What Happened
- The central government is exploring nuanced, graded restrictions on social media access for children, rather than an outright blanket ban, with age thresholds and levels of permitted access under active discussion.
- Union Minister Ashwini Vaishnaw indicated that the government is in discussions with social media intermediaries about enforcing age-based curbs, with consultations ongoing with industry stakeholders.
- The proposed approach mirrors but goes beyond the existing framework under the Digital Personal Data Protection (DPDP) Act, 2023, which already mandates verifiable parental consent before processing personal data of children under 18.
- Karnataka announced it would ban social media for users under 16, and Andhra Pradesh announced a ban for those under 13 — making them the first Indian states to announce such restrictions, though neither has enacted implementing legislation.
- The central government's engagement signals that pan-India regulation through central law is being considered as the more constitutionally sustainable route, given legal experts' concerns about state-level bans running into jurisdictional conflicts.
Static Topic Bridges
Digital Personal Data Protection Act, 2023 (DPDP Act) — Children's Data Provisions
The DPDP Act, 2023 is India's comprehensive data protection law, enacted to regulate the processing of digital personal data. Section 9 of the Act deals specifically with processing of children's personal data. Under the Act, any person under 18 is defined as a child, and data fiduciaries must obtain verifiable parental or guardian consent before processing a child's personal data.
- Data fiduciaries must implement appropriate technical and organisational measures to verify that the individual claiming to be a parent is an adult — using reliable identity and age details or virtual tokens from government-authorised entities.
- Prohibited by default: behavioural monitoring of children, targeted advertising directed at children, and processing likely to cause detrimental effect on a child's well-being.
- Draft DPDP Rules, 2025: Provide operational detail on how parental consent is to be obtained and verified; contemplate exceptions for educational institutions, healthcare providers, and child welfare purposes.
- A "significant data fiduciary" classification (notified by the government) triggers additional obligations including Data Protection Impact Assessments and appointment of a Data Protection Officer.
Connection to this news: The government's proposed graded age-based restrictions would build on the consent and data-processing obligations of Section 9, extending them into access-level restrictions — a step the DPDP Act itself does not currently mandate.
IT Act, 2000 and Legislative Competence
The Information Technology Act, 2000 is the primary central legislation governing cyberspace, electronic commerce, digital signatures, and cybercrime in India. It was enacted under Entry 31 (Posts and Telegraphs; Telephones, Wireless, Broadcasting and other like forms of Communication) and Entry 97 (Residuary Entry) of List I (Union List) of the Seventh Schedule to the Constitution. This places internet and telecommunications regulation squarely within the exclusive legislative domain of Parliament.
- Entry 31 of the Union List covers posts, telegraphs, telephones, wireless, broadcasting, and other forms of communication.
- Because internet services and social media platforms operate as communication services, state legislatures cannot enact laws that override or duplicate the IT Act's provisions.
- The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — made under Section 87 of the IT Act — already impose due-diligence obligations on social media intermediaries.
- Section 79 of the IT Act grants "safe harbour" protection to intermediaries (social media platforms) for user-generated content, subject to compliance with the Rules.
- Any binding platform-facing ban by a state government risks constitutional challenge on grounds of lack of legislative competence under Article 246 read with List I.
Connection to this news: This is precisely why legal experts — and implicitly the Centre itself — favour pan-India legislation over a patchwork of state-level bans; the constitutional architecture reserves regulatory authority over social media platforms to Parliament.
Global Models: Australia and France
Several countries have enacted binding age-based social media restrictions, providing a regulatory template. Australia enacted legislation in November 2024 banning social media access for children under 16, placing the compliance burden on platforms rather than parents. France introduced parental consent requirements for under-15s in 2023.
- Australia's model: Platforms must take "reasonable steps" to prevent under-16s from creating accounts; they face fines of up to AUD 50 million for systemic failures.
- France's approach: Requires platforms to obtain verifiable parental consent for minors under 15; implementation relies on a government-approved age verification solution.
- Both models adopt a platform-obligation approach — enforcement is against the platform, not the child or parent.
- India's proposed graded approach — different restrictions for different age bands — is potentially more nuanced than a hard cutoff.
Connection to this news: The Indian government is drawing on international precedents while tailoring the framework to India's constitutional structure and the existing DPDP Act architecture.
Key Facts & Data
- DPDP Act, 2023: Defines child as any person under 18; mandates verifiable parental consent for children's data processing (Section 9).
- Draft DPDP Rules, 2025: Provide operational mechanism for verifiable consent, including use of DigiLocker tokens.
- Karnataka proposal: Ban social media for under-16s (announced in state Budget 2026).
- Andhra Pradesh proposal: Ban social media for under-13s.
- IT Act, 2000: Central legislation; Entry 31, Union List = exclusive parliamentary competence over internet and communications.
- IT (Intermediary Guidelines) Rules, 2021: Due-diligence obligations on social media platforms including grievance officers, content takedown timelines.
- Australia banned under-16 social media access (November 2024); France mandated parental consent for under-15s (2023).
- India currently has no minimum age requirement for social media access; platforms self-impose 13-year limits per their own terms of service.