1. Introduction

Commercial Child-Genomics Exploitation Regulation refers to the legal and regulatory framework governing the collection, sequencing, storage, analysis, licensing, sharing, and commercial monetization of children's genetic information, with particular emphasis on preventing exploitation, discrimination, unauthorized research, and unfair commercial practices.

The term is a useful analytical concept rather than the name of a single, universally recognized statute. Its legal foundations are found in constitutional privacy rights, child-protection laws, data-protection legislation, medical-consent rules, consumer-protection law, research ethics, and restrictions on genetic discrimination.

Children's genomic information deserves special protection because it can reveal inherited disease risks, biological relationships, ancestry, and information about relatives. Unlike an ordinary password, genetic information cannot be changed if it is exposed or misused.

Illustrative examples of commercial exploitation

A genetic-testing company markets a child's DNA profile to pharmaceutical companies without an adequate legal basis.

A fertility or genomics business uses children's genetic data for research beyond the scope of the original consent.

An insurer attempts to use genetic predictions to classify a child as a future financial risk.

A company retains a child's biological sample indefinitely, despite a valid request for deletion or destruction.

A genomic testing service markets speculative predictions about intelligence, athletic potential, personality, or future educational performance to parents.

The central legal question is how to balance legitimate medical research and innovation against children's privacy, autonomy, dignity, welfare, and future ability to control information about themselves.

2. Principal objectives of regulation

Privacy and confidentiality

Restrict the collection, use, disclosure, and commercial transfer of identifiable or re-identifiable genomic information.

Child welfare and meaningful consent

Require legally valid parental or guardian authorization where applicable, age-appropriate explanations, and respect for the child's developing capacity to decide.

Prevention of discrimination

Limit inappropriate uses of genomic predictions in employment, insurance, education, lending, and other consequential decisions.

Responsible commercial research

Require transparent research purposes, suitable safeguards, appropriate oversight, and fair arrangements for the use of biological samples.

3. Legal framework in India

For an Indian-law analysis, the most important starting points are the Constitution of India, the Digital Personal Data Protection Act, 2023 (DPDP Act), applicable rules and commencement notifications, and relevant medical and research regulations.

A. Constitutional protection of privacy

Article 21 — Right to life and personal liberty

The Supreme Court has interpreted Article 21 to protect privacy, dignity, and personal autonomy. A child's genetic information may fall within these interests because it can reveal intimate information about health, family relationships, and biological identity.

Article 14 — Equality before the law

If a public authority uses genomic information to discriminate arbitrarily between children or families, Article 14 may be relevant. Private companies are not automatically subject to Article 14 in the same way as the State, although statutory and other legal remedies may apply to their conduct.

Article 15 — Prohibition of discrimination

Article 15 prohibits specified forms of discrimination by the State and addresses discrimination on enumerated grounds. Its direct application to a private genomics business depends on the facts and applicable law; it should not be treated as a general, stand-alone prohibition of every form of genetic discrimination.

In practice, constitutional arguments are especially important where government agencies, public hospitals, publicly controlled research institutions, or state-backed genomic databases are involved.

B. Digital Personal Data Protection Act, 2023

The DPDP Act is central to the Indian analysis, but its commencement must be checked carefully. The official India Code text records a phased commencement notification dated 13 November 2025. As of 2 November 2026, some provisions are subject to later commencement dates, so enactment alone does not establish that every provision is already operative.

India Code+1

The following provisions are particularly relevant:

India Code+1

Section 9 is particularly significant. Its enacted text requires verifiable parental or guardian consent before processing a child's personal data, prohibits processing likely to harm the child's well-being, and restricts tracking, behavioural monitoring, and targeted advertising directed at children, subject to statutory exemptions.

These safeguards are relevant to commercial genomics platforms. For example, a company cannot assume that a parent who purchases a DNA test has thereby authorized every future use of the child's data for advertising, unrelated research, or commercial transfers.

However, genetic data is not separately defined as a special category in the DPDP Act in the same way that it is under some other jurisdictions' laws. The Act's general rules for personal data and children's data must therefore be read according to their actual scope, rather than assuming that India has adopted every feature of the European model.

C. Other potentially applicable Indian laws

Information Technology Act, 2000 and applicable SPDI Rules, 2011: The rules may remain relevant to covered bodies corporate and sensitive personal data, depending on their legal scope and the applicable transitional framework.

Consumer Protection Act, 2019: May be relevant to misleading genomic-test claims, unfair trade practices, and deficient services.

Clinical research and biomedical ethics requirements: May govern research involving children, human biological materials, or clinical testing, depending on the institution, study design, and applicable rules.

