How can children have social media accounts, asks court

1. At a Glance

• The Supreme Court has asked how children in India can hold social media accounts. Under Indian law a minor cannot enter a contract, and an "account" is a contract between the platform and the child [1].
• The court said such contracts are void ab initio, meaning void from the start [1].
• The case links three bodies of law: contract law (who is competent to contract), data protection law (the DPDP Act, 2023 and DPDP Rules, 2025) and intermediary regulation (the IT/Intermediary Rules) [1][2].
• For UPSC, the topic touches child rights, platform accountability, Article 21 privacy, and how courts push the executive to make rules. It matters for GS-II and GS-III [1][2].

2. Why in the News

• 28 Sept 2026 (Monday): a Bench headed by CJI Surya Kant heard a plea by the NGO Just Rights for Children Alliance (JRCA), argued by senior advocate H.S. Phoolka. The plea seeks safeguards for children accessing social media [1].
• Justice Joymalya Bagchi asked whether platforms let children aged 12–15 open accounts, and called an account "a contract between the social media platform and a child" [1].
• Solicitor-General Tushar Mehta said the issue was prima facie covered by the DPDP Act, 2023. JRCA replied that the relevant provisions come into force only in 2027 [1].
• Justice Bagchi suggested the government issue directions under the Intermediary Rules so that platforms follow an 18-year minimum threshold [1].

3. Background & Evolution

• Contract-law base: a contract with a minor is void ab initio (the Bench said so) [1]. Static: competence to contract is set by Section 11, Indian Contract Act, 1872, and Mohori Bibee v. Dharmodas Ghose (Privy Council, 1903) held minors' agreements void. These are standard static facts, not from the retrieved sources.
• 2023: Parliament enacted the Digital Personal Data Protection Act, 2023, the statutory framework for digital personal data [1][2].
• January 2025: MeitY released the Draft DPDP Rules, 2025 for public consultation. Comments were due by 18 February 2025 [4][6].
• 14 November 2025: the DPDP Rules, 2025 were notified, marking the full operationalisation of the DPDP Act, 2023 [2][3].
• 2027: according to the petitioner, the relevant provisions take effect only in 2027 (phased commencement) [1].
• Sept 2026: the Supreme Court raised the contract-validity question in the JRCA plea [1].

4. Core Static Facts

Item	Fact
Parent ministry (data protection)	Ministry of Electronics & IT (MeitY) [3][5]
Principal statute	Digital Personal Data Protection Act, 2023 [1][2]
Subordinate legislation	DPDP Rules, 2025, notified 14 Nov 2025 [2][3]
Child data rule	Verifiable consent of parent/guardian needed before processing a child's personal data [2][3]
How consent is checked	Identity and age verification, including virtual tokens [2][3]
Exemptions from parental consent	Limited essential purposes: healthcare, education, real-time safety [2][3]
Banned practices towards children	Tracking, behavioural monitoring, targeted advertising [2][3]
Age threshold cited by Court	18 years [1]
Other regulatory lever named	Intermediary Rules (under the IT Act) [1]
Contract status of minor's account	Void ab initio [1]
Petitioner	Just Rights for Children Alliance (JRCA), an NGO [1]

5. Multi-Dimensional Analysis

Legal / Constitutional

• A platform's terms of service are a contract. If the user is a minor, the contract is void ab initio, which casts doubt on the legal basis of every account held by a minor [1].
• The DPDP framework handles the problem through verifiable parental consent, not an outright ban. The Court floated an 18-year floor through the Intermediary Rules [1][2].
• The gap in timing matters. The Rules were notified in Nov 2025, but the relevant duties take effect only in 2027, leaving children unprotected in between [1][2].

Social

• Children as young as 12–15 reportedly hold accounts [1].
• The ban on behavioural monitoring and targeted advertising directed at children protects vulnerable users from manipulative design [2][3].
• There is a trade-off between protection and children's access to information, education and expression. The healthcare, education and safety exemptions show the Rules try to balance this [2][3].

Scientific / Technological

• Enforcement depends on age assurance: identity and age verification and virtual tokens [2][3].
• Mandatory age checks raise questions of their own. They require collecting more data, which can conflict with data minimisation. (Analytical point, not from sources.)

Ethical / Governance

• Platform accountability: the Bench asked "What are these social media platforms doing?", putting the burden of compliance on intermediaries [1].
• Separation of powers: the Court suggested executive action under existing rules rather than laying down its own guidelines [1].
• Consultative rule-making: the draft DPDP Rules went through public consultation in early 2025 [4].

Administrative

• Two regulatory tracks cover the same ground: DPDP (data fiduciary obligations) and the IT Act / Intermediary Rules (platform due diligence). Both come under MeitY [1][3][5].
• Phased commencement means enforcement is postponed to 2027 [1].

6. Recent Developments (last 12–18 months)

• Jan–Feb 2025: Draft DPDP Rules released; comments invited until 18 Feb 2025 [4].
• 14 Nov 2025: DPDP Rules, 2025 notified, with verifiable parental consent and a ban on tracking and targeted ads for children [2][3].
• 28 Sept 2026: Supreme Court (CJI Surya Kant's Bench) questioned the validity of minors' social media accounts in the JRCA plea. It suggested directions under the Intermediary Rules for an 18-year threshold [1].

