What the Supreme Court’s Age-18 Push Means for Your Compliance Roadmap

A date of birth is usually one of the least consequential fields in a digital sign-up form. A business can verify a user’s identity, obtain consent, accept its terms and still miss the most basic question whether that person is legally entitled to sign up on the platform in the first place?

The question sits at the heart of the Supreme Court’s recent observations on minors creating social media accounts. In a recent hearing of a PIL filed by the Just Rights for Children Alliance, the Supreme Court (SC) questioned how platforms could allow children as young as 12 or 13 to open accounts when it contradicts the Indian contract law. The reasoning was simple that creating an account means accepting the terms of service of the particular platform, which leads to entering a contract. Under Section 3 of the Majority Act, 1875, and Section 11 of the Indian Contract Act, 1872, a person aged 18 years or above is only competent to enter a contract.

Consequently, SC requested the centre, represented by the Solicitor General Tushar Mehta, to make some amendments under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 so that these intermediaries (social media platforms) align their software in conformity with Indian laws, otherwise SC will be compelled to pass the directions. No rule has been notified yet. This is not a deadline, then, but it shows where the court is looking. It is no longer asking only what children see online. It is asking how they get in.

For businesses this creates a compliance problem that cannot be solved simply by adding another consent screen. The businesses first need to establish whether the person signing up on their platform is eligible to enter the contractual relationship as per the Indian Contract Law. It then needs to determine what it may lawfully do with that person’s data under the DPDP Rules 2025. 

Parental consent addresses data processing, not necessarily account eligibility

The distinction becomes particularly important as the businesses state that they are building mechanisms for parental consent on behalf of the child. However, the provision addresses how a child’s personal data may be processed under Section 9 of the Digital Personal Data Protection Act and Rule 10 of DPDP which requires verifiable parental consent before processing a child’s personal data, placing restrictions on tracking, behavioural monitoring and targeted advertising directed at children.

The contractual-capacity question remains unanswered whether the child can independently establish the underlying account relationship. A platform may therefore have a mechanism for obtaining verifiable parental consent and still face a separate question about whether its onboarding model appropriately establishes account eligibility.

This distinction is easy to overlook when privacy compliance is treated as the complete answer to child protection. For leadership teams, it changes the risk assessment. The issue no longer belongs exclusively to the privacy function. Legal, product, technology, information security, compliance and procurement may all have a role in designing and evidencing the relevant controls.

Proving Age Leads To A New Risk  

This is uncomfortable because most platforms treat age as something the user tells them. A user self-declares its age, which never gets checked, and a number of decisions rest on it. Whether your terms bind that user, whether your data processing has a valid basis, whether you need a parent’s consent, which features are available to the user, all of them depend on the age of the user. Nothing happens while nobody looks. The problem begins the day someone does when a regulator, a court or a customer asks how you knew a user was allowed to sign up. 

A declared age is a statement. An established age is evidence.

That shift has consequences for how businesses design onboarding, obtain consent, process personal data, manage vendors and demonstrate compliance.

It is tempting to think the cure is simply to check every user’s age, but that is where it gets tricky. To prove someone is eighteen, you have to collect something: a government-backed ID, a digital token, a third-party check. The check applies to every user, not only children. It leads the business to holding up more sensitive data than before, some of it sitting with a vendor. 

One risk has been fixed by creating another. The data protection rules already contemplate verifying the identity and age of the adult who gives a parent’s consent, so the building blocks exist. The craft lies in the design: collect as little as you can, keep it for as short a time as you can, and be able to explain both choices. 

The Way Out: A Readiness Review, Treating Age As A Control, Not A Data Point 

The businesses do not need to predict the final regulatory model to start preparing. They need to understand where age currently influences business decisions and whether those decisions are supported by reliable controls. A practical assessment should begin with the customer journey, mapping every point where age can affect:

• account creation and eligibility;
• consent and parental authorisation;
• access to products or features;
• profiling and personalised experiences;
• advertising and analytics;
• data retention and deletion;
• payments or other contractual transactions.

The next step is to examine the evidence behind the age attribute.

• Is age simply self-declared or verified? 
• Is the verification performed internally or through a third party? 
• Does the system automatically apply different controls when a user is identified as a child?
• Can the organisation demonstrate that those controls actually operated?

The same assessment needs to extend into the third-party ecosystem. Identity providers, advertising platforms, analytics providers, authentication services and other technology partners may form part of the age-related control environment. Their role should be reflected in contracts, operating procedures and assurance mechanisms.

The objective is not to build a complex compliance mechanism before the regulatory position is settled. It is to ensure that the business understands the dependency well enough to respond without rebuilding its customer journey from scratch.

The Larger Leadership Question

The Supreme Court’s observations bring attention to a broader issue in digital compliance. Businesses increasingly rely on information supplied by users to determine what they can legally do. Age is one example. Identity, consent and authority can raise similar questions.

The important distinction is between information collected and information that the businesses can reasonably rely upon as evidence. That distinction should now be part of management discussions around digital onboarding.

For CXOs, GCs, DPOs and compliance leaders, the practical question is therefore not whether India will ultimately adopt a particular age threshold or verification model. The more useful question is whether the businesses know where age affects its legal obligations, what controls currently support that determination, what evidence those controls produce, and how quickly the business could adapt if the regulatory expectation changes.

The larger lesson is simple: when a piece of user information determines what the business is legally entitled to do, it should not remain merely a field in the sign-up form. It needs to be treated as a control.