Adi Chaure*
How long does it take for a child to become an adult? Well, at least on social-media, less than five seconds: just change your year of birth, click “I agree”, and the age-barrier vanishes.
For as long as social-media has crept into our lives, this small fiction has worked flawlessly, since most platforms have had little reason to look behind it. A seventeen-year-old who declares herself eighteen and accepts the “Terms of Services”, is ordinarily treated as such, and is entitled to her personal account. The platform rarely cares if the age you filled is truly yours or not.
However, on 28 September 2026, Indian law tried to force open this contradiction. The Supreme Court, while hearing Just Rights for Children Alliance v. Union of India, pressed the Union Government to address minors maintaining social-media accounts despite being in contravention to Section 11 of the Indian Contract Act, 1872, which defines age of majority as an essential for contractual competence. While a social-media-membership may not seem like much, it begins legally with the contractual acceptance of a “Terms of Services.” The contradiction therefore presents itself as such: while the social-media architecture lets a minor cross the age-line by changing a date on a screen, the law expressly declares that a minor is not ordinarily bound by a contract.
An obvious solution to this contradiction would be to make platforms verify individual ages, but this solves only the easy half of the problem. If a self-declared birthday is not proof enough, something else is required to establish the person’s true age. A passport can do it- but it reveals far more than just age. Facial-age-estimation avoids document verification but simply replaces one kind of intrusion with another. And behavioural inference avoids both the above methods but practically becomes a “Big-Brother” surveillance system guessing your age from your digital activity, online behaviour, and so on.
Ironically, the harder it becomes to cheat an age-gate, the more information somebody may have to surrender to cross it. India may, therefore, solve one legal inconsistency, but create another regulatory problem: how can a platform know whether you are old enough to enter without first requiring it to know who you are?
Three Laws, One Child, and a Gap in the Middle
The first problem arises with Section 11 of the Indian Contract Act, which requires majority for contractual competence. Mohori Bibee v. Dharmodas Ghose aptly ruled that a minor’s agreement is void. Likewise, an electronic medium doesn’t invalidate substantive incapacity to contract. It is imperative to note, that incapacity to contract does not imply that every online service be closed to those below eighteen; the law may restrict particular functions, allow for parent-mediated access, or create a special statutory regime for minors.
The Digital Personal Data Protection Act, 2023 (“DPDP Act, 2023”) approaches the child from a different direction by defining a child as a person below eighteen and, subject to its exemptions, Section 9 requires verifiable parental consent before processing a child’s personal data while restricting detrimental processing, tracking, behavioural monitoring and targeted advertising. Though these obligations have been enacted, the relevant provisions are scheduled to become operational after the eighteen-month commencement period in May 2027.
Rule 10 of the Act shows how parental verification is meant to work; a Data Fiduciary must first establish that the person claiming to be the parent is an identifiable adult, using reliable identity and age information or a virtual mapped token. But here lies the problem- the appended illustrations begin only after the child’s status has been disclosed: either “C informs DF that she is a child”, or a parent opens an account for C.
The Rule therefore illustrates how to verify the adult giving consent, but fails to clarify how Social Media platforms are to discover that the declared user is actually a minor.
On the one hand, contract law tells us minors lack ordinary contractual capacity. On the other hand, the DPDP framework tells platforms what to do once a user is known to be a child. And the proposed intermediary rules may soon make age relevant to whether that user can hold an account at all. But all three frameworks depend on the same unanswered question: how does the platform know the user’s real age in the first place?
When Protecting Privacy Requires More Data
“Age assurance” does not equate to identity verification, as seen from Australia’s eSafety framework, which provides three mechanisms for it; age verification, which relies on verified age information; age estimation, which predicts age from characteristics; and age inference, which draws conclusions from information which the platform already holds about the user
Each method solves one problem by creating another. Uploading a full government identity document may establish age, but may also reveal sensitive private information. Facial age estimation can avoid documents but introduces automated classification and margin for error. And age inference may avoid both while encouraging platforms to analyse account history or behaviour. In essence, there is no perfect age gate, but only different kinds of errors and different kinds of intrusions.
Indian privacy law has already paved the way to test such a problem. In the case of K.S. Puttaswamy v. Union of India, the apex court had recognized informational privacy and held that intrusion into privacy must always be backed by the law and be proportionate to a legitimate aim. Protecting children online, while easily satisfying these tests, runs into trouble with the method of the said protection. If all a platform needs to know is whether a user is above eighteen, the law should prefer a method that confirms that fact without requiring the user to reveal more personal information than necessary. The aim, then, should be simple: verify age without turning age verification into full identity verification.
