Supreme Court asks Centre to frame rules to stop social media firms signing up minors
If a minor cannot sign a contract, how is a 13-year-old agreeing to a platform's terms of service?
Published 29 September 2026. Written by Pratidin from the reports linked at the end; every fact checked by a separate review before publishing. How we work
On 28 September 2026, a Supreme Court bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana asked the Union government to make statutory rules that stop social media companies from opening accounts for minors. The case is Just Rights for Children Alliance v Union of India, a public interest petition seeking safeguards against the use of social media and other digital platforms by children. Platforms today let children as young as 13 sign up by simply declaring their age. Justice Bagchi remarked that "a 15 year old child can have a Twitter account", and the bench said intermediaries should at least shape their membership so that the minimum threshold of 18 years is not breached.
The legal logic rests on contract law. Section 11 of the Indian Contract Act, 1872 says only a person who has reached the age of majority can contract, and Section 3 of the Majority Act, 1875 fixes that age at 18. Since the Privy Council's 1903 ruling in Mohori Bibee v Dharmodas Ghose, a minor's contract is void from the start. Signing up to a platform means accepting its terms of service, which is a contract. Solicitor General Tushar Mehta agreed that such contracts with minors are void ab initio and told the court the government was "ready" to act. He suggested that the parental consent model in the data protection regime could be adopted in another law so that parental consent is needed for minors to hold accounts.
The Chief Justice warned that if the government did not act, the court would be compelled to issue directions against intermediaries by invoking Section 79 of the Information Technology Act, 2000. Section 79 gives platforms a "safe harbour": they are not liable for users' content if they observe due diligence. Making age limits part of that due diligence would put the safe harbour at stake. The Digital Personal Data Protection Act, 2023 already treats anyone under 18 as a child and requires verifiable parental consent before processing a child's data, but its obligations are yet to fully apply. The petition also asks for guardian-controlled access so children can still use educational content. Supporters see protection from addiction, exploitation and data harvesting; critics warn that strict age checks require identity verification for every user and could cut children off from useful online learning.
Prelims facts
- On 28 September 2026 the Supreme Court, in Just Rights for Children Alliance v Union of India, asked the Centre to frame statutory rules barring social media firms from enrolling minors.
- The reasoning: under Section 11 of the Indian Contract Act, 1872 a minor cannot contract, and the Majority Act, 1875 fixes majority at 18.
- Mohori Bibee v Dharmodas Ghose (Privy Council, 1903) held a minor's contract void ab initio.
- The court warned it could act through Section 79 of the IT Act, 2000, the safe harbour for intermediaries.
- The DPDP Act, 2023 defines a child as a person below 18 and requires verifiable parental consent to process a child's data.
Quick recall
- What is the name of the case in which the Supreme Court asked for rules on minors and social media (September 2026)?
- Just Rights for Children Alliance v Union of India.
- Which section of the Indian Contract Act lists who is competent to contract?
- Section 11.
- Which law fixes the age of majority in India at 18?
- The Majority Act, 1875 (Section 3).
- Which case held that a minor's contract is void ab initio?
- Mohori Bibee v Dharmodas Ghose, decided by the Privy Council in 1903.
- Which section of the IT Act, 2000 gives intermediaries a safe harbour?
- Section 79.
- Under which section of the IT Act were the IT Rules, 2021 made, and when were they notified?
- Section 87; notified on 25 February 2021.
- What is the maximum penalty in the DPDP Act, 2023 for breaching obligations on children's data?
- Up to ₹200 crore.
- From when did Australia's under-16 social media account ban apply?
- 10 December 2025.
Prelims practice question
Consider the following statements:
1. Under the Indian Contract Act, 1872, a person who has not attained the age of majority is not competent to contract.
2. Under the Digital Personal Data Protection Act, 2023, a 'child' is a person below 16 years of age.
3. Section 79 of the Information Technology Act, 2000 exempts intermediaries from liability for third-party content if they observe due diligence.
Which of the statements given above are correct?
- 1 and 2 only
- 2 and 3 only
- 1 and 3 only
- 1, 2 and 3
Show answer
Answer: (c) 1 and 3 only. Statement 1 is correct (Section 11 of the Contract Act). Statement 2 is wrong: the DPDP Act defines a child as a person below 18. Statement 3 is correct: Section 79 is the safe harbour provision, available only if the intermediary observes due diligence.
Use this in UPSC Mains: previous-year questions
Recurring theme: Protecting children online: platform regulation, data protection and child rights
- How to use this
Use it to set out the existing legal safeguards for children online and the measures now being pushed, which a child rights body could monitor and build on.
