Social Media Age Verification: Child Safety vs Digital Privacy

Overview

The Supreme Court of India is examining child safety on digital platforms. This judicial scrutiny highlights an intense regulatory tension: shielding minors from online algorithmic harms while protecting fundamental privacy rights under Article 21.

Statutory mandates under the Digital Personal Data Protection Act, 2023 demand verifiable parental consent. Yet hard identity checks risk building centralised surveillance honeypots. These systems strip away adult anonymity without dismantling compulsive platform engagement loops.

A durable constitutional model relies on platform accountability. India needs safety-by-design standards, mandatory algorithmic audits, and privacy-preserving cryptographic verification.

The Supreme Court of India recently issued notice on a public interest litigation regarding social media regulation for minors. As reported in proceedings of Just Rights for Children Alliance v. Union of India, the bench sought responses from the Union Government to evaluate statutory mechanisms for age verification and parental consent rather than issuing an immediate judicial ban on minor access.

Key constitutional touchstones highlighted in the proceedings include:

• Just Rights for Children Alliance: Assessing statutory age verification and parental consent rather than blanket bans
• Justice K.S. Puttaswamy (2017): Safeguarding informational privacy under Article 21
• Anuradha Bhasin (2020): Protecting online speech and trade under Article 19(1)(a) and Article 19(1)(g)

The judicial notice highlights the necessity of an enforceable statutory architecture that balances parens patriae obligations with individual civil liberties.

The Digital Personal Data Protection Act, 2023 establishes India's primary statutory framework governing how online platforms process children's data. Section 9(1) of the DPDP Act 2023 mandates that a Data Fiduciary must obtain verifiable parental consent before processing any personal data belonging to a child.

Under Section 3 of the Majority Act, 1875, childhood is benchmarked at completing eighteen years of age. This standard aligns directly with Section 11 of the Indian Contract Act, 1872. Because minors lack legal capacity to contract, standard user agreements are void ab initio. Digital platforms cannot rely on basic click-wrap terms without explicit parental authorisation.

Statutory safeguards for children under the DPDP Act, 2023 include:

• Section 9(1): Mandatory verifiable consent of parent or lawful guardian
• Section 9(3): Absolute ban on behavioural monitoring and targeted ads
• Schedule (Item 3): Penalties reaching up to ₹200 crore for violations

Section 9(3) of the DPDP Act 2023 explicitly bars Data Fiduciaries from undertaking tracking or behavioural monitoring of children, as well as serving targeted advertisements directed at them. Breaching these provisions carries heavy deterrent liability, with Item 3 of the Schedule to the DPDP Act 2023 prescribing financial penalties of up to ₹200 crore.

Complementing this data framework, Rule 3(1)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 obligates online intermediaries to exercise due diligence. Intermediaries must make reasonable efforts to prevent users from hosting, uploading, or sharing content harmful to minors.

Digital governance policy faces a structural conflict between punitive access barriers and proactive software engineering. Hard age-gating operates as an exclusionary gatekeeper, demanding formal government identity documentation before allowing entry. Conversely, safety-by-design mandates that platforms embed safety, privacy, and user well-being directly into their default architecture.

Hard barriers often create a false sense of security. They incentivise children to migrate toward unregulated dark-web spaces or deploy virtual private networks (VPNs) to evade filters.

A safety-by-design model mitigates harm at the root. By disabling surveillance advertising and restricting infinite-scroll mechanisms, digital platforms stay safe regardless of a user's declared age.

Mandatory identity-based age verification requires digital platforms to collect government identity cards or biometric scans from all users across India. Enforcing hard age gates transforms open platforms into gated identity ecosystems where anonymous access is completely eliminated.

According to the Justice B.N. Srikrishna Committee Report on a Data Protection Framework for India, mandatory identity checks create centralised surveillance honeypots that heighten systemic cybersecurity risks. Requiring millions of citizens to upload Aadhaar cards, passports, or driver's licences to social media databases exposes sensitive credentials to severe data breach risks.

Key risks of mandatory online age verification include:

1. Loss of user anonymity for whistleblowers, journalists, and citizens
2. Mass collection of biometric and facial estimation data
3. Chilling effect on digital speech under Article 19(1)(a)
4. Exclusion of marginalised populations lacking formal identity documents

Facial age estimation technologies introduce further algorithmic bias and privacy intrusions. Processing biometric facial geometry to estimate age violates data minimisation principles, forcing adults and children alike to submit to continuous automated profiling.

Global regulatory regimes diverge sharply between Australia's restrictive prohibitions and the United Kingdom's architectural privacy rules. Comparing these jurisdictions provides valuable lessons for India's emerging digital regulatory framework.

The Parliament of Australia enacted the Online Safety Amendment (Social Media Minimum Age) Act 2024, establishing a strict statutory prohibition that prevents children under 16 from holding accounts on designated social media platforms. The Australian legislation places the enforcement burden directly on tech conglomerates, prescribing corporate penalties of up to 50 million Australian dollars for systemic compliance failures.

