On 17 October 2026, a Supreme Court bench of Justices J B Pardiwala and K Vinod Chandran declared that the right to access and use the internet is a fundamental right of every individual under Article 21 read with Article 19(1)(a), children included. The headline read is a rights story: a court telling the state it cannot simply switch children off. That read is correct as far as it goes.
It is worth slowing down on what the bench said next. It was not only against bans. The Court expressed concern that age-based restrictions could require the identification and ascertainment of every user's age, involving continuous collection and monitoring of sensitive data and a disproportionate risk of misuse and surveillance. The Court's own test for any safeguard is therefore not "does it protect children" but "does it protect children without building a database of everyone."
What the Court left open
The bench did not say children need no safeguards. It called blanket restrictions "unproven measures of proven disproportionality" and said no country has shown they make children safer. It then suggested a system built on parental consent and a separate child mode, applied to pre-teens, with proportionate ways of confirming that a parent has consented. The design was left to the Union government.
The Union has already written much of that design.
The consent rule that already exists
Section 9 of the Digital Personal Data Protection Act, 2023 defines a child as anyone under 18. It requires a company to obtain verifiable consent from a parent before processing any personal data of a child, and it bars tracking, behavioural monitoring and targeted advertising directed at children. The consent duty is not limited to pre-teens. It covers every person under 18.
The mechanics sit in the rules. Rule 10 of the DPDP Rules, 2025 makes the company check that the person identifying herself as the parent is an identifiable adult. The check can rely on identity and age details the company already holds, on details the parent volunteers, or on a virtual token issued by an authorised entity, a category that includes details verified by a Digital Locker service provider.
Read against the Court's test, the rule does something specific. It puts the identity and age check on the parent. Notified in November 2025, the Rules gave an 18-month phase-in, with limited exemptions for essentials such as healthcare, education and real-time safety. Rule 10 takes effect eighteen months after the 13 November 2025 gazette, which is 13 May 2027, 208 days after the ruling.
The scale the check has to carry
The population the rule governs is not small. More than half of children aged five to nine, 54 percent, reported using the internet in the three months before the National Statistics Office's telecom survey, against about 60 percent of all Indians as of 2025. Children that young are online at nearly the rate of the whole population.
Each of those accounts will need a parent whose identity and age the platform can confirm. The Court's surveillance worry does not vanish. It relocates. Instead of a platform holding the age of every user, it holds identity and age details for the adult behind each child's account. The token route in Rule 10 is the pressure valve: if a platform receives only a signal that a verified adult consents, little is collected. If it receives the identity details the token is mapped to, a large store of parent data forms at the same moment the Court warned about one.
The honest objection
The strongest objection is that this misreads the rule. The Court's concern was universal age checks. Rule 10 is triggered after a child is known to be a child. Its worked examples begin with a child who tells the platform she is a child, or a parent who opens an account for one. Nothing in the rule text requires a platform to test every user's age. On that reading the DPDP design already passes the Court's test, and the bench was warning against a different, harsher regime such as an age-gated ban.
That is a fair reading of the rule text. It leaves one gap. The Act's duty attaches to any child's data, and a platform that never learns a user is a child cannot have obtained consent for that user. The text does not say how a company is supposed to resolve that, so the incentive is to ask more users for more proof, not fewer. This is our reading of the incentive, not a finding in the rule, and the government's guidance before May 2027 will settle it either way.
The Signal
The ruling and the rule now point at the same design, and neither has yet defined what makes it proportionate. The Court said consent verification must be reasonable and proportionate and left the modalities to the Union. The rule says a parent can prove adulthood through a token. The open question is how much a platform learns when it checks one.
Watch for the Union's implementation guidance before the rule takes effect, and for one detail in it: whether the token confirms only that a verified adult consents, or passes identity details along. A bare confirmation satisfies the Court. Passing identity details along builds the database it warned about, one parent at a time.
Reporting basis: the Supreme Court ruling is reported by LiveLaw and Siasat, and rests on those two press reports of the bench's observations, not on the judgment text. The Digital Personal Data Protection Act and the DPDP Rules are cited from the Gazette texts published by the Ministry of Electronics and IT, and the notification date and phase-in from a Press Information Bureau release. The figures for children aged five to nine and for all Indians are from the National Statistics Office's telecom survey, as presented by Data For India, and that relay is the only source verified for them. The day counts to the rule's start date are The Signal's calculations from the gazette dates.