- In Just Rights for Children Alliance v Union of India (28 September 2026), the Supreme Court asked the Centre to frame statutory rules stopping social media firms from enrolling users below 18.
- Existing policy: the DPDP Act, 2023 treats anyone under 18 as a child and requires verifiable parental consent before processing a child's data, but its obligations are yet to fully apply.
- Balanced measures: guardian-controlled access so children still reach educational content, and privacy-preserving age checks, since critics warn strict checks need identity verification of every user.
Describe the context and salient features of the Digital Personal Data Protection Act, 2023.
How to use thisUse it to explain the DPDP Act's child-data provisions and the live context in which they are being extended to platform sign-ups.
- The DPDP Act, 2023 defines a child as a person below 18, requires verifiable parental consent before processing a child's data and bars tracking and targeted ads aimed at children.
- Context: in September 2026 Solicitor General Tushar Mehta suggested the Act's parental consent model be adopted in another law so minors need parental consent to hold social media accounts.
- Note the implementation gap: the Act's obligations are yet to fully apply, while the Supreme Court is pressing the Centre for statutory rules barring platforms from enrolling minors.
- How to use this
Use it to illustrate the main legal lever over social media platforms, intermediary safe harbour, and how courts are using it to push platform-level safeguards.
- Section 79 of the IT Act, 2000 shields platforms from liability for user content only if they observe due diligence, which rules under Section 87 can define.
- On 28 September 2026 the Chief Justice warned that, if the government did not act, the Court would issue directions against intermediaries under Section 79 to enforce an 18-year minimum age.
- Enforcement limits to note: children can lie about age or use a parent's account, and global platforms and VPNs weaken enforcement.
Mains practice question
The Supreme Court has asked the Union government to make rules to prevent social media platforms from enrolling minors. Discuss the legal basis for such a restriction and the challenges in enforcing it. (150 words)
Model answer
On 28 September 2026, in Just Rights for Children Alliance v Union of India, the Supreme Court asked the Centre to frame statutory rules so that platforms do not enrol users below 18.
Legal basis
- Section 11, Indian Contract Act, 1872: only majors can contract; Majority Act, 1875 sets majority at 18.
- Mohori Bibee v Dharmodas Ghose (1903): a minor's contract is void ab initio, so terms of service accepted by a child are unenforceable.
- Section 79, IT Act, 2000: safe harbour depends on due diligence, which rules under Section 87 can define.
- DPDP Act, 2023: child means under 18; verifiable parental consent; no tracking or targeted ads.
Enforcement challenges
- Age checks need identity data for every user, raising privacy risks.
- Children can lie or use a parent's account.
- Cutting off educational content; the petition itself seeks guardian-controlled access.
- Global platforms and VPNs weaken enforcement.
A parental-consent model with privacy-preserving age checks can protect children without excluding them.
The basics
Why this matters
Children join social media long before they are adults in law. The Supreme Court has now asked a simple question with large consequences: if a minor cannot enter a contract, how can a platform enrol a 13-year-old who "agrees" to its terms? The answer touches contract law, the IT Act, data protection and children's rights, all regular UPSC themes.
Step one: signing up is a contract
When you tick "I agree" you accept a platform's terms of service. That is a contract. Under A minor's contract under Indian law, a person below 18 cannot make one.
- Minimum age usually 13
- Age is self-declared
- Terms of service accepted with a click
- Majority at 18 under the Majority Act, 1875
- Only majors can contract (Section 11, Contract Act)
- A minor's contract is void from the start
Step two: the lever is the safe harbour
Platforms are protected from liability for what users post by Section 79 safe harbour for intermediaries. That protection depends on due diligence, and the government defines due diligence through rules. If age limits become part of due diligence, a platform that ignores them risks losing its shield.
- 1Contract lawA minor's acceptance of terms is void, so the account rests on no valid contract
- 2RulesCentre frames statutory rules requiring platforms to keep out users below 18
- 3Due diligenceCompliance becomes part of the conditions for the safe harbour
- 4ConsequenceA non-compliant platform can be held liable for content
Step three: the data law is already there
The DPDP Act and children's data treats everyone under 18 as a child and requires verifiable consent of a parent or lawful guardian. The Solicitor General suggested that this parental consent model could be adopted in another law for social media accounts.
Other countries
Australia's under-16 social media law shows one model: from 10 December 2025, platforms there must take reasonable steps to stop under-16s from holding accounts, or face fines of up to A$49.5 million.
The trade-off
Strict age gates need identity checks, which collect more data about everyone. Children also use the internet to learn. The petition itself seeks guardian-controlled access to educational content. Good rules will protect children without shutting them out.
