A Court Declines to Legislate From the Bench
On 20 August 2026, a Division Bench of the Delhi High Court — Justices V. Kameswar Rao and Manmeet Pritam Singh Arora — disposed of a public interest litigation seeking to bar children under 13 from social media and impose content restrictions for 13-16 year-olds. The Bench held that "banning or restricting social media access to children is a policy decision which is best left to the government," and asked the Centre to examine the petitioners' concerns in consultation with platforms and other stakeholders. No deadline was set (Bar and Bench).
That is the correct outcome, and not because the underlying worry is overblown. The PIL was filed by Kirti Dua, mother of a three-year-old, and paediatrician Dr Sharad Gupta, who argued that unrestricted exposure to sexually explicit and inappropriate content online infringes children's constitutional rights and exposes them to exploitation (Free Press Journal). That is a real harm, not a manufactured one. The question is who should design the remedy — a two-judge bench ruling on a writ petition, or an executive process that can actually consult platforms, parents, child-safety researchers, and the telecom and IT ministries before fixing a threshold that will bind hundreds of millions of accounts.
The Government Is Already Writing These Rules
The court's restraint isn't a punt into a vacuum. India's Parliamentary Standing Committee on the Empowerment of Women, chaired by Dr. D. Purandeswari, submitted a report on "Cyber Crimes and Cyber Safety of Women" on 23 March 2026 that recommended "age appropriate regulations and usage limits on social media to safeguard children and adolescents," along with mandatory KYC-based verification across social media, dating, and gaming platforms to curb fake profiles and anonymous harassment. The committee's report cited a 239% rise in cybercrimes against women between 2017 and 2022, with a parallel multi-fold rise in cases involving children (PRS India, Monthly Policy Review, March 2026). Separately, a graded age-tiered framework — distinct restrictions for 8-12, 12-16, and 16-18 year-olds — has reportedly been under discussion between MeitY, the Home Ministry, and major platforms (Biometric Update).
This sits on top of a statute that already treats children's data as a special category. The Digital Personal Data Protection Act, 2023, defines anyone under 18 as a child and requires data fiduciaries to obtain verifiable parental consent before processing a child's personal data (PRS India, DPDP Act 2023 text). The implementing DPDP Rules, 2025, notified on 13 November 2025, operationalise that mandate and give firms until 13 May 2027 — an 18-month runway — to build verifiable-consent and age-assurance systems, while prohibiting behavioural tracking and targeted advertising aimed at children (S.S. Rana & Co.). In other words, India already has a live statutory and regulatory process moving toward age-gating; the Delhi HC simply declined to short-circuit it with a judicially improvised age cutoff.
The Case for Caution
Give the skeptics their due before dismissing them. The Internet Freedom Foundation, responding to parallel state-level and parliamentary proposals, has warned that any workable age-verification mandate would functionally require age-checking the entire user base, not just minors, since a platform cannot know who is under 18 without checking everyone. That risks becoming, in IFF's words, a system that could "mandate age-verification systems that create fresh privacy risks for all users, including adults" — pairing government-issued ID with online activity at population scale (Internet Freedom Foundation). IFF also flags a distinctly Indian second-order harm: in households where daughters' internet access is already contested, a "child safety" framing can become a ready-made justification for cutting girls off from connectivity altogether, worsening the existing digital gender divide.
IFF's deeper point — that blanket bans target access rather than the addictive design choices (engagement-maximising feeds, autoplay, notification loops) that make platforms harmful to developing attention spans — is the strongest part of the critique, and one this publication has made about content-moderation mandates elsewhere: fix the incentive structure, not just the on-ramp.
Where the Steelman Breaks Down
But the steelman has a ceiling. "Don't verify anyone's age because verification is invasive" is not a policy; it's an abdication that leaves the CSAM exposure the petitioners described entirely unaddressed. The more defensible position — and the one the DPDP Rules already point toward — is narrow, purpose-bound age assurance (tokenised, minimally identifying, auditable) rather than Aadhaar-linked identity checks tied to every login. The distinction between "verify age" and "verify identity" is where this debate will actually be won or lost, and it is precisely the kind of technical calibration a court disposing of a single PIL cannot do, but a rulemaking process with platform and civil-society input can.
What Comes Next
The Delhi HC's restraint is correct as a matter of institutional competence, but it is not a free pass for inaction. The Centre now owns this question with no judicial clock running — the same dynamic that let the DPDP Rules take 18 months from Act to full compliance. If the government's age-verification framework emerges from the Purandeswari committee's recommendations without engaging IFF's privacy and gender-access objections, the next legal challenge won't be a PIL asking for restrictions — it will be one asking to strike them down.