Subject: Internal Security

Why in the News

Meta has agreed to pay up to $17.1 billion to resolve child harm claims brought by a bipartisan coalition of attorneys general across the United States, its territories and the District of Columbia.

What does the settlement require Meta to do?

1. The scale and the date: The agreement was reached on 26 August and ranks among the largest consumer protection settlements in internet history.
2. Default time limits and night restrictions: Users under 18 get default limits on time spent and restrictions on night time use.
3. Limits on notifications during school hours: The company must curb notifications sent to minors while school is in session.
4. Age assurance: The settlement requires enhanced measures to establish whether a user is a minor before the account is treated as an adult account.
5. Independent compliance oversight: Compliance with the safeguards is monitored by an independent party rather than reported by the company itself.

Why does the penalty carry little punitive weight?

1. The sum is small against the revenue base: The company generated $201 billion in revenue in 2025, and the settlement is payable over 10 years.
2. The market read it as a cost, not a shock: The stock rose 5 per cent after the settlement was announced.
3. The reforms are the substance, not the money: The mandated safety changes go to how Facebook and Instagram are allowed to operate for minors, and they are overdue rather than novel.

Why has India’s own debate produced no comparable outcome?

1. The cycle is episodic and self closing: A tragedy occurs, outrage follows, a platform issues a statement, a parliamentary question may be asked, and silence returns.
2. The harm is not less serious here: The absence of Indian legal action reflects the absence of a process capable of compelling answers, not a smaller problem.
3. Regulatory attention has been lighter than in the West: Global platforms have operated in India with weaker oversight and lower public awareness than they face in other large markets.

What did the American case produce that India lacks?

1. Court compelled discovery: The litigation forced the company to produce internal research, design documents and executive communications about child safety, under oath, in public and subject to cross examination.
2. The questions India cannot currently ask: What internal research shows about the mental health impact on Indian teenage girls, how the recommendation engine behaves in Hindi, Tamil and Bengali for a fourteen year old at 11 pm, and how many Indian children under 13 are active on platforms that legally prohibit their membership.
3. The unmeasured scale of abuse material: The scale of child sexual abuse material affecting Indian users and the manner of its reporting are not on any public record. Eg. In the United States alone, 7.5 million such materials were under internal review.
4. Whether the same design was applied here: If the addictive design features at issue in the American cases were applied to Indian users, those users have been exposed to the same harm with none of the protection.

What legal tools does India already hold?

1. The statutory base already exists: The Consumer Protection Act, 2019, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Protection of Children from Sexual Offences (POCSO) Act, 2012, the Juvenile Justice (Care and Protection of Children) Act, 2015 and the Constitution together cover the conduct alleged.
2. A regulator level inquiry: The National Commission for Protection of Child Rights (NCPCR), the statutory body for child rights, can open a formal inquiry compelling platforms to produce India specific safety research, algorithm documentation, data on underage users and internal harm research.
3. Direct recourse for families: Affected families can approach consumer forums and High Courts directly, without waiting for a regulator to act first.
4. Coordinated State litigation: State governments can file consumer protection and child safety suits in Indian courts, and a single State moving first can trigger a wider set of filings.
5. The policy standard is already stated: The Safe, Trusted and Accountable framework developed in 2021 was built so that platforms operating at scale bear legal responsibility for the consequences of their design choices.

Why is new legislation still needed?

1. Existing law compels disclosure only case by case: Each of the routes above produces documents inside one proceeding, so nothing survives the case that produced it.
2. A statutory right to algorithmic disclosure: Parliament can create an obligation on platforms to reveal their content moderation policies, recommendation engine parameters and child safety research for Indian users.
3. A standing recipient rather than a court: The disclosure would run to a designated Indian authority, which turns a litigated exception into a continuing duty.

