Back

ARTICLES

Minors on Social Media: Void Contracts, DPDP Consent and the Case for a Statutory Bar

Minors on Social Media: Void Contracts, DPDP Consent and the Case for a Statutory Bar

29.10.2026

Authored by: Jai Dhanani (Counsel) & Drishti Rathi (Associate)

INTRODUCTION

The growing participation of children on social media platforms raises a difficult question at the intersection of the contractual regime, data protection and digital regulation regime, namely, if a minor lacks contractual capacity, what legal consequences follow when the minor accepts a platform’s terms of service?

Social media platforms routinely require users to accept terms and conditions of service before creating an account. Those terms may govern conventional contractual provisions such as account access, content, confidentiality, intellectual property, termination, liability, dispute resolution etc. However, a substantial number of users, accepting the terms are below the age of eighteen, i.e., the age of majority in India. This dilemma poses an immediate question, namely: can a platform rely on a minor’s acceptance of terms as the foundation for an enforceable contractual relationship?

This issue came in to focus on 28.09.2026 wherein the bench of the Hon’ble Supreme Court headed by Hon’ble Chief Justice of India Justice Surya Kant, along with Justices Joymalya Bagchi and V. Mohana, heard a petition filed by Just Rights for Children Alliance i.e., W.P.(C) No. 001120/2026. The petition’s premise is simple: a person under the age of 18 lacks capacity to contract, so a platform that lets a minor click “I agree” contracts with someone is void ab initio as per law. Therefore, the platforms are in no position to rely on minor’s acceptance of the terms.

However, the wider debate concerns whether this principle warrants a statutory restriction on minor’s access to social media accounts. Indian law already treats a child’s acceptance of a platform’s terms of service as void ab initio, yet the same law is now all set to regulate how platforms process that child’s data with a parent’s consent along with a bar on persons under 18 years of age from holding accounts at all. Three regimes are converging this same subject-matter, namely, the Indian Contract Act, 1872 (“Contract Act”), the Digital Personal Data Protection Act, 2023 (“DPDP Act”) read with the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), and a proposed statutory bar announced before the Hon’ble Supreme Court of India (“Hon’ble Supreme Court”) on 28.09.2026.

The intersection of the foregoing legal frameworks presents a more complex problem than may initially appear. The distinction between contractual capacity, consent to the processing of digital data and eligibility to access a digital service is therefore central to understanding of the legal position. Any proposal to impose a statutory bar on minor’s access on social media must consequently be examined as a distinct regulatory measure, rather than being treated as an automatic consequence of the law governing minor’s contracts.

Against this backdrop, the article examines the relationship between the Contract Act, DPDP Act, and the emerging case of statutory restriction on minor’s access to social media platforms. It seeks to determine whether this existing legal framework adequately addresses the position of minors who independently accept platform terms, whether parental consent under the data protection law resolves the resulting legal difficulties and whether the statutory age based restriction is a necessary and proportionate response.

CONTRACT ACT: INCAPACITY TO ACCEPT THE TERMS

The statutory position

Section 10 of the Contract Act provides that an agreement is a contract only if it is made by parties competent to contract. Section 11 defines competence i.e., a person must have attained majority (i.e., 18 years as per Section 3 of the Indian Majority Act, 1875), is of sound mind, and is not be disqualified by any law from entering into contracts. Notably, Section 10A of the Information Technology Act, 2000 validates contracts formed electronically, but does not create capacity where the Contract Act denies it.

Void ab initio, not voidable

In Mohori Bibee v. Dharmodas Ghose, (1903) 30 IA 114 (PC) (“Mori Bibee”), the Privy Council held that a minor’s agreement is void ab initio rather than merely voidable at the option of the minor. The rule thereby is substantive, an electronic interface does not confer a capacity that the law otherwise withholds. Therefore, a click-wrap agreement does not by itself cure a minor’s lack of capacity.

Treatment under the Contract Act

The conclusion that a minor’s agreement is void ab initio must be distinguished from prohibition of a minor’s use of service. Section 11 merely addresses competence to contract and does not expressly prohibit a platform to provide service to a minor. In fact, such voidness does not establish a statutory offence or general prohibition on access.

The treatment further depends on the nature of interaction with the minor. A platform’s terms and conditions may create a contractual relationship but not every activity or interaction with the user shall constitute a contract. The legal consequences which delve from the minor’s incapacity to contract should be assessed in relation to the nature of the agreement and the rights/obligations sought to be enforced against the minor by the platform.

It is, however, imperative to note that the platform shall remain bound by the provisions under data protection law, legislations governing children, intermediary regulations etc. and is not in a position to assume that all the terms of the service shall be enforceable once the minor agrees to the click-wrap agreement. Having said so, it is also to be noted that the lack of an enforceable contract does not automatically make all terms of a service provision unlawful.

