If you run an Indian coaching or edtech brand, the safest testimonial workflow is: get the learner's written consent after the outcome is confirmed (not at enrolment), show their name, rank and course details, say whether they paid for the course, and keep a proof file for every claim. CCPA's 2024 coaching guidelines require written consent obtained after selection before using a successful candidate's name, photographs, testimonials or videos, and ASCI's education guidelines limit topper testimonials to students who completed your programme. This post turns those rules into a consent form, a proof pack and a UGC workflow.
Verified as of 14 October 2026, not legal advice. Primary sources are linked; confirm with counsel, especially on data protection.
Key Takeaways
- CCPA clause 4(2) of the coaching guidelines requires written consent, obtained after the candidate has been selected, to use a successful candidate's name, photographs, testimonials or videos in advertising.
- PIB's 15 May 2026 release on two penalised institutes cited featured students shown without proper consent, students who joined after the exams, and undisclosed free-batch status.
- ASCI says topper testimonials must come from students who completed the relevant programme and only from the advertising institute.
- The Digital Personal Data Protection (DPDP) Rules were notified on 13 November 2025; the main substantive obligations, including children's data rules, are scheduled for 13 May 2027, with a reported proposal to shorten timelines that I found no evidence had been notified as of the sources I checked.
- Influencer and UGC content that you amplify becomes your advertising; disclosure and claim-substantiation duties follow it.
What the rules actually say
CCPA coaching guidelines (statutory)
The Guidelines for Prevention of Misleading Advertisement in Coaching Sector, 2024 were notified on 13 November 2024 and apply to all advertisements by any person, including endorsers, in the coaching sector. Relevant clauses from the text:
- 3(b): false claims about selections, exam ranks or success rates are misleading advertising.
- 4(1)(a): disclose important information, including the rank secured, course name and duration, and whether the course is paid.
- 4(1)(b): disclaimers and important information must be prominent, in the same font as the claim.
- 4(2): no use of a successful candidate's name, photographs, testimonials or videos without written consent, obtained after selection.
PIB's release of 13 November 2024 describes the same points: the ad must state the student's name, rank and course details and whether the student paid; consent may be obtained only after success, not upfront at enrolment. The coaching definition excludes counselling, sports and creative activities, and a "coaching center" is one coaching more than fifty students, so confirm with counsel whether your offering falls inside.
ASCI education guidelines (self-regulatory)
The ASCI guidelines name edtech platforms in scope. Rule 5(d): topper testimonials must be from students who completed the relevant programme, exams or subject, and only from the advertising institute. Rule 5(e): placement numbers need the total number of students who passed out from that class. Ranking claims need the publication name and date (rule 5(b)).
What enforcement has focused on
PIB's 15 May 2026 release says CCPA penalised Motion Education Pvt. Ltd. (₹10 lakh) and Career Line Coaching, Sikar (₹5 lakh). The reported findings include:
- Featured students were shown while advertising paid programmes, without disclosing most were in a free rankers' batch.
- Photos and names of students who joined after the exams, and of students without proper consent, were used.
- Featured students' actual courses were concealed in some cases (some were enrolled only in test series).
- The institutes could not substantiate several claims when asked for documents.
Both appealed to the NCDRC, per the release, so this is not final. For marketers the lesson is practical: the regulator asked for documents, so the proof file matters as much as the creative.
The timing problem: consent after the result, not at enrolment
Many edtech funnels bundle a "marketing consent" clause into the enrolment form. Under the CCPA rule as described by PIB and the guideline text, that doesn't work for testimonial use: consent must be obtained after selection. Design for that:
- Enrolment form: no blanket media consent clause for testimonials.
- Outcome confirmed (result declared, offer letter received, certificate issued): your team contacts the learner.
- Learner reviews the exact creative or quote and signs a specific, dated consent.
- Consent record is stored with the proof of the outcome.
A consent form template
Adapt with counsel. Fields I'd include:
| Field | Why |
|---|---|
| Learner's full name and contact | Identify consent-giver |
| Parent/guardian name and signature if under 18 | Minors: see DPDP section below |
| Date of outcome and outcome description (for example, "Rank X in Exam Y, 2026") | Ties consent to a confirmed result |
| Course(s) taken and whether paid or free/scholarship | Needed for the paid/free disclosure |
| Exact assets covered: name, photo, quote, video | Specific, not blanket |
| Channels and duration (website, social, paid ads, print; for how long) | Limits scope |
| How to withdraw consent and who to contact | Operational |
| Date and signature, after outcome date | Evidences post-selection timing |
State plainly that taking part is voluntary, and that declining has no effect on services. Keep the language simple; for Hindi or regional-language learners, provide the form in their language.
The proof pack for every featured learner
Create one folder per featured student, and don't publish until it's complete.
- Evidence of the outcome (scorecard, offer letter, certificate) with date
- Enrolment record showing which course they actually took, and whether paid
- Signed consent dated after the outcome
- The final approved creative (screenshot of the exact ad or post)
- Approver name and date
- Planned expiry or review date
This is the document set a regulator's request would likely cover, based on what PIB's release says CCPA asked the penalised institutes for (documents to substantiate claims). It also gives you a quick takedown path if the learner withdraws.
UGC, reposts and creator content
Reposting a learner's Instagram story or LinkedIn post feels informal, but once you amplify it in marketing it's your advertisement.
Get permission explicitly. A "thanks for tagging us!" comment isn't a consent record. Send the consent form, and apply the same post-outcome timing if the content claims a result.
