children's product still does not fit Indian law, the gap is not a compliance detail. It is an architectural fact Indian companies should design around now, while it is still cheap.

---

Building DPDP-compliant children's data flows or age-assurance architecture? Our resources library covers Section 9 obligations, Rule 10 parental verification and Data Fiduciary duties. If you are designing consent capture ahead of the 13 November 2026 milestone, start with our consent manager breakdown.