Supreme Court Asks Centre to Use IT Rules to Bar Under-18s From Opening Social Media Accounts

The news

New Delhi. The Supreme Court on Monday, September 28, asked the Union government to put in place statutory rules so that social media platforms and other digital intermediaries comply with Indian law on minors and make 18 years the minimum age for membership. A three-judge Bench presided over by Chief Justice of India Surya Kant, with Justices Joymalya Bagchi and V. Mohana, was hearing a public interest litigation (PIL) by the NGO Just Rights for Children Alliance (JRCA), filed through advocate Saksham Maheshwari and argued by senior advocate H.S. Phoolka. Notices went out on September 10 to the Electronics and IT, Law and Labour Ministries. The core of the argument is legal capacity. Under Section 3 of the Majority Act, 1875, a person attains majority only on completing 18 years, and under Section 11 of the Indian Contract Act, 1872, a person below majority is not competent to contract. An account is a contract, and a minor’s contract is, as the Bench put it, void ab initio — void from the very beginning, as if it never existed. “What are these social media platforms doing? Are they permitting children as young as 12 years to 15 years to have accounts? And what is an ‘account’? It is a contract between the social media platform and a child,” Justice Bagchi said, The Hindu reports. The petition says platforms let children aged 13 and above open accounts merely by declaring their age, a “fundamental legal and regulatory inconsistency”. Justice Bagchi noted that these intermediaries — companies that host content posted by others — are registered under US law and have “imported into Indian digital space the restrictions which are applicable in the US”. The Indian Express reports that CJI Kant said the government can invoke sections 4 and 9 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, to issue directions, and Justice Bagchi urged the government to direct platforms to “fashion their software or platform in conformity with Indian law” with “a minimum threshold of 18 years”. Solicitor-General Tushar Mehta agreed that minors cannot contract under Indian law, said “we will have to control the intermediaries”, and added, “Government is ready to do that.” He also submitted that the issue is prima facie covered by the Digital Personal Data Protection Act, 2023; Mr. Phoolka replied that its provisions come into force only in 2027. The PIL seeks age-assurance mechanisms (real checks of age, not self-declaration), an end to independent accounts for minors, and educational access through parent-run accounts. The 21 September card covered the EU’s under-15 proposal; what is new is that India’s top court has framed the question through contract law. The syllabus link is GS2 on government policies, statutory bodies and the protection of vulnerable sections, and GS3 on cyber security.

Static syllabus linkage

1. A minor cannot make a contract in India, and such an agreement is void from the start. Section 10 of the Indian Contract Act, 1872 says an agreement is a contract only if made by the free consent of parties competent to contract, for a lawful consideration and a lawful object. Section 11 defines a competent person as one who has attained the age of majority, is of sound mind and is not disqualified by law. In Mohori Bibee v. Dharmodas Ghose (1903), the Privy Council held that a mortgage executed by a minor was void ab initio, not merely voidable, and that the minor could not be made to repay the money advanced. Section 68 of the Act is a narrow exception: a supplier of “necessaries” to a minor can recover the price from the minor’s property, but not from the minor personally. The Majority Act, 1875 fixes the age of majority at 18.
2. The DPDP Act, 2023 treats everyone below 18 as a child and demands parental consent. The Digital Personal Data Protection Act, 2023 defines a “child” as an individual who has not completed 18 years. Section 9 requires a data fiduciary — the company deciding why and how personal data is processed — to obtain the verifiable consent of a parent or lawful guardian before processing a child’s personal data. It also bars processing likely to harm a child’s well-being and prohibits tracking, behavioural monitoring and targeted advertising directed at children. The Act lets the government exempt certain classes of fiduciaries or purposes from these conditions. The DPDP Rules, 2025 phase in the substantive obligations, which is why the petitioner told the court the provisions come into force only in 2027.
3. Safe harbour protects platforms only if they follow the government’s due-diligence rules. Section 79 of the Information Technology Act, 2000 exempts an intermediary from liability for third-party content it hosts, provided it observes due diligence and acts on lawful orders. In Shreya Singhal v. Union of India (2015), the Supreme Court read down Section 79 so that “actual knowledge” means a court order or a government notification, not a private complaint. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 spell out these due-diligence duties, with extra obligations for “significant social media intermediaries” above a user threshold notified by the government. A platform that ignores the Rules risks losing its safe harbour, which is the lever the Bench asked the Centre to pull.
4. Children’s rights in the digital space rest on Article 21 and international commitments. In Justice K.S. Puttaswamy v. Union of India (2017), a nine-judge Bench held privacy to be a fundamental right under Article 21. India is a party to the UN Convention on the Rights of the Child, which defines a child as a person below 18 and makes the best interests of the child a primary consideration in all actions concerning children. The Juvenile Justice (Care and Protection of Children) Act, 2015 and the Protection of Children from Sexual Offences Act, 2012 also use 18 as the age line. Article 39(f) of the Directive Principles asks the State to ensure that children are protected against exploitation and moral and material abandonment.