Go deeper
In one line: The Supreme Court wants binding rules so that platforms stop enrolling users below 18, reasoning that a minor cannot legally accept a platform's terms of service.
Why it matters for UPSC
It links the Contract Act, the IT Act, the DPDP Act and child rights. Mains questions on children in the digital era, social media regulation and data protection can use it directly; Prelims can test the sections and cases.
The core idea
Signing up to a platform is a contract, and under A minor's contract under Indian law such a contract by a person below 18 is void. The government can turn this into a rule for platforms through the due diligence conditions attached to Section 79 safe harbour for intermediaries. The DPDP Act and children's data already requires parental consent to process a child's data, and the Solicitor General suggested borrowing that model. Abroad, Australia's under-16 social media law shows how a hard age limit works in practice.
Numbers and dates to remember
- 28 September 2026: hearing in Just Rights for Children Alliance v Union of India.
- 18: age of majority (Majority Act, 1875) and DPDP definition of a child.
- 13: the minimum age most platforms use, based on self-declaration.
- 1903: Mohori Bibee v Dharmodas Ghose.
- 25 February 2021: IT Rules notified.
- ₹200 crore: maximum DPDP penalty for breaching children's data obligations.
Where to go next
- A minor's contract under Indian law: why a child's click on "I agree" has no legal force.
- Section 79 safe harbour for intermediaries: the shield platforms could lose.
- DPDP Act and children's data: the parental consent model already in law.
- Australia's under-16 social media law: a working example of a hard age limit.
Go deeper: protect children or protect access?
For stricter age limits. Contract law already treats a minor's agreement as void, so platforms are building a business on consent that does not exist, as explained under A minor's contract under Indian law. Children face addiction-driven design, exposure to harmful content and data harvesting. The DPDP Act and children's data already bars tracking and targeted advertising aimed at children, which shows Parliament's intent. Tying age compliance to Section 79 safe harbour for intermediaries gives the rule teeth without a new statute.
Against, or for a softer model. Verifying age means checking identity documents or using facial estimation for all users, adults included, which raises privacy and exclusion risks. Children use platforms to learn, create and connect, and the petition itself asks for guardian-controlled access to educational content. Blanket bans can push children to fake ages or to less safe corners of the internet. The PRS analysis of the DPDP Bill noted that the US and UK allow data consent at 13 and the EU standard is 16, so India's 18 is already strict.
Comparisons. Australia's under-16 social media law puts the burden on platforms, with large fines, rather than on children or parents. India could combine the court's 18-year threshold with parental consent for younger users, as the Solicitor General suggested. The key design choices are who verifies age, how little data is collected, and what content remains open to children.
A minor's contract under Indian law
Why a child's click on 'I agree' has no legal force.
In one line: In India a person below 18 cannot make a valid contract, and any contract made by a minor is void from the beginning.
The rules
Section 10 of the Indian Contract Act, 1872 says agreements are contracts when made by competent parties. Section 11 says a person is competent if he or she has reached the age of majority, is of sound mind and is not disqualified by law. Section 3 of the Majority Act, 1875 fixes the age of majority at 18.
The landmark case
In Mohori Bibee v Dharmodas Ghose (1903), a minor had mortgaged his property to a moneylender. The Privy Council held that the minor's contract was absolutely void, so the lender could not enforce it or recover the money advanced.
Why it is in the news
A platform's terms of service form a contract. The Solicitor General told the Supreme Court that contracts between minors and social media intermediaries are void ab initio. The court used this to ask for rules that match platform sign-ups with Indian law.
Where to go next
- Section 79 safe harbour for intermediaries
- DPDP Act and children's data
Section 79 safe harbour for intermediaries
The legal shield platforms could lose.
In one line: Section 79 of the IT Act, 2000 protects intermediaries such as social media platforms from liability for users' content, but only if they follow due diligence.
How it works
An intermediary is not liable for third-party information if it only provides access or hosting, does not initiate the transmission, select the receiver or modify the content, and observes due diligence as prescribed by the government. The due diligence rules are made under Section 87. The current set is the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, notified on 25 February 2021.
The Shreya Singhal reading
In Shreya Singhal v Union of India (2015), a bench of Justices J. Chelameshwar and R.F. Nariman struck down Section 66A and read down Section 79: a platform must act on "actual knowledge" only when it receives a court order or a government notification.
Why it is in the news
The Chief Justice warned that the court would invoke Section 79 against intermediaries if the government did not act on minors' accounts.
Where to go next
- A minor's contract under Indian law
- Australia's under-16 social media law
DPDP Act and children's data
The parental consent model already written into law.
