DPDP Act vs the Feed: Why It Won’t Fix Child Safety

Q: Does the DPDP Act actually protect children from harmful social media content?

It protects their data, not their feed — and those are different problems with different mechanisms. Section 9 of India’s Digital Personal Data Protection Act requires verifiable parental consent for processing the personal data of anyone under 18, and Section 9(3) bans behavioural tracking, behavioural monitoring, and targeted advertising directed at children. Those are meaningful data-protection provisions and they do real work: a compliant platform will not build an advertising profile of your child or serve them behaviourally-targeted ads. What Section 9 does not touch, anywhere, is what the recommendation engine chooses to show next. A feed ranking model optimises for retention using real-time engagement signals within the session — how long the thumb paused, whether a short loop replayed — and it does not need a stored profile, a verified age, or any personal data at all to do that. So a platform can disable tracking for a flagged minor account, suppress all targeted advertising, satisfy every consent requirement, and still serve that fourteen-year-old an endless stream of high-arousal content, because the ranking objective was never regulated. This is the gap parents observe directly: their child’s account is nominally protected, and the content is still inappropriate. Fixing it requires regulating the curation layer — mandating chronological feeds for minor accounts, restricting ad units inside infinite short-form loops, and attaching liability to algorithmic amplification — none of which the current Act contains. The UK’s Age Appropriate Design Code addresses design and defaults directly, which is why it is the more useful benchmark for child safety even though the DPDP Act is arguably stricter on paper about data.

Q: Why does anonymity not protect a child from harmful recommendations?

Because modern recommendation engines run on real-time behaviour, not on stored identity — the harmful part of the system never needed to know who your child is. The intuition behind privacy-first child protection is that if a platform cannot profile a minor, it cannot target one. That was largely true in an era of demographic ad targeting. It is not true of short-form video feeds. These systems rank candidates using engagement signals generated within the current session: dwell time on a thumbnail measured in milliseconds, whether a six-second clip looped twice, whether the user scrolled past instantly or hesitated. Those signals require no account history, no age, no demographic profile, and no persistent identifier — they are produced by the interaction itself. Because the objective function is retention, and because high-arousal content (sexualised, sensational, outrage-provoking) reliably produces retention across virtually all human viewers, a completely anonymous session drifts toward that content within minutes. Nothing about the drift is targeted at children specifically; children are simply not excluded from it, and they are less equipped to disengage. This is why "we do not track minors" is a true statement that provides much less safety than it sounds like. The corollary for policy: banning profiling addresses a real privacy harm but leaves the content-exposure harm entirely intact, and any framework that measures child safety by whether data was collected will systematically miss the mechanism doing the damage. The controls that actually work at this layer are structural — defaulting minor accounts to chronological feeds from explicit follows, removing engagement-optimised ranking rather than removing personalisation from it.

Q: What is the verification paradox in the DPDP Act?

It is the pattern where stricter age-verification requirements produce weaker protection in practice, because the friction pushes minors to declare themselves adults. Section 9(1) requires verifiable parental consent before processing a minor’s data, and Rule 10 of the DPDP Rules — notified in November 2025 — makes this concrete, requiring data fiduciaries to adopt technical and organisational measures ensuring the consent is genuinely parental, with due diligence that the self-identified parent is an identifiable adult and DigiLocker-backed identity tokens among the named mechanisms. Now trace what a teenager does when faced with that flow. Confronted with a signup that demands a parent complete a government-backed identity verification, the rational teenage response is to set the birth year to 2000. The platform then classifies them as an adult, and every Section 9 protection — the consent requirement, the tracking ban, the targeted-advertising prohibition — ceases to apply. The child is now in a completely unprotected environment, arrived at through the protection mechanism itself. The paradox is sharpened by India’s flat eighteen-year threshold, which is stricter than GDPR (16, with member-state discretion down to 13) or COPPA (under 13), so a seventeen-year-old needs verified parental permission for routine use — friction that guarantees widespread misdeclaration. There is a second-order harm too: requiring thousands of apps to each verify parental identity means each of them collects sensitive government-linked identity data, creating many central honeypots. The structural fix is to decouple verification from the app: perform age assurance once at the operating-system or app-store layer and pass apps a zero-knowledge attestation (a minor flag or an age band) rather than an identity document.

