What Happened
- The Andhra Pradesh government is evaluating a system of "age tokens" integrated with DigiLocker to verify children's ages before granting access to social media platforms — a privacy-preserving alternative to submitting identity documents directly to private platforms.
- Under the proposed framework: children below 13 would be prohibited from accessing social media entirely; children aged 13–16 would face content restrictions to prevent exposure to harmful or inappropriate material.
- A Group of Ministers (GoM) met on April 9, 2026 with representatives from Meta, YouTube, X (formerly Twitter), ShareChat, and Josh to discuss existing age-verification safeguards and coordinate on the new framework.
- The government has tasked officials with studying international models from Singapore, Australia, and Denmark before finalising legislation.
- AP is expected to introduce comprehensive legislation — representing one of India's first state-level legislative attempts to codify children's digital rights and platform responsibilities.
Static Topic Bridges
DigiLocker — Architecture and Legal Status
DigiLocker is a cloud-based digital document wallet launched in 2015 under the Ministry of Electronics and Information Technology (MeitY) as part of the Digital India initiative. It allows citizens to store, share, and verify digitally signed government documents. The Aadhaar-linked system enables document authentication without physical transfer of the document itself — a key feature for privacy-preserving age verification.
- DigiLocker has legal validity under the IT Act, 2000 (Section 7A, as amended): documents issued via DigiLocker are deemed equivalent to originals
- As of 2025, DigiLocker had over 30 crore registered users and 600+ crore documents issued
- "Age tokens" in the proposed AP framework would work as cryptographic proof-of-age — a platform receives confirmation "user is above/below age X" without seeing the underlying identity document (birth certificate, Aadhaar, school records)
- This architecture aligns with the data minimisation principle under the Digital Personal Data Protection (DPDP) Act, 2023
Connection to this news: The age token mechanism leverages DigiLocker's trusted infrastructure to allow social media platforms to verify user age without collecting or storing children's sensitive identity data — addressing both the verification goal and the privacy protection requirement simultaneously.
Digital Personal Data Protection Act, 2023 — Children's Data Provisions
The DPDP Act, 2023 contains specific provisions for processing children's personal data. Section 9 of the Act prohibits data fiduciaries from processing the personal data of a child (defined as under 18 years) without verifiable parental consent, and from behavioural tracking, targeted advertising, or any processing that may be detrimental to a child's well-being.
- DPDP Act, 2023 (enacted August 2023): India's first comprehensive data protection law
- "Child" under DPDP Act: any individual below 18 years of age
- Significant Data Fiduciaries (SDFs) — large platforms designated by the Central Government — face heightened obligations for processing children's data
- Data Protection Board of India: adjudicatory body under DPDP Act to hear complaints and impose penalties
- Penalty for violating children's data provisions: up to ₹200 crore
Connection to this news: AP's age token initiative operationalises the spirit of DPDP Act Section 9 at the state level, creating a technical mechanism for the "verifiable parental consent" and age verification that the central law requires but does not prescribe implementation methods for.
International Regulatory Models for Children's Online Safety
Several countries have enacted children's online safety laws that Andhra Pradesh's officials have been tasked to study. Australia passed the Online Safety Amendment (Social Media Minimum Age) Act in 2024, setting a minimum age of 16 for social media use. Singapore's Online Safety (Miscellaneous Amendments) Act mandates age assurance mechanisms. These laws place the compliance burden on platforms, not on children or parents.
- Australia's law (2024): minimum age 16 for social media; platforms face fines up to AUD 50 million for non-compliance
- UK Online Safety Act (2023): requires platforms to conduct "children's risk assessments" and implement age verification for adult content
- India's IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (amended 2023): require platforms to remove child sexual abuse material within 24 hours and have grievance redressal officers in India
- National Commission for Protection of Child Rights (NCPCR): India's statutory body under the Commissions for Protection of Child Rights Act, 2005 — can take cognisance of children's digital rights violations
Connection to this news: AP is seeking to adapt global best practices to India's context, where Aadhaar-linked digital identity infrastructure (DigiLocker) offers a technically superior age verification pathway compared to the self-declaration systems used by most social media platforms currently.
Key Facts & Data
- Proposed ban: Children below 13 — no social media access; aged 13–16 — content restrictions
- Verification mechanism: "Age tokens" via DigiLocker (Aadhaar-linked), proving age without exposing identity documents to platforms
- GoM meeting: April 9, 2026; platforms present: Meta, YouTube, X, ShareChat, Josh
- International models studied: Singapore, Australia, Denmark
- DigiLocker: Launched 2015, MeitY; 30+ crore registered users; legal validity under IT Act, 2000 (Section 7A)
- DPDP Act, 2023, Section 9: Prohibits processing children's data without verifiable parental consent; penalty up to ₹200 crore
- NCPCR: Statutory child rights body under Commissions for Protection of Child Rights Act, 2005
- Australia's reference law: minimum age 16 for social media (2024)