At a glance
Webcam-based exam proctoring and behavioural analytics (eye-movement tracking, keystroke patterns, tab-switch detection) collect exactly the kind of continuous behavioural data the DPDP Act is written to restrict when the learner is a child — it bars tracking and behavioural monitoring of children for platforms it applies to. A narrow relief exists for educational institutions, but a commercial EdTech platform running proctoring software doesn’t automatically get to rely on it. Consent, purpose-limits and a real answer to “why track this” are the actual compliance path.
Educational resource only. This explains how the children’s-data restrictions under India’s Digital Personal Data Protection Act, 2023 (DPDP Act) apply to exam proctoring and behavioural tracking on EdTech platforms; it is not formal legal advice.
The situation
Online exams normalised proctoring software fast — webcam feeds, screen recording, sometimes eye-tracking or typing-pattern analysis, all sold as academic-integrity tools. For an adult learner, that’s a data-processing question like any other. For a minor — the majority of users on school-adjacent EdTech and coaching platforms — it lands squarely inside the DPDP Act’s specific, and stricter, rules for children’s data.
What proctoring and behavioural tracking actually collect
Proctoring is one of the more invasive forms of routine data collection a student encounters. Depending on the tool, it can include:
- Live or recorded webcam and microphone feeds during the exam window.
- Screen recording and tab/window-switch detection, flagging any deviation from the exam screen.
- Biometric-adjacent signals — eye-gaze tracking, face-presence checks, sometimes keystroke-pattern analysis.
- Behavioural scoring — an algorithmic “suspicion” score derived from all of the above, sometimes with real consequences (a flagged exam, a re-take requirement) attached.
Why this sits close to DPDP’s tracking restriction
The DPDP Act specifically restricts behavioural monitoring and tracking of children — and proctoring is behavioural monitoring by definition. For Data Fiduciaries the Act’s children’s provisions apply to, processing a child’s data for tracking or behavioural monitoring, or for targeted advertising directed at children, is restricted. Continuous webcam monitoring paired with an algorithmic suspicion score is a close functional match to “behavioural monitoring” — even though the platform’s stated purpose is academic integrity, not marketing or profiling. That doesn’t mean proctoring is banned outright; it means it needs a genuine purpose-and-necessity justification and can’t be waved through as ordinary EdTech functionality.
Does the institutional relief cover commercial EdTech?
Only for a narrow class of institutions, and typically not for a standalone commercial EdTech company. The Rules carve out limited relief — under Rule 12 and the Fourth Schedule — for specific institutional classes (schools, among others) processing a child’s data for defined educational or safety purposes, such as tracking a child’s location or activity for safety reasons. That relief is scoped tightly to those institutional classes and purposes; a commercial EdTech platform running proctoring software for a paid course is a materially different fact pattern from a school administering the relief covers, and shouldn’t assume the carve-out extends to it without checking the exact scope against its own setup. Where a school itself deploys the proctoring tool for its own exams, the relief’s applicability is a closer question worth checking specifically — but the vendor supplying the software to multiple institutions commercially sits outside it either way.
What a defensible proctoring setup looks like
Purpose-limit the tracking to what academic integrity actually needs, and get verifiable parental consent for the processing itself.
- Verifiable parental consent before deploying any tracking-capable tool on a user under 18 — the general children’s-data consent requirement, not a proctoring-specific one.
- Collect only what integrity monitoring needs — continuous webcam presence for a timed exam is a different request than persistent behavioural scoring across a whole course.
- Set a short, defined retention window for recordings and behavioural logs — exam-integrity footage doesn’t need an indefinite hold.
- Avoid marketing or profiling use of any data collected for proctoring — using exam-behaviour data to build a broader student profile for unrelated purposes is the kind of repurposing the DPDP Act’s purpose-binding principle is written against.
- Give a real, working channel to flag a false suspicion score — not just a compliance nicety, but part of demonstrating the processing is proportionate.
AI-driven proctoring: facial recognition and algorithmic scoring
An automated “suspicion score” generated by facial-recognition and eye-tracking algorithms is a materially heavier form of processing than a human invigilator watching a video feed, and platforms should treat it that way, not as a minor upgrade. Facial-recognition-based identity verification and continuous gaze-tracking use the same category of sensitive biometric processing covered elsewhere on this site for other sectors (attendance systems, ID verification) — applied here to a child, with the added complication that automated flagging algorithms have a documented track record of higher error rates for some skin tones, lighting conditions and neurodivergent behaviour patterns, none of which the student can see or contest in real time. A defensible setup treats an AI-generated flag as an input to human review, not a final determination — a flagged exam should get a person’s eyes on the footage before any consequence follows, and the platform should be able to explain, if asked, roughly what triggered a specific flag.
Where the recordings actually go
Much of the proctoring software used by Indian EdTech platforms and institutions is foreign SaaS, which means exam footage of Indian minors is often processed or stored outside India — a cross-border question layered on top of the tracking question. Whether a platform builds proctoring in-house or licenses it from a vendor (domestic providers exist, alongside several international ones), it’s worth knowing specifically where the video and behavioural-log data is actually processed and stored, not just which company’s logo is on the product. India’s cross-border transfer rule doesn’t currently block transfers to any specific country, but the platform is still the Data Fiduciary responsible for the data regardless of where a vendor physically stores it — a foreign vendor’s own data-handling standard doesn’t relieve the platform of its DPDP Act obligations to the student and parent.
What happens to the footage after the exam
Exam-integrity footage has a natural expiry point — the appeals window for that specific exam — and holding it materially longer than that needs its own justification, not just storage-is-cheap inertia. Once an exam’s grades are finalised and any dispute or appeal window has closed, the specific purpose that justified collecting webcam and behavioural data in the first place is largely served. A platform that keeps every proctoring recording indefinitely “in case it’s needed later” is drifting from purpose-limited collection into exactly the kind of open-ended retention the DPDP Act’s principles argue against — set a defined deletion point tied to the appeals process, not the platform’s general data-retention convenience.
FAQ
Is webcam exam proctoring of minors illegal under the DPDP Act?
Not outright illegal, but it sits close to the tracking/behavioural-monitoring restriction the DPDP Act places on children’s data — it needs verifiable parental consent and a genuinely purpose-limited setup, not a default “every exam gets full proctoring” policy.
Does the school-safety relief in the Rules cover commercial proctoring vendors?
Generally no — that relief is scoped to specific institutional classes and purposes (like a school tracking a child’s safety), not to a commercial EdTech company supplying proctoring software across multiple platforms.
What consent is needed before deploying proctoring on students under 18?
Verifiable parental consent, the same baseline the DPDP Act requires for any processing of a child’s data — proctoring doesn’t have a separate, lighter consent standard.
Can behavioural data collected during an exam be reused for other purposes?
Not without a fresh basis — using exam-monitoring data for broader student profiling or unrelated purposes breaks the DPDP Act’s purpose-binding principle, even if the original collection was properly consented to.
Should an AI-generated “suspicion score” alone be enough to flag a student for cheating?
No — treat it as an input to human review, not a final decision. Automated flagging has known error-rate issues across different skin tones and behaviour patterns, so a person should review the footage before any real consequence follows.
How long should proctoring footage be kept after the exam?
Only as long as the appeals or dispute window for that specific exam stays open — once grades are finalised and that window closes, an indefinite hold no longer has a real purpose behind it.