On October 15, 2026, the Supreme Court held that the right to access and use of internet is a fundamental right of every individual under Article 21, read with Article 19(1)(a) of the Constitution, and that children enjoy the same right. The order was passed by a bench comprising Justices J. B. Pardiwala and K. Vinod Chandran in Just Rights for Children Alliance vs. S. The order primarily deals with how platforms should detect and remove such material. However, the part likely to have the most lasting impact concerns children’s access to social media.
The court rejected blanket bans on children’s access to the internet, calling them “unproven measures of proven disproportionality” and held that the methods used to enforce age-based restrictions are “themselves an overreach,” since they require identifying the age of every user and the continuous collection and monitoring of sensitive data (Just Rights for Children Alliance vs. S. Harish, M.A. NOS. 2553-2554 OF 2026 ).
At the same time, it acknowledged the need for certain safeguards and suggested a system that places greater emphasis on parental consent, guidance and oversight, along with a dedicated “child mode” for children’s accounts. Such accounts would be private by default, restrict contacts and messages from unknown adults, and limit children’s access to advertising and content. These measures could be implemented for preteens, with a reasonable and proportionate way of verifying parental consent. The court has left the details to the Union Government.
The Ministry of Electronics and Information Technology (MeitY) and the Ministry of Law and Justice have been directed to take this forward through guidelines, standard operating procedures, and amendments to the IT Act and the IT Rules, where necessary. The Union must file an affidavit on its progress before the next hearing on December 10.
This is not the only case on this issue to which government will have to respond. A day after the order, on October 16, a bench comprising Chief Justice Surya Kant and Justice Joymalya Bagchi issued notice on a public interest petition filed by Emerald Heights International School in Indore, seeks a national framework to protect children on social media. The petition proposes a graded model: no accounts for children under thirteen; access only with verifiable parental consent and child-safe settings for those aged between thirteen and sixteen; and safeguards for those aged between sixteen and eighteen. The petition also lists behavioral profiling and compulsive use design among the harms that children face. The bench tagged it with a pending petition set to be heard on December 7. This means that the government will have to set out its approach to children’s access to social media before two Supreme Court benches within the same week — on December 7 and December 10.
The law already exists
What is interesting is that the order does not mention the Digital Personal Data Protection Act, 2023 (DPDP Act), at all. However, much of what the court has asked for is already in Section 9 of the Act, which deals with the personal data of children which will come into force in May 2027. The government itself has made this point before. On September 28, the Solicitor General told the Supreme Court in a separate matter, that the issue of children’s social media accounts appeared to be covered by the DPDP Act.
- Parental consent: Section 9(1) requires platforms to obtain verifiable parental consent before processing the personal data of anyone under 18. The DPDP Rules, notified in November 2025, allow the parent’s identity and age to be verified through virtual tokens, which can be issued though different mechanisms, including DigiLocker. The Rules focus on verifying the parent, and do not expressly require platforms to check the age of every user. This goes some way toward addressing the court’s concern about privacy.
- Well-being: Section 9(2) prohibits processing a child’s personal data in a manner likely to cause a detrimental effect on the child’s well-being. Making a child’s profile visible to strangers or recommending a child’s account to unknown adults involves processing the child’s personal data, and could fall within this provision. Section 9 allows exemptions from the consent requirement and prohibition on tracking, but not from this provision.
- Advertising and tracking: Section 9(3) prohibits tracking, behavioral monitoring and targeted advertising directed at children. These restrictions address concerns raised by the Court around personalized feeds and the moderation of advertising shown to children.
This means that the DPDP Act already provides for the parental consent and oversight described by the court, as well as the mechanism needed to enforce a ‘child mode.’
What needs to be done
As countries around the world grapple with their own laws around child safety online, this is a good opportunity for the government to clarify its own stance on the matter. While many of the protections sought for can be covered under the DPDP Act, the IT Rules can be used to cover any additional lacunae. As the December deadlines for both cases approaches, two broad things need to be clarified.
First, there needs to be more clarity on how the DPDP Act’s protections work in practice. The Act does not define “behavioural monitoring” or what counts as a “detrimental effect” on a child’s well-being. It would be necessary to issue some guidance about what a child mode should include —such as private accounts by default, restrictions on contact from unknown adults, no targeted advertising and no personalized feeds built on behavioral data. This would help platforms understand what is expected of them from the day the Act is enforced.
The primary gap here is the information asymmetry. While there is broad consensus that social media platforms harm children, the precise nature of the harm is difficult to ascertain since the relevant data are held by the platforms themselves. To define the features of a child safe mode, regulators must first be given access to the kinds of features platforms deploy and data on their impact. This brings us to the second important requirement.
This is an opportunity to streamline disclosure requirements for platforms. The current law already requires intermediaries to publish monthly compliance reports on complaints, including a separate section on CSEAM, which are to be independently audited. The DPDP Rules also require Significant Data Fiduciaries (SDFs) to carry out annual impact assessments and audits, and to verify that their algorithms do not pose risks to users’ rights. These assessments should be filed with the Data Protection Board, with a separate section on how platforms treat children, and published in some form. This would help regulators to assess whether a child-mode is actually working.
While there is broad consensus that children must be protected online, there is considerable debate about the best way to do so. However, the answer to this necessarily depends on information collected by platforms, which policy makers do not have access to. The key to determine the appropriate child-safety measures lies in the information collected by platforms themselves, and any mechanism—whether it is age-based restrictions or restriction on certain features—must be based around these disclosures.
Nidhi Singh is an associate fellow at Carnegie India’s Technology and Society program.
This commentary is part of an article series leading up to Carnegie India’s annual flagship event, the Global Technology Summit, co-hosted with the Ministry of External Affairs, Government of India, for which The Print is an official Digital Partner. For more information, visit globaltechnologysummit.com.