Challenges to compelling platform disclosure in India

1. No child rights regulator holds standing discovery power: A statutory commission can summon information, and it cannot compel sworn production of internal research open to cross examination. Eg. Platform responses to Indian regulators are routinely filed as written submissions rather than as evidence tested in a hearing.
   The Fix: Give the child rights commission discovery powers with a stated penalty for non production, on the model available to a commission of inquiry.
2. Consumer forums cannot read algorithmic evidence: A district or State consumer commission has no technical assessor able to interpret recommendation engine documentation. Eg. Consumer adjudication in India is built around defective goods and deficient services, not around product design telemetry.
   The Fix: Attach a standing panel of technical assessors to the National Consumer Disputes Redressal Commission for platform cases.
3. The evidence sits outside Indian process: Internal research and design documents are held on servers abroad and reached through mutual legal assistance. Eg. Mutual legal assistance requests to the United States for platform records routinely take more than a year to return.
   The Fix: Write a production obligation for India specific safety research into intermediary due diligence, so the duty attaches to operating in India rather than to where a server sits.
4. Safe harbour blunts liability for design: Section 79 of the Information Technology Act, 2000 shields intermediaries for third party content, and design and ranking choices are argued into that shelter. Eg. Platforms have defended recommendation ranking as an automated function rather than as an editorial act.
   The Fix: Separate design and ranking decisions from hosting in the due diligence rules, so safe harbour covers content and not product architecture.

Conclusion

Platform accountability in India has been argued at the level of statements and outrage, never at the level of evidence. The material that would establish whether Indian children were exposed to the same design choices sits with the platforms, and no Indian process currently compels its production. Legislation would convert that into a standing duty, and litigation would produce it once. The marker to watch is whether any Indian regulator or State government files an action carrying discovery powers, rather than another request for information.

Online child safety in India

1. What the domain covers: It governs how platforms design products for users below 18, across age of access, consent, exposure to content and collection of data.
2. The regulatory age is higher than the platform age: Indian data protection law treats anyone below 18 as a child, while platforms set their own account creation floor at 13.
3. States have moved before the Centre: Karnataka announced plans to bar social media for those under 16, and Andhra Pradesh announced restrictions for those under 13.
4. The evidence base cited officially: Research highlighted in the Economic Survey 2025-26 records that adolescents lack the neurological brakes needed to resist addictive features such as infinite scroll.

Laws and Rules Governing Online Child Safety

1. Digital Personal Data Protection Act, 2023: It treats any individual below 18 as a child, requires verifiable parental consent before processing a child’s data, and prohibits behavioural tracking and targeted advertising directed at children.
2. The Data Protection Board of India adjudicates breaches and imposes penalties under the Act, with appeals lying to the Telecom Disputes Settlement and Appellate Tribunal.
3. Information Technology Act, 2000: Section 67B criminalises publishing or transmitting material depicting children in sexually explicit acts, and extends to browsing and downloading such material.
4. Indian Penal Code and Bharatiya Nyaya Sanhita provisions on obscenity: They cover sale and circulation of obscene material to a person under 20, and operate alongside the specialised child protection statutes.

Key Facts about Online Child Safety

1. Australia set a minimum age of 16 for social media accounts through the Online Safety Amendment (Social Media Minimum Age) Act 2024, enforced from December 2025.
2. Indonesia became the first Southeast Asian country to enforce a ban for under 16s, in March 2026.
3. Gaming disorder is classified as a health condition in the World Health Organization’s International Classification of Diseases, Eleventh Revision (ICD-11).
4. Kerala runs Digital De-Addiction centres, known as D-DAD centres, for children showing signs of compulsive device use.

Challenges in Online Child Safety

1. Age verification is easily circumvented: A minimum age holds only where the platform can establish age, and self declared dates of birth cannot be checked. Eg. Children open accounts on platforms barring under 13s using a false year of birth or an adult family member’s account.
   The Fix: Move to privacy preserving age estimation processed on the device, rather than to identity document uploads.
2. Verification itself creates a new privacy risk: Establishing age through selfies, identity documents or bank details assembles a fresh database of minors’ sensitive data. Eg. Document based age checks require a child to hand a platform the exact identifiers the law is trying to keep from it.
   The Fix: Require age signals to be discarded once the check is complete, with a bar on retaining the underlying document.
3. A ban pushes use underground: Restriction moves minors to less regulated services and to tools that hide their location. Eg. Teenagers migrate to smaller platforms or route access through virtual private networks.
   The Fix: Replace a binary ban with a graduated model, strict restriction under 13, supervised access from 13 to 15, and full access at 16.
4. Restriction removes support networks for some children: Online communities are the only peer support available to some minors, and a blanket bar cuts that too. Eg. LGBTQ+, neurodivergent and disabled children frequently depend on such communities.
   The Fix: Exempt verified support, counselling and helpline services from minor account restrictions.

[2025, GS2, 15 marks] The National Commission for Protection of Child Rights has to address the challenges faced by children in the digital era. Examine the existing policies and suggest measures the Commission can initiate to tackle the issue.”