Analysis urges design rules, not just age limits, for child online safety

The brief

Context

India's internet base has expanded rapidly — the Economic Survey 2025-26 records 96.96 crore connections in 2024 against 25.15 crore a decade earlier — pushing child online safety to the centre of policy. Several states and the Union government have responded mainly with age bars and takedown deadlines: Karnataka proposed barring under-16s from social media in March 2026, Andhra Pradesh under-13s, and MeitY told Parliament that intermediaries must remove nudity and morphed images within two hours of a complaint. Writing for the Observer Research Foundation, research assistant Purushraj Patnaik argues that such entry-and-exit rules ignore what happens in between — ranking algorithms, autoplay, streak counters, stranger-messaging defaults and slow reporting queues. He proposes using Sections 9(2) and 9(3) of the DPDP Act, 2023 to regulate product design rather than only access.

Key facts

• Economic Survey 2025-26: 96.96 crore internet connections in 2024, up from 25.15 crore a decade earlier; 89 percent of rural 14- to 16-year-olds have a smartphone at home.
• Australia's under-16 social media rule took effect 10 December 2025; eSafety Commissioner's 31 July 2026 assessment found account ownership among 10- to 15-year-olds fell from 52 to 42 percent in three months.
• In Australia, use of at least one restricted platform stayed above 81 percent, down from 85.9 percent before the law; about half of those still using one said the platform never checked their age.
• A 2025 survey of 1,003 American minors: 11 percent had an online sexual interaction on a given platform, 19 percent on Snapchat, Kik and BeReal; 7 percent had seen AI-generated nude imagery of another child.
• 47 percent of American minors had used a platform before its minimum age; 19 percent were helped by a parent or older sibling; 41 percent of underage users reported online sexual interactions versus 13 percent of non-underage users.
• NCRB recorded 1,238 cybercrimes against children under the IT Act in 2024, of which 1,099 were for publishing or transmitting sexually explicit material.
• A survey of 89,000 urban parents found 82 percent described the reporting route as slow or unclear; after an online sexual interaction, 75 percent of minors block the account and 53 percent report it.
• DPDP Rules notified 13 November 2025 require verifiable consent but set no test or threshold for 'detrimental effect' or behavioural monitoring; Meta settled a consumer protection suit by 51 US attorneys general in August 2026, agreeing to daily time limits, an overnight block and an unranked feed f

Timeline

1. 2000Information Technology Act enacted; Section 79 ties intermediary safe harbour to due diligence.
2. 2021IT Rules 2021 notified; Rule 4(4) asks large platforms to endeavour to identify child sexual abuse imagery.
3. 2023DPDP Act passed with Sections 9(2) and 9(3) on children's data; CCPA notifies Guidelines for Prevention and Regulation of Dark Patterns identifying 13 interface designs.
4. July 2025European Commission's Article 28(1) guidelines retain document checks for highest-risk services and accept age estimation elsewhere.
5. 13 November 2025DPDP Rules notified, requiring verifiable consent but no measurable test for detrimental effect.
6. 10 December 2025Australia's under-16 social media rule takes effect.
7. March 2026Karnataka proposes barring under-16s from social media; Andhra Pradesh proposes under-13s; Union government examines graded age brackets.
8. July 2026Allahabad High Court issues notice on a petition to keep minors off Roblox; MeitY tells Parliament intermediaries must remove nudity and morphed images within two hours of a complaint.
9. 31 July 2026Australian eSafety Commissioner's assessment reports the fall in account ownership among 10- to 15-year-olds.
10. August 2026Meta settles consumer protection suit by 51 US attorneys general, agreeing to design changes for minors.

Who has a stake

• Children and adolescents online — Exposure is shaped by ranking, autoplay and stranger-messaging defaults; underage users who evade age gates face the highest reported risk of sexual interactions.
• MeitY — Sets intermediary obligations and takedown clocks; could specify what DPDP Sections 9(2) and 9(3) require of product design on minors' accounts.
• State governments (Karnataka, Andhra Pradesh) — Have proposed age bars of under-16 and under-13 respectively for social media access.
• Large platforms and their engineers/product managers — Upstream design choices — ranking, notifications, retention — decide exposure; may face declarations, audits and published encounter rates.
• Parents and families — 82 percent of 89,000 urban parents found reporting slow or unclear; universal identity verification would shift verification costs to households, including on shared handsets.
• Regulators abroad (Australia's eSafety Commissioner, European Commission, UK ICO) — Provide the comparative evidence: age-gating results, age estimation guidelines, and the Children's Code fallback of protecting all uncertain-age users.
• Judiciary and NCRB — Allahabad High Court is hearing a petition on minors and Roblox; NCRB data captures complaints filed, not actual exposure.

Why it matters

With nearly 97 crore internet connections and 89 percent of rural 14- to 16-year-olds having a smartphone at home, the scale of children's exposure makes design choices, not entry rules, the decisive variable. Australia's experience shows age bars can cut account ownership modestly while leaving most usage and the highest-risk evaders untouched. If India's existing DPDP provisions on children's data were turned into enforceable design rules with published exposure metrics, safety could be measured by how rarely children encounter harm rather than by how fast posts come down.