Indian Contract Act, 1872 and general principles governing minors: May affect the enforceability of online terms, consent documents, arbitration clauses, and other agreements involving children.

Intellectual property and confidentiality law: May affect the use of inventions, databases, proprietary analytical methods, and confidential research information. Ownership of an analytical method does not automatically confer unrestricted rights over a child's genomic data or biological sample.

The legal assessment must distinguish between a diagnostic test performed for a child's medical benefit and a commercial research programme that uses the child's information for an additional purpose.

4. Detailed explanation of the principal regulatory issues

4.1 Informed parental consent and the child's assent

A parent or lawful guardian may generally authorize appropriate healthcare or research activities on behalf of a child, subject to applicable law. But authorization is not unlimited.

A robust consent process should explain:

What biological sample will be collected.

What genetic information will be analysed.

Whether results may reveal unrelated or adult-onset conditions.

Whether the sample or genomic data will be shared with third parties.

Whether pharmaceutical development, commercial research, or licensing is contemplated.

How long the sample and data will be retained.

What deletion, withdrawal, and complaint mechanisms are available.

For research, age-appropriate assent should also be sought from children who can meaningfully participate in the decision, where applicable ethical and legal standards require it.

The child's interests may diverge from the parent's interests. A parent might want broad genetic screening for curiosity, commercial profiling, or future reproductive decisions even when the test offers no clear medical benefit to the child.

A regulator or court should therefore examine whether the decision was informed, proportionate, and consistent with the child's welfare, rather than treating a signature as conclusive proof of ethical conduct.

4.2 Commercial sale, licensing, and secondary use

Commercial exploitation can occur without the literal sale of a DNA sample. Examples include licensing genomic datasets, providing access to research partners, developing predictive models, or generating proprietary products from genomic analysis.

Important questions include:

Was the additional use disclosed?

Is the information identifiable or reasonably capable of being linked to a child?

Is the proposed purpose compatible with the original collection?

Is consent or another lawful basis required?

Are there restrictions on onward transfer or re-identification?

Does the arrangement create a foreseeable risk to the child or relatives?

Pseudonymisation is not the same as anonymisation. A dataset with names removed may still permit re-identification through genetic matching or combination with other datasets.

A commercial contract cannot, by itself, override applicable privacy legislation, research safeguards, or the child's legal rights.

4.3 Genetic discrimination and predictive profiling

A genomic prediction may indicate a statistical risk rather than a certain future outcome. Treating that prediction as an established fact can create unfair consequences.

For instance, a private school might attempt to use a commercial genetic report to classify children according to supposed academic potential. A future employer or insurer might attempt to infer future health costs from information collected during childhood.

Potential legal issues include discrimination, misleading representations, privacy violations, breach of confidentiality, and unfair or unlawful data processing. The precise cause of action depends on the jurisdiction and facts.

Regulation should require strong justification for consequential decisions based on genomic data and should prohibit unsupported claims that genetic characteristics determine a child's intelligence, personality, behaviour, or social worth.

4.4 Retention and destruction of biological samples

Biological samples can reveal substantially more information than the limited results originally requested by a customer. Continued storage may permit new analyses that were not foreseeable when the sample was collected.

A responsible retention policy should therefore specify:

The clinical or research purpose of storage.

The period for which retention is necessary.

Who can access the sample and associated records.

The circumstances in which a sample may be transferred.

Procedures for secure destruction when retention is no longer justified.

Exceptions for legally required retention or ethically approved research.

A parent's withdrawal of permission does not necessarily mean every record must be immediately erased in every jurisdiction. Legal obligations, research-integrity requirements, and statutory exceptions may apply. Nevertheless, businesses should not assume that indefinite storage is permissible simply because it appears in boilerplate terms.

4.5 Corporate accountability and remedies

Depending on the facts, a genomics business may face:

Regulatory directions, penalties, or other statutory consequences.

Civil claims for breach of contract, confidentiality, or other actionable wrongs.

Consumer complaints concerning misleading claims or deficient services.

Injunctions or orders restricting further processing or disclosure.

Research-ethics sanctions or institutional disciplinary action.

Contractual and reputational consequences arising from misuse or data breaches.

For a strong compliance programme, the company should conduct a privacy impact assessment, restrict employee access, maintain audit logs, assess vendors and research partners, secure genomic databases, and document every purpose for which children's samples and data are used.

5. Important case laws and their legal principles

The following judgments provide useful foundations for regulating commercial child-genomics exploitation. Some directly concern children's genetic information; others establish broader privacy, bodily-material, or autonomy principles. They should not all be described as judgments specifically creating a cause of action for commercial child-genomics exploitation.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Supreme Court of India · (2017) 10 SCC 1 · Decided 24 August 2017

Facts and issue: A nine-judge bench considered whether privacy is a constitutionally protected fundamental right in India, in litigation arising in the context of the Aadhaar scheme.