Consent Cannot Make an Unsafe Platform Safe
One easy way is to make the parents responsible. The DPDP framework itself gives parents an important role. However, an unsafe platform won’t transform into a safe place with merely that. A child may, despite the permission to use a service, still encounter public-by-default settings, persistent geolocation, unwanted contact, engagement-maximising notifications, profiling or recommendation systems built to keep her scrolling. Moreover, consent and safety are two separate things. Consent addresses whether a child’s data may be processed, but ignores assessing if the platform itself is safe for the child or not. A proper child safety framework, hence, needs to look beyond parental permission, and look towards regulating the way platforms operate.
Nor must “below eighteen” mean identical protection for every age. The DPDP Act itself leaves room for calibrated treatment. Section 9(5) permits the Government, in cases where processing by a Data Fiduciary is found to be safe, to relax specified obligations above a notified age. Age-appropriate design can therefore recognise developmental differences without rewriting the age of majority.
The UK Regulates the Room; Australia Regulates the Door
The UK’s Children’s Code approaches the problem through design. Services likely to be accessed by children are expected to use high-privacy defaults, minimise data, limit profiling, switch geolocation off by default in ordinary circumstances and avoid nudges that encourage children to weaken privacy. Its guidance also recognises different developmental stages, from early childhood through ages sixteen to seventeen.
In other words, protecting children does not always mean shutting the door. Sometimes it means changing the room.
Australia begins with the door. Since 10 December 2025, specified social-media platforms have had to take reasonable steps to prevent Australians below sixteen from maintaining accounts. Yet the regime does not simply demand government identification. Where government-issued identification or accredited Digital ID is offered, reasonable alternatives must exist. Information collected for the age-restriction purpose is restricted in its secondary use and must be destroyed once that purpose has been fulfilled.
The UK shows how to regulate what children encounter after entry, and Australia shows why the method used to police entry must itself be regulated. India now needs to take notes from both at once.
Build an Age Gate, Not a KYC Counter
If the Government now makes eighteen a meaningful threshold for independent social-media accounts, the easiest rule would also be the most intrusive one: demand documentary proof from everyone. It would turn social-media access into a KYC exercise.
India’s own DPDP Rules point towards a better model. Rule 10 already recognises virtual tokens mapped to verified identity and age information. The same principle can be extended to age assurance. Where a platform needs only to know whether a user is above eighteen, a trusted verifier should be capable of returning exactly that fact: “18+ verified”.
The platform does not need the underlying document, address, identification number or precise date of birth. Nor should that credential become a persistent identifier capable of linking the same person across different platforms.
Second, the data collected for age verification should be used only for that purpose. No facial image used for estimating age should become training data, nor should any identity credential enter an advertising profile. Once no longer needed, the verification data should be deleted.
Third, India cannot make age gating its sole child-safety policy. The Information Technology Act, 2000, as an intermediary due-diligence framework, can regulate how platforms are designed, including privacy defaults, profiling, stranger contact, geolocation, notifications, recommendation systems, and manipulative nudges. Personal data used for establishing age can separately be regulated by the DPDP framework. In simple terms, while one regime regulates the platform, the other regulates the information collected at its entrance.
Moreover, platforms which use significant age-assurance systems should also conduct Child Rights and Privacy Impact Assessments, which should explain what data is collected, how age is determined, how often the system makes mistakes, how long data is retained, whether third parties are involved and whether a less intrusive method could work. High-risk automated systems should also be made open to audit.
Finally, age verification must include a meaningful correction process. A twenty-year-old may be mistaken for sixteen, while a seventeen-year-old may be mistaken for nineteen. Others may lack the required documents or fit poorly within a parental-consent system. Platforms must therefore provide reasonable alternatives, human review and an accessible way to challenge incorrect decisions.
Whether or not eighteen is the right threshold for every form of social-media access remains a separate question. But once the law makes age legally significant, it must also regulate how that age is determined.
Conclusion
The Supreme Court proceedings began with a contract-law problem, but solving that problem may create another if platforms are required to verify age without limits on the information they can demand. India need not choose between child safety and privacy. The existing laws, that is, the Contract law, can determine capacity, while the DPDP framework can regulate children’s personal data, and the intermediary rules can hence govern platform access and design.
What remains amiss is a framework connecting all three while ensuring that platforms collect no more information than the protective purpose requires. While a seventeen-year-old lying about her birthday is a real regulatory problem, requiring every adult to prove their identity in order to prevent the problem just creates a new one. Ultimately, entrance gates to social media platforms only need to know how old you are. They do not need to know who you are.
* The author is a student of third-year B.A. LL.B. at National Law University, Odisha. The author may be contacted at 24ba033@nluo.ac.in
This blog reflects the personal views of the author and does not necessarily represent the views of The Policy Chronicle.