What India's data law asks of a toy that listens

India passed the Digital Personal Data Protection Act in 2023. Most coverage of it was written for companies. Almost none was written for the parent standing in front of a toy that talks, which is a shame, because the part of the law that covers children is short, specific and unusually easy to read.

Here is what it actually says, and what it does not.

A child is anyone under eighteen

The Act sets the line at eighteen, which is higher than many parents expect and higher than the equivalent line in several other countries. Everything below applies to a three-year-old and a sixteen-year-old alike.

Consent has to come from you, and be verifiable

Section 9 requires verifiable consent from a parent or guardian before a company processes a child's personal data. Verifiable is the operative word. A tick box that anyone in the house could tick is not obviously consent from you, and a company that relies on one is relying on an interpretation rather than a practice.

Tracking a child is not allowed

The same section prohibits tracking, behavioural monitoring and targeted advertising directed at children. This is the clause with the sharpest teeth for this category, because it rules out the business model that funds most free consumer software. If a toy is cheap and the company has no other visible revenue, this is the question to ask.

Anything likely to harm a child is not allowed

The Act also bars processing that is likely to cause a detrimental effect on a child's wellbeing. It does not define that phrase, which cuts both ways: it gives regulators room, and it gives companies room. Treat it as a signal of intent rather than a bright line you can hold anyone to today.

What the law does not do

Three honest gaps, because a guide that only lists protections is not useful. The Act says nothing about the physical safety of a toy, which is a separate certification regime entirely. It does not require conversation logs to be readable by a parent, so a company showing you every word your child said is going beyond the law rather than meeting it. And enforcement is still building out, which means in practice the strongest protection a parent has in 2026 is choosing carefully rather than complaining afterwards.

What you can reasonably ask for

Four questions, all of which a compliant company should answer without hesitating. How do you obtain and record my consent. Where is my child's voice data stored, and in which country. Do you track my child or show them advertising of any kind. How do I delete everything, and does deleting mean deleting.

A vague answer to any of those is itself an answer. So is a privacy policy written so that nobody could follow it, which is common in this category and worth treating as a result rather than an inconvenience.

Where we stand

We are a company selling a toy that listens to children, so the questions above point at us too. Our answers: consent is asked for from the parent account, not the child; voice data stays in your region; we do not track your child, profile them or advertise to them, and we do not sell their data under any circumstance; and the full conversation log is readable and deletable by you in the parent app, which the law does not require of us.

Those mechanisms are set out in more detail on the Safety page and in the privacy policy. If any of it reads as less than clear, that is a fault worth telling us about.