Check the claim, not just the permission. A learner may genuinely say "this got me a job at X," but your ad repeating it needs substantiation (ASCI rule 5(a) on latest completed academic year; CCPA clause 3(b)).
Disclose material connections. ASCI's influencer guide says material connections, monetary or not, must be disclosed, including free products, commissions and discount codes, with labels placed where they're visible without clicking "more" and not buried in hashtags or relied on in a bio. If you give learners a perk for posting, it's a material connection.
Don't disguise ads. The CCPA's Dark Patterns Guidelines, 2023 list "disguised advertisement" among 13 patterns: presenting ads as user content, news articles or other non-ad material. Paid placements dressed as organic learner stories fall into that area.
Endorser accountability. PIB's release says endorsers must verify the claims they promote. The CCPA's 2022 guidelines require endorsements to reflect genuine, reasonably current opinion based on real experience, with any material connection fully disclosed.
I cover how community-led channels can generate this kind of content without shortcuts in my community-led growth plan for edtech.
Data protection: the DPDP timeline as of 14 October 2026
Student names, photos and videos are personal data. Per AZB Partners' update on the DPDP Rules:
- 13 November 2025: Rules notified; Data Protection Board provisions and definitions took effect.
- 13 November 2026: consent manager registration requirements.
- 13 May 2027: substantive obligations, including notice and consent standards and children's data rules.
For a child, the Rules require verifiable parental consent, with verification of an identifiable adult parent. AZB notes certain entities, including educational institutions, are exempt from parental-consent and behavioural-monitoring restrictions only when processing is strictly limited to child-welfare functions such as education and safety. Marketing a learner's photo in an ad is, in my reading, not obviously that kind of function, but I'm not a lawyer, so this is a question to put to one.
On timing: a King, Stubb & Kasiva article of 14 August 2026 still puts the substantive provisions at 13 May 2027, and dpdprules.org said on its 12 October 2026 review that a reported proposal to cut an 18-month window to 12 months had not been notified, and that a Removal of Difficulties Order in October 2026 changed wording in two sections without changing commencement dates. Both are secondary sources, so verify against MeitY's official notifications before planning around a date.
Practical move now: build consent records that would satisfy both regimes. If the learner is under 18, treat the parent's signature as mandatory.
Reviews, ratings and "learner stories" pages
- Don't cherry-pick only top outcomes without context. Show the denominator where you state numbers (ASCI 5(e)).
- Label whether featured learners took a paid or free programme (CCPA, per PIB).
- Date every story and review it each academic year; stale outcomes become stale claims.
- Keep a "what typical learners experience" section next to the highlights. It reads more honestly, and it also helps in AI answers where assistants summarise your page; my notes on this are in the post on answer capsules.
Workflow by team
| Step | Owner | Output |
|---|---|---|
| Identify outcome | Student success | Evidence file |
| Request consent post-outcome | Marketing | Signed form |
| Verify claim vs register | Compliance/ops | Approved wording |
| Disclose paid/free, rank, course | Creative | Compliant creative |
| Publish and log | Social/SEO | URL, date, expiry |
| Quarterly sweep | Marketing | Expired or withdrawn items removed |
If the claims lead to wider auditing needs, see my edtech SEO audit post and the companion ASCI claims checklist.
What I couldn't verify
- Exact DPDP application to testimonial use by educational institutions; take legal advice.
- The Act's definition of "child" is not in the sources I opened; I've referred to under-18 as the working assumption in the template, so confirm it.
- Whether your product is "coaching" under CCPA's definition.
FAQ
Do I need written consent for student testimonials in India?
Under CCPA's coaching guidelines, yes: written consent to use a successful candidate's name, photographs, testimonials or videos, obtained after selection. If your offering sits outside that definition, similar care is still sensible, and data-protection rules apply to personal data.
Can I collect consent at enrolment?
For testimonial use under the coaching guidelines, no. PIB's description says consent may be obtained only after the student has succeeded, not upfront at enrolment.
What must I show next to a student's photo in an ad?
PIB says ads showing a student's photo must state the student's name, rank and course details, and clearly say whether the student paid for the course.
Can I use a toppers' photos if they were in a free batch?
You can only do so truthfully. The 15 May 2026 PIB release criticised featuring students without disclosing most were in a free rankers' batch while advertising paid programmes.
Do ASCI rules cover testimonials?
Yes. ASCI rule 5(d) says topper testimonials must come from students who completed the relevant programme, exams or subject, and only from the advertising institute.
Is reposting a learner's social post safe?
Not automatically. Treat it as your advertisement: get explicit permission, verify the claim, and disclose any perk or payment as a material connection.
What if the learner is a minor?
Under the DPDP Rules, children's data needs verifiable parental consent, with limited exemptions for strictly welfare-related education functions. Get a parent or guardian's signature and ask counsel about timing under the phased dates.
When do the DPDP substantive obligations apply?
Per AZB's update and a 14 August 2026 secondary article, 13 May 2027. A reported proposal to shorten some timelines was not found notified in the sources I checked.
How long should I keep consent records?
I haven't found a rule specific to testimonials in the sources I opened. Keep them for as long as the content is live, plus a period your counsel advises, and remove content when consent is withdrawn.
Work with me
I'm Younus Fardeen, an SEO and AEO strategist with 4+ years of marketing experience, including edtech and startup work. If you want help building a testimonial and proof-pack workflow that your marketing team can run without slowing down, see my work and use the contact form at https://younusfardeen.in.
Verified as of 14 October 2026, not legal advice.