On May 28, 2026, the Fifth U.S. Circuit Court of Appeals issued an administrative stay that lifted U.S. District Judge Robert Pitman's December 2025 preliminary injunction, allowing Texas's SB 2420 — the App Store Accountability Act — to take effect while its appeal proceeds. The court offered no reasoning. Pitman had found the law likely violates the First Amendment, comparing it to requiring "every bookstore to verify the age of every customer at the door" before a minor could enter or buy a book (Texas Tribune).
The ruling reads as a distant American culture-war story. It is not. SB 2420 forces Apple's and Google's app stores to verify the age of every user, obtain written parental consent before anyone under 18 downloads an app or makes an in-app purchase, and requires developers to rate every app across four age bands — under 13, 13–15, 16–17, and adult. That architecture — push age assurance to a single platform chokepoint and gate minors behind parental consent — is, in its essentials, the architecture India has already chosen.
India already chose the harder version
The steelman for both Texas and India is real. Minors face industrial-scale harms online — non-consensual deepfakes, grooming, addictive design — and asking individual children to navigate that alone is a policy failure. Concentrating verification at a chokepoint (the app store, or the data fiduciary) is administratively cleaner than asking ten thousand apps to each build their own age gate. Lawmakers are responding to genuine demand from parents, not inventing a problem.
But India has reached for a more sweeping version of the same instinct. The Digital Personal Data Protection Rules, 2025 — notified on November 13, 2025 (PIB) — require every data fiduciary to obtain "verifiable consent of the parent" before processing the personal data of anyone under 18 (Rule 10). Acceptable methods include matching identity and age against a government-issued virtual token or a Digital Locker service (DPDP Rules, Rule 10).
Two design choices make India's regime more consequential than Texas's. First, the threshold: India treats everyone under 18 as a child, where the EU's GDPR sets the consent floor between 13 and 16 and the U.S. COPPA at 13. A 17-year-old signing up for a coding course or a multiplayer game is, in Indian law, a child whose data cannot be touched until a parent is verified. Second, the verification anchor: where Texas leans on Apple and Google's existing account systems, India's Rule 10 routes verification toward DigiLocker and ID-linked tokens — folding identity infrastructure into routine app sign-ups for a population of 1.4 billion.
Layered on top sits the content-side mandate. The IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 — notified February 10 and in force February 20, 2026 — require platforms to make users declare whether content is synthetically generated, to label that content "prominent[ly], easily noticeable, and adequately perceivable," and to embed provenance metadata (Khaitan & Co). Between the DPDP Rules and the SGI rules, India has built both an identity chokepoint and a content chokepoint within four months.
The enforcement gap India can't wish away
Here is where Pitman's warning and India's reality meet. The constitutional cost he flagged — that age-verification mandates burden every adult's right to read and speak anonymously to shield minors — is not a cost India has avoided. It is a cost India is set to import at a larger scale, with a higher age threshold and a heavier identity footprint. And the supposed payoff, stronger protection, is precisely what India is struggling to deliver.
Four months after the SGI rules took effect, MediaNama documented ten cases in which AI-generated content spread without labels, platforms failed to act, or victims had to seek remedies on their own — including a non-consensual intimate imagery victim whom Instagram told the deepfakes "did not violate its Community Standards," despite a two-hour takedown mandate (MediaNama). The Bombay High Court has let actor Preity Zinta proceed against Google and 15 others over AI deepfakes — an individual turning to litigation because the rules, on their own, did not bite.
That is the pattern proportionate regulation should learn from. A mandate without an enforcement mechanism does not protect children; it imposes friction on the lawful majority while the harmful minority routes around it. Texas's stay does not vindicate the model — it merely defers the constitutional reckoning. India would be unwise to treat the Fifth Circuit's silence as endorsement.
What proportionate looks like
None of this argues for doing nothing. It argues for matching the tool to the harm. Targeted, time-bound takedown obligations for the genuinely dangerous categories — NCII, CSAM, impersonation — are defensible and enforceable, and India already has them; the failure is in enforcement capacity, not in the absence of rules. What is harder to justify is a universal, ID-linked verification wall that treats a 17-year-old reading the news as a compliance event, exports surveillance risk onto the entire adult population, and substitutes the appearance of protection for its substance.
The Texas litigation will eventually force American courts to weigh those trade-offs in the open. India's framework has not faced the same scrutiny — but the same questions apply, and its higher threshold and identity anchoring make them sharper. The lesson of the Fifth Circuit's unexplained stay is not that the age-gate works. It is that nobody has yet shown it does.