Verifiable parental consent requires more than a checkbox

A checkbox saying ‘I am the parent’ records a statement. It does not, by itself, check whether the person making that statement is an identifiable adult or establish a complete parental-consent process. The operational challenge is to connect the relevant child, the adult, the proposed purpose and reliable evidence of the decision.

Design those elements separately. When they are collapsed into one button, it becomes difficult to explain what the organisation actually verified.

Read the requirement with its timing

As of 22 October 2026, the relevant substantive duties are scheduled for 13 May 2027 under the commencement notification. Section 9(1), read with the October 2026 correction, provides the parental or lawful-guardian framework. Rule 10 sets out the measures and due diligence for verifiable parental consent, including checking that the person identifying themselves as the parent is an identifiable adult.

The rule describes reliable identity and age details already held, or voluntarily provided details, including an authorised virtual-token route. Its illustrations also address existing and new parent accounts. It does not universally mandate Aadhaar, a face scan, a copied identity document or DigiLocker as the only method.

These distinctions matter because the verification process can itself create a substantial collection of personal data. Choose a method that fits the actual requirements and the service, and assess the information it introduces.

Separate the questions the process answers

First, identify the child account or activity to which the permission relates. A parent’s verified profile is not useful evidence if it cannot be connected to the relevant child and purpose.

Second, establish the person and the reliable adulthood check required by the rule. Existing details must actually be reliable for that purpose; the fact that an account has existed for years is not a complete assessment. Where new evidence is needed, evaluate the available permitted route and its handling requirements.

Third, address the claimed parental or lawful-guardian role through an appropriate process. Do not overstate a successful age check as proof of every aspect of that relationship. Unusual or disputed cases need a clear escalation route and, where relevant, assessment of the applicable guardianship position.

Finally, present the specific processing purpose and obtain the relevant decision. Verification establishes something about the person. It does not grant permission for every present and future use of the child’s information.

A hypothetical school-platform enrolment

A school platform already has reliable identity and age details for an adult account used in an existing relationship. When that adult seeks to create a child account, the platform checks whether those details support the required adult verification and connects the process to the particular enrolment.

It then presents the relevant purpose information and records the decision. A separate optional publicity request is assessed separately rather than hidden inside access to the learning service. If the claimed parent is a new user and the reliable details are absent, the platform uses its assessed new-user route instead of accepting the same checkbox as a substitute.

This example follows the distinction in rule 10’s illustrations between reliable details already held and information that needs to be provided through an appropriate route. It does not mean every school’s historical records automatically satisfy the rule.

Keep evidence useful and proportionate

Record the verification method, outcome, time, relevant account links and the purpose decision. Preserve the notice or consent version needed to understand what was presented. Decide which underlying evidence is genuinely necessary, who can access it and how the applicable retention rules will be met.

Do not retain a full document copy merely because a verification service can return it. Equally, do not discard all evidence and leave only an unexplained ‘verified’ flag. The right record should let an authorised reviewer understand the basis of the decision without giving every staff member access to identity material.

Design exceptions and changes before launch

Plan for failed verification, a wrong account link, a disputed relationship and a change in who is authorised to act. Explain the next step in language a family can use. A dead-end error can lead staff to create informal workarounds that bypass the intended process.

Where an exemption is being considered, assess its exact scope separately; do not assume verification requirements disappear across the entire organisation. Keep the child’s wellbeing and the remaining obligations in view.

The common failure is calling a declaration ‘verification’ because the screen looks complete. Test what evidence the process actually checks and what decision it records. That is the difference between a visible button and an explainable parental-consent workflow.