7. Prelims Hooks

• A contract with a minor is void ab initio, i.e. void from the beginning [1].
• The PIL on children's social media safeguards was filed by the NGO Just Rights for Children Alliance [1].
• The Bench that heard it was headed by CJI Surya Kant [1].
• The Union was represented by Solicitor-General Tushar Mehta [1].
• The DPDP Act was enacted in 2023 [1].
• The DPDP Rules, 2025 were notified on 14 November 2025 [2][3].
• The nodal ministry for DPDP is MeitY, not the Ministry of Women & Child Development or the Ministry of Law [3][5].
• Processing a child's data needs the verifiable consent of a parent or guardian [2][3].
• Parental consent is exempted for healthcare, education and real-time safety purposes [2][3].
• Tracking, behavioural monitoring and targeted advertising directed at children are prohibited [2][3].
• Verifiable consent can be obtained through age/identity verification and virtual tokens [2][3].
• Public comments on the draft DPDP Rules were due by 18 Feb 2025 [4].
• The Court suggested an 18-year minimum age for accounts through the Intermediary Rules [1].

8. Why "Void Contract" Does Not Settle the Question

• Calling the contract void does not make the child safer
• The Bench said a minor's account is a contract that is void ab initio (void from the start) [1].
• But a void contract only means neither side can enforce it in court. The platform cannot enforce its terms against the child, and the child cannot enforce the platform's promises either.

• Nothing in contract law stops the platform from collecting the child's data or showing the child harmful content. Those harms have to be dealt with by a separate law, not by the contract.

• This is why the Solicitor-General pointed to the DPDP Act, not the Contract Act

• The DPDP framework does not ask whether the contract is valid. It asks whether the data fiduciary (the company that decides how personal data is used) got verifiable parental consent [1][2].

• So contract law raises the question, but only data law and platform law can answer it.

• The same argument would reach far beyond social media

• Every online service a child signs up for runs on terms of service: gaming apps, e-learning apps, email.
• If "void contract" were enough to ban accounts, all of these would fall too. That includes the education services the DPDP Rules deliberately exempt from parental consent [2][3].
• The contract point works as a way to question platforms. It is too blunt to be the rule itself.

9. Parental Consent or Outright Ban: What Australia Did Differently

• India lets parents decide. Australia took the decision away from parents
• Under India's DPDP Rules, a child under 18 can use a platform if a parent or guardian gives verifiable consent [2][3].
• Australia's Online Safety Amendment (Social Media Minimum Age) Act, 2024 set a minimum age of 16. Parents cannot consent on behalf of under-16s [9].

• It came into force on 10 December 2025. Platforms like Facebook, Instagram, TikTok, Snapchat, X and YouTube face fines of up to A$50 million if they do not take "reasonable steps" to remove under-16 accounts [10].

• A ban places the whole burden on the company. Consent splits it with the family

• Under Rule 10, platforms must confirm who the parent is and that the parent is related to the child [7].
• After that one check, the parent carries the responsibility. A parent who does not understand the app, or who shares one phone with the child, can approve it without knowing the risks.

• Under Australia's ban, no parental approval unlocks the account, so a careless or pressured parent cannot let the child in.

• But a ban is only as good as its enforcement

• In March 2026, Australia's regulator said Meta, YouTube and others were not fully complying with the ban [11].
• A strong rule on paper still depends on the platforms checking age honestly. The same weakness would apply to an 18-year floor in India.

10. The Case Against a Court-Pushed 18-Year Floor

• The strongest objection: Parliament has already chosen a different model
• The DPDP Act, 2023 is a later and more specific law. It chose consent, not a ban, for users under 18 [1][2].
• The Court suggested that the executive use the Intermediary Rules (rules under the IT Act that set the "due diligence" platforms must follow) to impose an 18-year threshold [1].

• Those are delegated legislation (rules made by the government under an Act, not passed by Parliament). Using them to impose a ban that Parliament chose not to impose could be challenged as going beyond the parent Act.

• Second objection: bans push children elsewhere instead of protecting them

• UNICEF warned in December 2025 that age-based bans will not, on their own, keep children safe [12].
• A 17-year-old kept off mainstream platforms may move to smaller, less-regulated apps, or lie about their age. Either way, the child is then outside the DPDP protections, such as the ban on targeted advertising.

• An 18-year floor is also stricter than Australia's 16 [9]. It would cut off older teenagers who use these platforms to learn, prepare for exams and speak publicly.

• What the objection gets right, and what it misses

• It is right that a blanket 18-year ban made by executive order sits badly with the DPDP Act.
• It misses the timing gap. The DPDP Rules give up to 18 months for phased compliance [3], so the child-data duties bind only from 2027 [1].
• Until then children have neither a ban nor enforceable parental consent. The Court's push is best read as a demand to fill that gap, not as a final choice of model.

