Over-18 and parent-consent checks for Indian apps, with no birth date kept
TL;DR Yearproof is a check that consumer apps call when they need to know whether a user is an adult and, if not, whether a real parent has agreed. It returns a yes or no and a consent record. Apps pay per check, because India's data law makes getting this wrong expensive.
India's data protection law treats everyone under 18 as a child, and an app must get verifiable consent from a parent before it processes a child's personal data[1]. Breaking the children's obligations can draw a penalty of up to ₹200 crore[2]. Most apps today ask users to tick a box saying they're adults. That will not hold up once the phased compliance window that started in November 2025 closes[2].
Proof is the awkward part. A gaming or social app doesn't want to collect Aadhaar numbers or birth certificates, and holding them just creates a new breach risk. It needs an answer, not the underlying documents.
What it does, in regulatory terms: age assurance and consent record-keeping for data fiduciaries under the DPDP Act and Rules. It does not decide whether the app's processing is lawful, and the app stays responsible.
An app sends a user to Yearproof. The user proves age through a government-linked digital locker token or a document the app already holds. Yearproof returns "18 or over: yes/no" and throws away the birth date. If the user is a minor then Yearproof runs the parent through the same check, links the two accounts and stores a signed consent record the app can show the Data Protection Board later. A parent verified once can approve a second app in a few taps.
Rule 10 of the DPDP Rules already allows a virtual token mapped to identity details and issued by an authorised entity, with digital lockers named[3]. That's why I dropped the seed's zero-knowledge proof system as the core. The token route is cheaper and closer to what the rule describes. A proof-based "over 18" answer can still come later as a privacy upgrade.
The payer is the app's legal or compliance team - online gaming, social and dating platforms, creator apps, and edtech firms whose services fall outside the school and education exemptions[2]. Pricing would be per verified check, with a monthly minimum. There's no public price list for Indian age checks to compare against, so treat any number you quote to buyers as a test, not a benchmark.
The DPDP Rules were notified on 17 November 2025, with an eighteen-month phase-in[2]. By my count that puts the hard deadline around May 2027. Legal teams are budgeting for it right now. DigiLocker already has more than 70 crore registered users[4], so most adult Indians can produce a government-issued token without installing anything new.
No public figure exists for India's age-verification spend. The firmer signals are adjacent - DigiLocker's 70+ crore users and 900+ crore issued documents show the token rails are in place[4], and one UK age-check provider reports more than 800 million age checks to date[5], which shows the per-check model can scale once rules bite.
Global age-check providers offer facial age estimation, reusable digital IDs and document checks, and one lists a Bengaluru office[5]. Indian KYC firms sell DPDP consent and privacy tooling to Indian companies[6]. KYC vendors resell DigiLocker document pulls. The gap is a narrow product built only for the child-and-parent problem, with a reusable parent token and an audit trail, priced for apps that aren't banks.
| Difficulty | Moderate (39/100) |
| Starting capital | ₹1.1–2 Cr |
| Time to launch | 6–9 months |
The software is not exotic. The hard part is trust: getting authorised access to locker tokens, passing buyers' security reviews, and proving the parent is actually the parent and not an older cousin with a phone. My estimate is two to four months per enterprise deal.
Yearproof needs no licence to operate, but its whole value depends on building to the DPDP Rules and getting token access.
Building this outside India? The categories above usually have a local equivalent, so check with your own regulator.
Be careful with AI face-based age estimation here. Treat it as a hint at best, never as the verified answer, because the rule asks for verifiable consent and an estimate is not proof.
Want to work out the AI layer for Yearproof? Talk to Yash →
Here's what can go south -
I think it's a reasonable bet for a founder from identity, KYC or privacy engineering who can sell to legal teams. If you're hoping a blockchain angle will carry it then it's a poor fit, because buyers want a defensible answer. Prove first that three mid-size apps will run a paid pilot before the deadline, and that parent completion rates stay above 60%.
Plan for roughly ₹1.1–2 Cr, mostly on engineering, security reviews and the long sales cycle with app legal teams.
No licence, but you must build to the DPDP Act and Rule 10 of the DPDP Rules, and you'll need a requester arrangement with DigiLocker.
Yes, several countries now require age checks for apps. The accepted methods differ by country, so check your local regulator's guidance.
The free Yearproof validation kit has the line-by-line capital breakdown, the effort scoring, the data-protection checklist, a 14-day validation sprint with pass/fail targets, a 90-day launch plan, 10 interview questions for app compliance teams, and 5 assumptions to test. Download the kit →
Thinking about building Yearproof or something close to it? The make-or-break work is securing token access and making the parent step short enough that apps keep it switched on, and I'm glad to work through both with you. If you need a hand, you know where to find me. Talk to Yash →
For illustration only. Names are fictional and ideas hypothetical; sourced facts are real but may be out of date. Nothing here is legal, financial or professional advice, and Yash Khatri is not personally liable for any use of it. Read the full disclaimer.