India’s existing laws address harmful online content and child sexual exploitation, but do not establish a comprehensive framework to mitigate risks arising from platform design, including recommendation systems and engagement-driven features, according to a report by NALSAR University of Law and the Indian Governance and Policy Project (IGAP).
The report, ‘The Child Safety Imperative: Age-Appropriate Digital Governance Pathways for India’, examines gaps in India’s legal framework and recommends a dedicated online child safety framework centred on safety-by-design obligations, platform accountability and privacy-preserving age assurance.
The findings come as states like Karnataka, Goa, and Andhra Pradesh consider age-based restrictions on children’s social media access. At the national level, the Supreme Court in September asked the Union Government to consider statutory rules governing minors’ social media access. The Centre is also considering graded restrictions on minors’ social media access.
India’s laws focus on unlawful content, not platform design: Section 67B of the IT Act criminalises the creation, publication and distribution of child sexual exploitation and abuse material (CSEAM), while Section 79 and the IT Rules establish due diligence obligations for intermediaries. The 2026 amendments to the IT Rules also extend obligations to synthetically generated content, including deepfakes and manipulated audio-visual material.
However, these provisions do not establish a comprehensive system for regulating platform design. Recommendation algorithms, engagement-driven features, and systems that exploit children’s developing cognitive capacities can create risks that content moderation alone cannot address.
The DPDP Act introduces protections against processing that harms children’s wellbeing, alongside restrictions on tracking, behavioural monitoring and targeted advertising. However, its child-specific provisions are scheduled to take effect on May 13, 2027. The report argues that India needs a framework that addresses risks arising from digital services themselves, rather than relying primarily on prohibitions against unlawful content and individual conduct.
Legal gaps persist across emerging online harms: The report says existing criminal laws do not fully address cyberbullying, doxxing, sextortion and AI-related harms. The Bharatiya Nyaya Sanhita addresses certain forms of intimidation and defamation, but these provisions only partially cover contemporary online harms. For instance, disclosing a child’s personal information may fall outside the scope of these offences when the information is factually accurate, or the legal requirements for intimidation are not met.
Similarly, the law on extortion does not expressly cover sextortion where an offender seeks sexual images, sexual acts or other non-financial forms of compliance. Such cases may require authorities to rely on a combination of provisions under the BNS, POCSO and the IT Act.
The report also identifies limitations in the Sahyog portal, which facilitates government-issued takedown notices to intermediaries. Its current role primarily involves communicating removal requests; it does not yet provide reciprocal mechanisms for intermediary reporting, information-sharing or joint investigations.
It recommends a more coherent reporting system for child sexual exploitation and abuse material, alongside clearer institutional responsibilities and stronger coordination between regulators and law enforcement agencies.
Age assurance presents privacy and implementation challenges: The DPDP Act requires data fiduciaries to obtain verifiable parental or guardian consent before processing the personal data of children under 18. The accompanying rules provide mechanisms to verify consent, including identity information already held by a data fiduciary, information supplied by a parent or guardian, and virtual tokens issued by authorised entities.
However, questions remain about the effectiveness of age assurance, the additional personal data collected to verify age or parental relationships, and the standards platforms must meet to establish verifiable consent.
Age-based restrictions would also create practical challenges if states adopted different thresholds. Digital platforms operate across state and national boundaries, making geographically specific restrictions difficult to implement. Divergent state requirements could create fragmented compliance obligations for platforms.
The proposed approach is to match the level of age assurance to the risks associated with a service. Privacy-preserving age estimation could suffice in some contexts, while higher-risk services might require stronger verification.
Any system should include data-minimisation requirements, security safeguards and clear restrictions on retaining or reusing age-assurance data. The relationship between age verification and existing obligations under the DPDP Act also needs greater regulatory clarity.
Recommendations from the report: The report recommends that India consider a dedicated, principle-based online child safety framework, with safety-by-design obligations at its core. Such a framework could establish principles that guide regulatory responses as technologies and platform practices evolve, without requiring legislative amendments for every new risk.
Platforms should make the safest experience the default for children, rather than leaving protective measures to optional settings. Potential measures include non-profiling recommendation options, limits on engagement-driven design for younger users, and child-safety risk assessments before introducing new products or features.
Proposed restrictions should also undergo child rights impact assessments to examine their effects on access to education, health information and peer-support communities. Children and adolescents should be consulted during policy development.
The recommendations further call for investment in regulators’ technical expertise, operational autonomy and financial resources. Digital literacy programmes should involve children, parents and educators, while schools could help identify and respond to cyberbullying, online harassment, image-based abuse and risks associated with algorithmic systems.
Also read:
- Issue Brief: Age Verification and Restricting Social Media for Children #NAMA
- Report: Child Rights Commission is creating social media code of conduct for children’s safety online
The post Report: India’s laws address harmful content, but do not mitigate design features harmful to children appeared first on MEDIANAMA.