THE DPDP ACT, 2023 AND THE DPDP RULES, 2025: PARENTAL CONSENT

The DPDP Act, 2023 (fully operative from May, 2027) along with the DPDP Rules does not prohibit children from platforms It instead makes the processing of their personal data conditional upon verifiable parental consent, and prohibits the forms of processing upon which the commercial model of most platforms depends.

Who is a child

Section 2(f) of DPDP Act defines a “child” as an individual who has not completed 18 years of age.

Section 9: Parental Consent

  • Verifiable parental consent (S. 9(1)): Before processing any personal data of a child, a Data Fiduciary must obtain the verifiable consent of the parent or lawful guardian, in the manner prescribed.
  • No detrimental processing (S. 9(2)): A Data Fiduciary shall not undertake processing of any personal data that is likely to cause any detrimental effect on the well-being of a child.
  • No tracking, behavioural monitoring or targeted advertising (S. 9(3)): This is an absolute prohibition, not a consent-based one and it cannot be waived even by a parent.
  • Exemptions (S. 9(4)): The Central Government may exempt specified classes of Data Fiduciaries, or specified purposes, from the requirements of Sections 9(1) and 9(3).
  • Verifiably safe processing (S. 9(5)): Where the Central Government is satisfied that a Data Fiduciary processes children’s data in a verifiably safe manner, it may notify an age above which that Data Fiduciary is exempt from Sections 9(1) and 9(3).

Rule 10 of DPDP Rules: Meaning of “Verifiable”

Rule 10 requires a Data Fiduciary to adopt appropriate technical and organisational measures to ensure that verifiable parental consent is obtained before any personal data of a child is processed, and to exercise due diligence in confirming that the person identifying himself or herself as the parent is an identifiable adult. A mere self-declaration does not suffice. The Rule contemplates verification by reference to:

  • reliable details of identity and age already available with the Data Fiduciary; or
  • details voluntarily provided, or a virtual token mapped to such details, issued by an entity entrusted by law or by the Government with the maintenance of such details, including through a Digital Locker service provider.

Does parental consent cure the contractual incapacity?

The DPDP Act and Contract Act operate under entirely separate legal frameworks. Parental consent for processing personal data does not transform a minor into a person competent to contract under Section 11. It may satisfy the applicable statutory requirement for data processing but  does not validate minor’s independent acceptance of the terms. Therefore, the parental consent does not automatically make the contract legally enforceable.

However, the consequences depend on the nature of the undertaking and the applicable law. The position may differ where a parent contracts in their own capacity, assumes obligations personally or acts under a legally recognised representative arrangement. Mere parental consent to data processing should not be treated as equivalent to a parent becoming a contracting party.

Section 9 establishes a regime of regulated processing. It presupposes that the child will use the service, and it determines whose consent is required and which forms of processing are prohibited. Section 9(5) goes further and contemplates that certain platforms may be permitted to process the data of older adolescents without parental consent. Therefore, a statutory bar on accounts for persons under 18 would leave this framework with limited application to general social media services, although it would remain fully applicable to educational, gaming, e-commerce and other services.

PROPOSED STATUTORY BAR

Within 10 months, the idea of an age bar in India moved from a High Court’s suggestion to an undertaking by the Union of India before the Hon’ble Supreme Court during the proceedings on 28.09.2026. During the proceedings, the Union assured that it would actively take steps to regulate companies and amend the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“IT Rules”) to legally bar social media platforms from allowing users under eighteen years of age to independently create accounts. However, as on date, no amendment imposing such a bar has been notified.

The proceedings before the Hon’ble Supreme Court

The significance of W.P. (C) No. 001120/2026 lies less in the outcome, which is still pending, than in its reasoning. The aforesaid Writ Petition did not pray for a ban on policy grounds, rather it prayed the State to enforce the existing law of capacity. The Petitioner in the aforesaid Writ Petition sought amendment of the IT Rules, or specific directions, so that platforms do not contract with persons under eighteen years of age, without parental or guardian consent, backed by identity verification or e-KYC. However, the response by Union of India took the argument a step further, from parental-consent gating to a prohibition on social media accounts, with an exception contemplated for educational services.

ANALYSIS AND CONCLUSION

The discussion above shows that the Contract Act, the DPDP Act and the proposed bar each deal with a different question. The Contract Act asks whether a minor can be bound by the platform’s terms. The DPDP Act asks whose permission is needed before a child’s data is used, and which uses are not allowed at all. The proposed bar asks whether a child should hold an account in the first place. Much of the present debate treats these as one question. They are separate, and the answer to one does not settle the others.