11. To Check a Child's Age, Platforms Must Check Everyone

• Age checks cannot target only children
• A platform cannot know who is under 18 without asking every user. Adults will also have to prove their age.

• This is already happening in India: WhatsApp began asking Indian users to verify their age in August 2026 [14].

• More checking means more data in company hands

• The Rules allow age and identity checks, including virtual tokens (a digital proof of age that does not reveal the full identity document) [2][3].

• If platforms instead collect ID documents or face scans, they build large stores of sensitive data. That goes against data minimisation (collecting only the data that is really needed), a principle the DPDP Act itself follows.

• So the method of checking matters as much as the age limit

• Virtual tokens protect privacy only if they are cheap, widely accepted and trusted by platforms. Otherwise platforms will fall back on collecting documents.

12. What Should Happen Before the 2027 Deadline

• MeitY should bring forward the child-data duties for large social media platforms
• The 18-month phase-in [3] treats a small start-up and a platform with crores of users the same way.

• The biggest platforms are the ones children actually use [1]. The government can make the child provisions apply to them first, which closes most of the gap the Court is worried about.

• MeitY should specify one privacy-safe way to verify age

• Rule 10 says platforms must take "appropriate technical and organisational measures" but leaves the method open [7].
• A government-backed virtual token [2] used by every platform would stop each company from collecting IDs in its own way.

• MeitY already promised in January 2025 that the child-protection rules could be refined further [8]. The Court hearing is the moment to do it.

• Regulate the design, not just the door

• The OECD's 2026 review of policies on young people and social media looks at approaches beyond age limits, such as safer platform design [13].
• UNICEF also says platforms must be made safer, because a ban alone is not enough [12].

• India's Rules already ban tracking and targeted ads for children [2]. The next step is rules on harmful features: endless scroll, autoplay, and contact from strangers.

• If Parliament wants a minimum age, Parliament should set it

• Australia set its age of 16 by amending an Act, with penalties written into the statute [9][10].
• India should do the same by amending the DPDP Act or the IT Act, rather than issuing executive directions under the Intermediary Rules. That keeps the rule safe from legal challenge.

13. Anchors for Answers

• Data: DPDP Rules give data fiduciaries up to 18 months for phased compliance, so child-data duties bind only from 2027 [3][1]
• Data: Australia's platforms face fines of up to A$50 million for failing to remove under-16 accounts [10]
• Report/Committee: OECD, Growing Up in the Social Media Age (Digital Economy Paper No. 385, 2026) [13]; UNICEF warning (Dec 2025) that age bans alone will not keep children safe [12]
• Law/Case: DPDP Act, 2023 and Rule 10 of the DPDP Rules, 2025 (verifiable parental consent) [7]; Intermediary Rules under the IT Act [1]; void ab initio minor's contract [1]
• Comparison: Australia's Online Safety Amendment (Social Media Minimum Age) Act, 2024: an under-16 ban with no parental opt-in, in force from 10 Dec 2025 [9][10], yet the regulator reported incomplete compliance by Meta and YouTube in 2026 [11]

14. Mains Relevance

• GS-II: Government policies and interventions; welfare of vulnerable sections (children); role of the judiciary; statutory and regulatory bodies.
• GS-III: Challenges to internal security through communication networks and social media; cyber security; IT and data governance.
• GS-IV: Corporate ethics; the duty of care that digital platforms owe to minors.
• Possible question stems: 1. "A social media account is, in law, a contract." Examine the legal validity of minors' online accounts in India and the adequacy of the DPDP framework in protecting children online. (15 marks) 2. Discuss the tension between children's online safety and their digital rights. Critically evaluate verifiable parental consent as a regulatory tool. (10 marks) 3. Should India prescribe a statutory minimum age for social media use? Discuss with reference to recent judicial observations and the IT/Intermediary Rules. (15 marks)

15. Related Topics to Study Next

• Indian Contract Act, 1872 (competence to contract): the legal basis for the "void ab initio" observation.
• IT Act, 2000 and IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021: the tool the Court suggested for an age floor.
• Right to Privacy, K.S. Puttaswamy (2017): the constitutional basis for data protection law.
• Data Protection Board of India: the adjudicating body under the DPDP Act.
• POCSO Act, 2012: the wider law on child online safety and exploitation.
• UN Convention on the Rights of the Child: the international standard on child protection and participation.
• Other countries' age limits for social media: for comparative answers.

16. Common Errors / Trap Areas

• Void vs. voidable: a minor's contract is void ab initio, not voidable [1].
• Act year vs. Rules year: the Act is from 2023; the Rules were notified in Nov 2025. The relevant provisions take effect in 2027, per the petitioner [1][2].
• Wrong ministry: DPDP comes under MeitY, not MWCD or MHA [3][5].
• Consent vs. ban: the DPDP framework requires parental consent. It does not ban under-18 users. The 18-year "threshold" was the Court's suggestion under the Intermediary Rules [1][2].
• Exemptions: only healthcare, education and real-time safety are exempt, not all "educational platforms" in general [2][3].