Why UPSC loves this

1. GS2 asks about the protection of vulnerable sections and the regulation of big technology. Mains questions have asked about data protection, the accountability of social media platforms and the balance between free speech and regulation. This case adds a clean legal hook — contractual capacity — that a candidate can use to argue that platform regulation need not wait for a new law. It also fits GS2’s “mechanisms, laws, institutions and bodies constituted for the protection and betterment of these vulnerable sections”.
2. Prelims tests the vocabulary of digital law. UPSC has asked about the IT Act, 2000, the DPDP Act, 2023 and the meaning of terms such as intermediary and data fiduciary. The definition of a child under the DPDP Act, the safe-harbour provision in Section 79 and the Contract Act’s rule on minors are the kind of settled provisions Prelims prefers.
3. A global wave of age limits is now reaching India. Australia legislated a minimum age of 16 for social media accounts, and the EU is weighing parental gates for under-15s, as this magazine reported on 21 September. An answer on children’s online safety should compare these models — outright bans, parental consent and design-based duties — rather than treat India’s debate in isolation.

Analysis

1. The Bench has found a way to regulate platforms without waiting for a new law. The usual debate on children and social media asks whether Parliament should ban accounts below some age. The Bench sidestepped that by pointing out that Indian law already does not recognise a child’s account as a valid contract. If the contract is void, the platform’s terms of service cannot bind the child, and the platform’s claim that the child “agreed” to data collection collapses. Combined with the IT Rules, which are delegated legislation the executive can amend quickly, this gives the government a route that does not require a fresh Bill. The counter-view is that courts should not push the executive into rule-making on a policy question, since the choice of an age line involves trade-offs that belong to the legislature.
2. Void contract logic cuts both ways and could hurt children more than platforms. If a minor’s account is void, the child also loses the contractual protections — grievance redress, data deletion obligations under the platform’s own policy — that flow from the terms of service. Void-contract doctrine was built to protect minors from being bound by bad bargains, not to shut them out of public spaces. A child who uses a messaging app for school groups, or a teenage creator who earns from content, would find that the law treats their activity as legally non-existent. The better reading is that the contract point justifies stricter rules on platforms, not the exclusion of children, and the petition itself asks for parent-controlled access to educational content.
3. Age assurance is the hard engineering problem the order does not solve. Platforms today rely on self-declared birth dates, which any child can falsify. Real age assurance means either document checks, which require collecting identity data from everyone, or estimation from face or behaviour, which raises privacy and error concerns. Requiring every Indian adult to prove age to open an account would expand data collection sharply, which sits awkwardly with the DPDP Act’s principle of data minimisation. The design of any rule will therefore decide whether child safety is bought at the cost of adult privacy. A graded approach — stricter checks only for features that carry higher risk, such as messaging strangers or monetisation — may be more workable than a single gate.
4. The DPDP timetable exposes a gap between law on paper and law in force. The Solicitor-General’s answer that the DPDP Act already covers the issue and the petitioner’s reply that it takes effect only in 2027 show the cost of long phase-in periods. The Act was passed in 2023, yet its parental-consent rule for children is not yet enforceable. Meanwhile platforms have no statutory duty beyond self-declaration. The court’s suggestion to use the IT Rules is effectively a bridge until the DPDP regime starts. It also means two parallel regimes — MeitY directions under the IT Rules and the Data Protection Board under the DPDP Act — may later need to be reconciled.
5. Setting the line at 18 is stricter than most of the world. The US-derived norm of 13 comes from American children’s privacy law, Australia chose 16 and the EU proposal discussed on 21 September looks at 15. An 18-year threshold would make India one of the strictest jurisdictions. Supporters argue that Indian law already uses 18 for majority, consent and child protection, so consistency demands it. Critics note that 16- and 17-year-olds use platforms for education, jobs and civic life, and a rigid ban may push them to borrowed accounts or unregulated apps. The choice is not only legal but social, and a public consultation before any rule would strengthen its legitimacy.

Administrator's brainstorm