Parental consent settles the data question, not the contract question

The DPDP Act comes closer to the actual harm. What most platforms take from a child is attention and data, and Section 9 regulates exactly that. The prohibition on tracking, behavioural monitoring and targeted advertising in Section 9(3) is significant because even a parent cannot waive it. It goes to the heart of the business model most often blamed for harm to children.

Even so, parental consent under Section 9(1) is consent to processing. It does not make the parent a party to the terms of service, and it does not give the child the capacity that Section 11 of the Contract Act denies. A platform that fully complies with the DPDP Act will still have no enforceable contract with the child. Two practical concerns remain. First, the Act will not be fully in force until May 2027, so these protections are largely on paper for now. Second, the method of verifying parents under Rule 10 has not yet been tested at the scale of India’s user base.

The bar is a policy choice

The Petition before the Hon’ble Supreme Court asked the State to enforce the existing law of capacity. The Union’s response went further and proposed that persons under eighteen should not hold accounts at all, this step does not follow from the Contract Act. The law of capacity says that a minor’s promise cannot be enforced, but it nowhere says anything about whether a minor may use a service. A bar on access must therefore be justified on its own merits, and the following issues will need to be addressed before it can stand.

  • Instrument: rules or statute. A prohibition on account-holding by a class of citizens restricts expression and access to information under Article 19(1)(a). Restrictions must rest on “law” and fall within Article 19(2). A bar introduced only through rules under Sections 79 and 87 of the IT Act invites the ultra vires challenges that have already troubled the IT Rules 2021 in the past. We consider that a bar of this consequence should be enacted by Parliament.
  • Under Puttaswamy and Anuradha Bhasin v. Union of India (2020) 3 SCC 637, the State must show a legitimate aim, a rational connection, the absence of a less restrictive but equally effective alternative, and a fair balance. A blanket bar to 18 must be justified against graded alternatives, including the DPDP Act’s own ban on tracking and targeted advertising, which addresses the engagement-driven model most associated with harm.
  • The age-assurance paradox. Verifying that users are adults means verifying everyone. Mandatory e-KYC for all users would collect identity data at a scale that sits uneasily with the DPDP Act’s purpose-limitation and data-minimisation principles. Token-based, zero-knowledge or DigiLocker-style attestations that confirm age without disclosing identity should be the default, as Rule 10 of the DPDP Rules already contemplates for parents.
  • “Social media” must be defined with care. Messaging, video gaming, education and news services blur together, and an overbroad definition will sweep in services with clear value for children, while a narrow one invites migration to unregulated alternatives.
  • Alignment with the DPDP Act. If the bar is enacted, Section 9 should be read as governing all services not covered by the bar, and the power under Section 9(5) to lower the consent age for verifiably safe processing should be exercised consistently with it.

Conclusion

The Petition before the Hon’ble Supreme Court rests on a simple and sound idea i.e., a platform should not benefit from an agreement that the law says a minor cannot make. It is fitting that a rule settled in Mohori Bibee more than a century ago now sits at the centre of the debate on platform governance. But the rule has limits. A void contract can be raised as a defence when a platform tries to enforce its terms. It cannot tell a platform how to design its service, what data it may collect, or who may hold an account.

The DPDP Act regulates data, not access, and the proposed amendment to the IT Rules has not yet been notified. If at all there is a restriction regarding children’s access to social media, then the said restriction ought to be promulgated by the Parliament basis the evidence of harm and the age qua restriction it fixes should be one the State can justify. It should place the duty to verify age on platforms, using methods that do not require every user to disclose their identity, further it should leave children free to use educational and civic services platform and it should work alongside the DPDP Act rather than against it. As a law built the foregoing way would protect children without making identity checks the price of being online for everyone else.

References:

Cases referred:

  • Mohori Bibee v. Dharmodas Ghose (1903) 30 IA 114 (PC);
  • Khan Gul v. Lakha Singh AIR 1928 Lah 609 (FB);
  • Raj Rani v. Prem Adib AIR 1949 Bom 215;
  • Shreya Singhal v. Union of India (2015) 5 SCC 1;
  • S. Puttaswamy v. Union of India (2017) 10 SCC 1;
  • Faheema Shirin R.K. v. State of Kerala (Ker HC, 2019);
  • Anuradha Bhasin v. Union of India (2020) 3 SCC 637;
  • AGIJ v. Union of India (Bom HC, 2021, interim);
  • Kunal Kamra v. Union of India (Bom HC, 2024);
  • Vijayakumar v. Union of India (Mad HC, Madurai Bench, Dec 2025);
  • Just Rights for Children Alliance v. Union of India (SC, pending; heard on 28.09.2026).