Decision: The Court unanimously recognized privacy as a fundamental right protected by Article 21 and other freedoms guaranteed by Part III of the Constitution.

Indian Kanoon+1

Application to child genomics:

Genetic information may engage informational privacy and personal autonomy.

State collection or retention of genomic data must be assessed against applicable constitutional standards.

A government-backed genomic database cannot be justified merely by asserting administrative convenience; the legal basis, legitimate purpose, and safeguards matter.

The principles of dignity and autonomy support careful protection of children's intimate biological information.

Limitation: Puttaswamy did not establish a comprehensive code governing commercial DNA testing, nor did it hold that every private commercial use of genetic data is automatically unconstitutional. Its relevance is as a constitutional foundation, applied alongside the legislation governing the particular conduct.

Case 2: Coatney v. Ancestry.com DNA, LLC (2024)

United States Court of Appeals for the Seventh Circuit · No. 22-2813 · Decided 15 February 2024

Facts: Children whose guardians had activated DNA-testing kits through Ancestry accounts alleged that confidential genetic information had been disclosed to another business. The company sought to compel arbitration under the terms accepted by the guardians.

Decision: The Seventh Circuit upheld the denial of the motion to compel arbitration. Applying Illinois law, it concluded that the children were not bound by the arbitration agreement merely because their guardians had agreed to it; the children had not themselves entered into the agreement or independently engaged with the service or obtained the relevant direct benefits alleged to support enforcement.

Justia Law+1

Legal significance:

A parent's acceptance of online terms does not invariably bind a child to every contractual provision.

Arbitration clauses and other limitations on remedies require a valid basis for enforcement against the particular claimant.

Companies handling children's DNA should distinguish the parent's contractual relationship from the child's own legal interests.

Contract drafting cannot safely substitute for a careful assessment of the child's privacy rights and the applicable law.

Limitation: The decision concerned arbitration and contract enforceability, not a final determination that the alleged genetic-data disclosure was unlawful. It is a US appellate decision and does not bind Indian courts.

Case 3: S. and Marper v. United Kingdom (2008)

European Court of Human Rights, Grand Chamber · Applications Nos. 30562/04 and 30566/04 · Decided 4 December 2008

Facts: One applicant was 11 years old when arrested. After the criminal proceedings against the applicants ended, authorities retained their fingerprints, cellular samples, and DNA profiles.

Decision: The Grand Chamber held that the retention of the applicants' fingerprints, cellular samples, and DNA profiles violated Article 8 of the European Convention on Human Rights. The judgment emphasized the sensitive character of genetic information, its potential to reveal information about relatives, and the need for adequate safeguards against misuse.

Bailii+1

Application to commercial genomics:

Retention itself may interfere with privacy, even without proof that the data was subsequently misused.

Genetic material may reveal much more than the narrow purpose for which it was initially collected.

Children's genetic records warrant particular caution.

Indefinite retention without sufficiently precise limits and safeguards is difficult to justify.

Limitation: The case concerned state retention of DNA in a criminal-justice context, not commercial DNA-testing companies. Its principles are persuasive comparative guidance rather than directly binding Indian precedent.

Case 4: Moore v. Regents of the University of California (1990)

Supreme Court of California · 51 Cal. 3d 120 · 793 P.2d 479

Facts: John Moore's cells were used in research that led to the development of a commercially valuable cell line. He alleged that the physicians involved had not adequately disclosed their economic interests.

Decision: The California Supreme Court allowed claims based on alleged failures of informed consent and breach of fiduciary duty to proceed, but rejected his conversion claim based on a property interest in the excised cells.

Indian Kanoon

Application to child-genomics regulation:

Medical professionals and research institutions should disclose material conflicts of interest.

Consent to a medical procedure is not necessarily informed consent to every subsequent commercial research use.

Commercial benefits arising from biological material raise questions about transparency, duties to patients, and the proper scope of authorization.

Limitation: Moore did not establish that individuals universally own all information or inventions derived from their biological samples. Its property-law holding is jurisdiction-specific, and it did not concern a child's genome.

Case 5: X and Another v. Z (Children) and Another (2015)

England and Wales Court of Appeal · [2015] EWCA Civ 34 · Decided 5 February 2015

This case considered the legal implications of retaining DNA profiles and cellular samples in a context involving children and criminal investigations. The court discussed the ability of DNA profiles to reveal familial relationships and the privacy implications of retaining genetic information.

Bailii

Application: It illustrates why genomic privacy is not exclusively individual. A child's DNA can disclose biological relationships and information about parents, siblings, and other relatives. Commercial companies should therefore consider familial privacy risks when designing data-sharing and genetic-matching services.