Key features across international jurisdictions:

• Australia: Minimum age of 16, strict platform prohibition, and high corporate fines
• United Kingdom: 15 statutory standards, privacy-by-default, and UNCRC alignment
• India: DPDP Section 9 parental consent under 18, with penalties reaching up to ₹200 crore

The United Kingdom adopts a preventative approach through the Information Commissioner's Office (ICO). The UK enforces the Age Appropriate Design Code (AADC), which contains 15 statutory standards grounded in Article 3 of the UN Convention on the Rights of the Child. Rather than locking minors out of digital participation, the AADC requires platforms to turn off geolocation tracking, set profiles to private by default, and switch off nudge techniques that encourage compulsive screen use.

The Supreme Court of India evaluates digital state restrictions through the fourfold proportionality standard established in the landmark Puttaswamy ruling. State action infringing on informational privacy under Article 21 must satisfy four cumulative limbs:

1. Legality: Existence of an explicit, accessible statutory law
2. Legitimate Aim: State interest in child welfare (parens patriae obligations)
3. Suitability: Rational connection between the statutory measure and the objective
4. Necessity: Adoption of the least intrusive means to achieve the regulatory goal

While child protection represents a compelling and legitimate state objective, blanket identity-gating fails the necessity limb of the proportionality test. If platform architectural reforms and privacy-by-default protocols can shield children without harvesting personal identification documents from adult citizens, mandatory identity verification constitutes a disproportionate constitutional intrusion.

The Central Consumer Protection Authority has codified legal boundaries against deceptive design practices that exploit psychological vulnerabilities. Under the Guidelines for Prevention and Regulation of Dark Patterns, 2023, the CCPA prohibits manipulative user-interface designs such as forced action, confirm shaming, and trick questions.

Social media business models rely heavily on engagement maximisation. Platforms engineer variable dopamine reward schedules, auto-play feeds, and gamified notification badges to capture youth attention for targeted advertising monetisation.

Key ethical concerns in minor platform design encompass:

• Cognitive exploitation of developing faculties through dark patterns
• Attention commodification via compulsive algorithmic feedback loops
• Asymmetric information power between tech platforms and individual parents
• Shifting accountability entirely onto parental surveillance

Treating online child safety purely as a parental supervision failure ignores the extreme asymmetry of power between global technology firms and individual families. Applied ethics in public policy requires enforcing corporate fiduciary duties, ensuring platforms bear primary accountability for algorithmic harms rather than outsourcing compliance to domestic policing.

Reforming digital child safety requires deploying cryptographic verification protocols alongside systemic product redesign rather than coercive exclusion. Policymakers must align technological capabilities with constitutional safeguards to protect minors without creating a mass surveillance regime.

1. Deploying Zero-Knowledge Proofs (ZKPs): Digital identity architectures should adopt cryptographic protocols detailed in NIST Special Publication 800-63C. Zero-Knowledge Proofs enable platforms to mathematically confirm that an individual meets a minimum age threshold without receiving, storing, or inspecting their underlying identity credentials or exact date of birth.
2. Transitioning to Calibrated Age Tiers: The uniform 18-year threshold under the Majority Act, 1875 should be complemented by graduated statutory protections. Treating a 17-year-old identically to a 7-year-old creates severe implementation friction and infringes on developing informational autonomy.
3. Mandating Independent Algorithmic Audits: Regulatory bodies must enforce Section 9(3) of the DPDP Act 2023 by requiring social media intermediaries to undergo periodic third-party audits. Intermediaries must prove that recommendation algorithms serving younger demographics do not amplify harmful or addictive content loops.
4. Institutionalising Safety-by-Design Standards: India's regulatory authorities should formulate a national code of practice modelled on the UK Age Appropriate Design Code. Platforms must disable geolocation tracking, turn off push notifications during school hours, and enforce maximum privacy settings by default for minor accounts.

• The Supreme Court of India's notice in Just Rights for Children Alliance v. Union of India examines regulatory gaps in online minor protection rather than imposing a blanket judicial ban.
• Section 9 of the DPDP Act, 2023 mandates verifiable parental consent for users under 18, prohibits behavioural tracking, and prescribes penalties up to ₹200 crore for non-compliance.
• Mandatory identity verification creates severe privacy risks by stripping online anonymity and generating centralised data honeypots contrary to the Justice Srikrishna Committee recommendations.
• Any state-mandated digital restriction must satisfy the fourfold proportionality test (legality, legitimate aim, suitability, necessity) established in Justice K.S. Puttaswamy (2017) under Article 21.
• International approaches contrast sharply: Australia's Online Safety Act 2024 enforces a strict under-16 account ban, whereas the UK Age Appropriate Design Code mandates privacy-by-default without exclusion.
• Sustainable reform requires privacy-preserving cryptographic tools like Zero-Knowledge Proofs (ZKPs) and systemic safety-by-design standards rather than intrusive surveillance.