Q: How does the UK Age Appropriate Design Code differ from India’s DPDP Act?

The AADC regulates product design and default settings; the DPDP Act regulates data processing and consent. That is the whole difference, and it determines what each can actually prevent. The AADC is a set of 15 standards that impose obligations on how a service is built for children. Standard 7 requires high-privacy settings by default, so protections are active out of the box rather than after someone opts in. Standard 10 requires geolocation to be off by default. Standard 12 requires profiling to be off by default. Standard 13 addresses nudge techniques — precisely, it prohibits nudges that lead children to weaken their privacy protections or provide unnecessary personal data, while permitting nudges toward high-privacy choices. It also applies age-appropriate treatment across five developmental bands (0–5, 6–9, 10–12, 13–15, 16–17) rather than a single cutoff, and favours risk-based, privacy-preserving age assurance over hard identity gates. The DPDP Act, by contrast, is consent-centric: it establishes when a platform may process a child’s data and prohibits tracking and targeted advertising, but once consent is validly obtained it says nothing about defaults, interface mechanics, autoplay, infinite scroll, streaks, or recommendation ranking. The practical consequences: under the AADC a minor’s account arrives with profiling disabled and location off before anyone consents to anything, and dark-pattern retention mechanics are constrained; under DPDP the same account is compliant with tracking disabled while the feed and interface remain engagement-optimised. Neither framework fully solves algorithmic amplification, but the AADC at least reaches the design layer where the mechanism lives.

Q: Is a flat 18-year age threshold better or worse for child protection?

Worse in practice, despite appearing stricter — because a single cutoff ignores developmental differences and creates the friction that drives misdeclaration. India’s DPDP Act treats every person under 18 identically, so a seventeen-year-old and a seven-year-old face the same regime: verifiable parental consent for essentially any data processing. Compare GDPR, which sets 16 with member-state discretion down to 13, and COPPA, which applies to under-13s. Three problems follow from the flat threshold. First, it is developmentally wrong: the protections a seven-year-old needs (no social features, no open messaging, heavily curated content) differ fundamentally from what a seventeen-year-old needs (privacy defaults, algorithmic transparency, protection from exploitative design), and collapsing them into one rule means either over-restricting older teens or under-protecting young children. Second, it drives evasion: friction disproportionate to a sixteen- or seventeen-year-old’s actual risk profile produces mass misdeclaration of birthdates, and a minor classified as an adult loses every protection — the strictest rule produces the least protection for the group most likely to route around it. Third, it makes compliance blunt for platforms, which face a binary rather than being able to build genuinely age-appropriate experiences. The AADC’s five developmental bands are the better model: calibrate protection to capability, so young children get strong restrictions, older teens get privacy-protective defaults and honest algorithmic treatment without infantilising friction, and the incentive to lie about age drops because the burden matches the risk. Pairing developmental tiering with OS-level age assurance — where the age signal comes from the device rather than a self-declared form field — addresses both the calibration and the evasion problem simultaneously.

Q: What would actually make social media safer for children?

Four structural reforms that address the mechanism rather than the metadata, in rough order of impact. First, mandatory zero-recommendation feeds for minor accounts: ban engagement-optimised "For You" ranking for accounts identified as minors and default them to chronological feeds containing only content from accounts they deliberately chose to follow. This is the highest-leverage single intervention because it removes the machinery that produces the drift toward harmful content, rather than trying to filter the output of that machinery. Second, decouple age verification to the OS layer: perform age assurance once at the operating-system or app-store level and pass applications a zero-knowledge attestation (minor flag or age band) instead of requiring each app to collect government identity documents. This eliminates the honeypot problem, reduces friction to a one-time device setup, and makes the age signal far harder for a teenager to falsify than a dropdown at signup. Third, prohibit all ad units inside infinite short-form video streams served to minor accounts — not merely targeted ads, all ads. Removing the monetisation removes the commercial incentive to build addictive feeds for children, which is the root economic driver. Fourth, extend duty of care to distribution: where a platform’s algorithm systematically amplifies self-harm or sexual content into a minor’s feed, intermediary safe-harbour protection should not apply. Liability attached to amplification is what makes the other reforms enforceable rather than aspirational. Complementing these, adopting AADC-style developmental age bands and high-privacy defaults would bring design regulation into a framework that currently addresses only data. The common thread: every one of these operates on what the platform serves and how it is built, which is where the harm actually originates.