In one line: The Digital Personal Data Protection Act, 2023 treats anyone below 18 as a child and requires verifiable consent of a parent or lawful guardian before a child's personal data is processed.
Key features
The Act received the President's assent on 11 August 2023. Data fiduciaries (entities that decide why and how data is processed) must not process children's data in a way that harms their well-being and must not track, behaviourally monitor or target advertising at children. Breaching these obligations can attract a penalty of up to ₹200 crore, imposed by the Data Protection Board of India. The PRS analysis notes that the requirement implies age verification for all users.
Status
The Act and its rules were notified in phases from November 2025; the obligations on data fiduciaries are yet to fully apply.
Why it is in the news
The Solicitor General pointed to the parental consent model under the data protection law and suggested adopting it in another law so that parental consent is needed for minors to hold accounts.
Where to go next
- A minor's contract under Indian law
- Australia's under-16 social media law
Australia's under-16 social media law
A working example of a hard age limit on platforms.
In one line: Australia's Online Safety Amendment (Social Media Minimum Age) Act, 2024 requires platforms to take reasonable steps to stop users below 16 from holding accounts.
Key features
The law passed on 29 November 2024 and applied from 10 December 2025, after a one-year transition. Platforms covered from that date include Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick. Services such as YouTube Kids, Google Classroom, Messenger and Roblox are outside the rule. Platforms that fail to take reasonable steps face fines of up to A$49.5 million. The burden is on the company, not on children or parents.
Why it matters for India
It shows a model in which the law sets the age and platforms must design verification. India's court is pointing to an even higher bar, 18, drawn from contract law. It also shows the exemptions for education and messaging that the petition in India seeks through guardian-controlled access.
Where to go next
- Section 79 safe harbour for intermediaries
- DPDP Act and children's data
Prelims-style quiz
Consider the following statements:
1. In Shreya Singhal v Union of India (2015), the Supreme Court struck down Section 66A of the IT Act.
2. In the same case, the Court read down Section 79 so that 'actual knowledge' means a court order or a government notification.
3. In the same case, the Court struck down Section 69A of the IT Act, which permits blocking of online content.
How many of the statements given above are correct?- Only one
- Only two
- All three
- None
Show answer
Answer: (b) Only two. Statements 1 and 2 are correct. Statement 3 is wrong: the Court upheld Section 69A as a narrowly drawn provision with safeguards.
Consider the following statements about the Digital Personal Data Protection Act, 2023:
1. It defines a child as a person below 18 years of age.
2. It requires verifiable consent of a parent or lawful guardian before a child's personal data is processed.
3. It bars tracking, behavioural monitoring and targeted advertising directed at children.
4. Its maximum penalty for breaching obligations relating to children is ₹50 crore.
How many of the statements given above are correct?- Only one
- Only two
- Only three
- All four
Show answer
Answer: (c) Only three. Statements 1, 2 and 3 are correct. Statement 4 is wrong: the penalty for breaching obligations on children's data can go up to ₹200 crore.
Consider the following statements:
Statement-I: A social media account opened by a 15-year-old in India rests on an agreement that is void in law.
Statement-II: Under Indian law a person below the age of majority is not competent to contract, and such a contract is void ab initio.
Which one of the following is correct in respect of the above statements?- Both Statement-I and Statement-II are correct and Statement-II explains Statement-I
- Both Statement-I and Statement-II are correct and Statement-II does not explain Statement-I
- Statement-I is correct but Statement-II is incorrect
- Statement-I is incorrect but Statement-II is correct
Show answer
Answer: (a) Both Statement-I and Statement-II are correct and Statement-II explains Statement-I. Both are correct and Statement-II explains Statement-I. Accepting terms of service is a contract; Section 11 of the Contract Act and Mohori Bibee (1903) make a minor's contract void. The Solicitor General accepted this in court.
Australia's Online Safety Amendment (Social Media Minimum Age) Act, 2024 requires platforms to take reasonable steps to prevent account holding by persons below which age?
- 13 years
- 14 years
- 16 years
- 18 years
Show answer
Answer: (c) 16 years. The Australian law sets 16 as the minimum age, applying from 10 December 2025, with fines up to A$49.5 million.
Consider the following statements about the Supreme Court hearing of 28 September 2026:
1. The Solicitor General agreed that contracts between minors and social media intermediaries are void.
2. The Court immediately withdrew the safe harbour of all social media platforms.
Which of the statements given above is/are correct?- 1 only
- 2 only
- Both 1 and 2
- Neither 1 nor 2
Show answer
Answer: (a) 1 only. Statement 1 is correct. Statement 2 is wrong: the Court asked the government to frame rules and only warned that it could issue directions under Section 79 if the government failed to act.