"A social media account is, in law, a contract." Examine the legal validity of minors' online accounts in India and the adequacy of the DPDP framework in protecting children online.

The Supreme Court recently called a social media account "a contract between the platform and a child" [1]. Minors cannot legally contract, so these accounts stand on weak legal ground. The DPDP framework fills only part of the resulting protection gap.

Legal validity of minors' accounts

• Section 11, Indian Contract Act, 1872 says a minor cannot enter a contract, and Mohori Bibee v. Dharmodas Ghose (1903) held minors' agreements void. The Bench called such accounts void ab initio (void from the start) [1].
• Even so, children aged 12–15 reportedly hold accounts [1]. Platforms' click-through terms ignore the question of capacity.
• Limits of voidness: a void contract only means its terms cannot be enforced. It does not stop data collection or harmful content. Read literally, it would also void e-learning and email accounts.

DPDP framework: strengths

• Verifiable parental consent is required before a child's data is processed. It is checked through identity and age verification and virtual tokens [2].
• Tracking, behavioural monitoring and targeted advertising aimed at children are banned [3].
• Exemptions for healthcare, education and real-time safety balance protection with access [2].

DPDP framework: gaps

• Timing gap: the Rules were notified on 14 Nov 2025 with an 18-month phase-in [2], so the child-data duties bind only from 2027 [1].
• Burden on parents: consent shifts responsibility to parents, many of whom have low digital literacy or share a phone with the child. Australia instead bars under-16 accounts and places the onus on platforms (from 10 Dec 2025) [4].
• Privacy paradox: to find the children, platforms must check every user's age. This strains data minimisation.
• Data, not design: the Rules govern data use but not features such as endless scroll and contact from strangers. UNICEF warns that bans alone may backfire without safer design [5].
• Regulatory overlap: the Court floated an 18-year floor via the Intermediary Rules [1]. As delegated legislation, this could clash with the consent model Parliament chose in the DPDP Act.

Contract law exposes the problem, but only data law and platform law can solve it. MeitY should bring forward the child-data duties for large platforms, notify a single privacy-safe token-based age check, and add safety-by-design norms. Any age floor should come from Parliament, not executive directions. This would uphold Article 21 privacy (Puttaswamy) and the UNCRC's best-interests principle.