Q: Does banning targeted advertising to children solve the advertising problem?

No — it removes the personalisation from the ads, not the ads, and for minors the residual harm is substantial. Section 9(3) of the DPDP Act prohibits targeted advertising directed at children, which is a genuine protection against behaviourally-profiled commercial manipulation. But a minor scrolling an infinite short-form feed still receives a continuous stream of advertising insertions between content; those ads are simply untargeted. That matters less than it sounds, for two reasons. First, untargeted inventory in high-volume short-form placements is disproportionately purchased by categories that buy cheap reach: gambling and betting adjacents, crypto and trading schemes, extreme fitness and body-transformation products, and aggressive direct-response offers. These are precisely the categories a parent would exclude, and removing targeting does nothing to remove them — arguably it worsens the mix, because advertisers with quality inventory tend to want the targeting that is now prohibited. Second, the ad load itself is part of the retention machinery: interstitial ads in an infinite loop are structurally part of the dopamine cadence, so treating them purely as a data-privacy question misses their role in the interface design. The stronger intervention is categorical rather than behavioural: prohibit all ad units inside infinite short-form streams served to accounts identified as minors. This has a second-order benefit that the targeting ban does not — it removes the revenue that justifies building engagement-optimised feeds for children in the first place, attacking the incentive rather than one delivery mechanism. Platforms would still monetise adult accounts normally; they would simply lose the business case for optimising a minor’s attention.

Q: What should platforms building for the Indian market do now?

Treat this as a dated compliance programme rather than a future consideration, and build past the legal minimum if child safety is genuinely a goal. On compliance: the DPDP Rules were notified in November 2025 with a phased runway, so verifiable parental consent under Rule 10 is binding law with a deadline, not a proposal. The concrete work is an age-assurance mechanism, a consent lifecycle that records grant, revocation, expiry, and age transition with an auditable trail, technical enforcement that actually disables tracking and targeted advertising for accounts flagged as minors (not just a policy statement), and parental access and revocation endpoints that produce real cascading deletion. Sensitive identity data used for verification should never be stored raw — hash transaction identifiers, keep no government ID numbers — because verification requirements otherwise create exactly the honeypot risk that makes breaches catastrophic. On going beyond compliance, which is where the actual safety gain is: default minor accounts to chronological feeds from explicit follows rather than algorithmic ranking; suppress ad units in short-form loops for minors; ship high-privacy defaults (private profiles, geolocation off, profiling off) before consent rather than after; disable autoplay and defer engagement notifications overnight; and adopt developmental age bands rather than a binary minor flag so a sixteen-year-old is not treated like a six-year-old. Two practical notes. Age-band context should propagate through your services as a synthetic token, never as a raw birthdate. And if you serve both India and the EU, design once against the stricter of the two regimes — maintaining divergent child-safety logic per jurisdiction is how gaps appear, and the AADC standard is the more demanding target that will also satisfy DPDP.

Satyam Kumar

Back to Blog

ai-architecture

Regulating the Feed, Not Just the Data: Why India's DPDP Act Won't Fix Social Media for Children

By Satyam KumarJuly 26, 202612 min read

dpdp act child safety online algorithmic curation age appropriate design code aadc data privacy india section 9 verifiable parental consent recommendation algorithms tech policy gdpr article 8 coppa social media regulation privacy by design compliance 2026

Regulating the Feed, Not Just the Data: Why India's DPDP Act Won't Fix Social Media for Children

Frequently Asked Questions

Share this article

Twitter LinkedIn WhatsApp

Satyam Kumar

Founder & AI Architect, AppScale LLP

AI & Cloud Architect. Helping teams build systems that scale to millions.

LinkedIn GitHub

Regulating the Feed, Not Just the Data: Why India's DPDP Act Won't Fix Social Media for Children

Frequently Asked Questions

Share this article

Comments

Leave a comment