Limitation: Its criminal-justice setting and procedural context mean that it should be used as supporting authority, not as a direct ruling on commercial exploitation.

6. Comparative legal position

The comparison shows that a single consent form is rarely a complete compliance solution. A business operating across borders may need to satisfy different standards for parental authorization, research consent, commercial transfers, data retention, and remedies.

Case 6: R (on the application of Catt) v. Commissioner of Police of the Metropolis (2015)

UK Supreme Court · [2015] UKSC 9

This case concerned the retention of personal information by police authorities and the compatibility of that retention with privacy rights. Although it was not a child-genomics or commercial DNA case, it illustrates the need to examine the justification for retaining personal information and the proportionality of the retention arrangements.

Application: Genomics companies should be able to explain why they retain children's genomic information, how long retention is necessary, and what safeguards protect against unrelated future use. The judgment is supplementary to the more directly relevant DNA-retention principles in S. and Marper.

7. Applying the law to hypothetical disputes

The following examples illustrate how the principles may operate in practice.

Scenario A: DNA data sold to a pharmaceutical company

Facts: A company collects a child's DNA sample for a health report, then transfers identifiable genomic information to a pharmaceutical business for unrelated commercial research without adequate authorization.

Potential legal analysis:

Examine whether the transfer has a lawful basis under the applicable data-protection framework.

Assess whether parental authorization covered this specific use.

Determine whether medical confidentiality, research rules, or contractual restrictions apply.

Consider regulatory complaints and appropriate civil remedies.

Relevant authorities: Puttaswamy, Moore, and the applicable Indian data-protection legislation.

Scenario B: A genetic test marketed as an intelligence predictor

Facts: A business advertises a DNA test as a reliable way to identify children with superior intelligence and sells the results to parents.

Potential legal analysis:

Examine whether the claims are scientifically supported.

Assess possible misleading advertising or unfair trade practices.

Investigate whether the processing is likely to harm children's well-being.

Consider whether the product creates an unjustified risk of discrimination or stigmatization.

Likely regulatory concern: A disclaimer may not cure a misleading headline or an unsupported promise about a child's future abilities.

Scenario C: A child's DNA is retained indefinitely

Facts: A company retains a biological sample after completing a one-time test and refuses to explain its future uses.

Potential legal analysis:

Review the disclosed purpose and retention policy.

Determine whether continued storage remains lawful and necessary.

Assess the applicability of erasure rights and statutory exceptions.

Consider whether continued retention creates disproportionate privacy risks.

Relevant authority: S. and Marper v. United Kingdom, particularly its analysis of the privacy implications of retaining DNA samples and profiles.

8. A proposed regulatory model for commercial child genomics

A comprehensive regulatory framework could incorporate the following safeguards. These are policy recommendations, not a claim that every safeguard is already expressly mandated by Indian law.

9. Key legal distinctions

Three distinctions are essential in applying this framework.

First, parental permission is not unrestricted commercial ownership. A parent may authorize appropriate decisions for a child, but that authority does not automatically override legislation, professional duties, or the child's welfare.

Second, a biological sample, genomic information, and a commercial invention are legally distinct. Moore demonstrates why commercial value generated from biological material does not automatically establish a proprietary right in every resulting invention. It also demonstrates why disclosure and informed consent can remain important even where a property-based claim fails.

Justia Law+1

Third, privacy protection and research prohibition are not the same thing. Legitimate pediatric diagnostics and ethically conducted genomic research can produce substantial public benefits. The regulatory objective is to ensure that these activities have a defensible purpose, appropriate authorization, proportionate safeguards, and accountability.

10. Conclusion

Commercial Child-Genomics Exploitation Regulation is best understood as a developing field at the intersection of child welfare, genetic privacy, informed consent, commercial research, and corporate accountability.

In India, Puttaswamy supplies a constitutional foundation for privacy and autonomy, while the DPDP Act and its commencement framework must be applied according to the provisions actually in force at the relevant time. Comparative decisions such as Coatney, S. and Marper, and Moore provide useful guidance on children's contractual interests, DNA retention, informed consent, and the commercial use of biological material.

The central principle is that a child's genome should not be treated merely as a commercial asset. Commercial use must be evaluated against the child's welfare, the applicable legal basis, the scope of authorization, the risks of disclosure, and the need to preserve the child's future autonomy.

Academic note: The authorities discussed above establish related legal principles; they do not collectively constitute a single, settled doctrine specifically titled “Commercial Child-Genomics Exploitation Regulation.” Any real dispute requires jurisdiction-specific analysis of the applicable legislation, facts, consent documents, and remedies.