Introduction
Merely clicking ‘I consent’ without comprehension, while parents still struggle to unlock screens, is not a safeguard but rather a reflection of a generational gap in technological awareness.[1]
Rapid digitalisation has fundamentally reshaped children’s interaction with virtual spaces, enabling new forms of expression and participation in the digital environment. Children have emerged as active participants in online gaming, social media ecosystems, and digital content creation, drawing them into what this paper conceptualises as “digital shadows”. This emerging phenomenon exposes existing gaps in legal safeguards, directing children towards dark patterns in the era of technological transformation. The primary challenge lies in balancing a regulated digital market[2] with child’s right to free expression and meaningful participation.
However, their participation is increasingly shaped by opaque algorithms and exploitative gaming platforms that influence what children see, create, and engage with online, undermining meaningful self-expression by steering children’s choices through commercial incentives rather than informed and autonomous decision-making. Gaming platforms and applications have emerged as central domains where concerns about autonomy and consent remain largely unaddressed. Although free-to-play models increase accessibility, they often depend upon manipulative monetisation practices, such as in-app purchases and loot boxes, that exploit children’s behavioural vulnerabilities. The risks associated with unregulated digital exposure include privacy concerns, exposure to harmful content and cyberbullying, all of which may affect holistic development.
A Three-Tier Liability Model
Consequently, liability cannot rest solely with the government, nor are children entirely to blame, as games (e.g. loot boxes) and websites are designed in a manipulative manner that fosters addictive behaviour. The following three-tier liability model distributes responsibility among the State, platforms, and parents, unlike the current framework, which leaves it vaguely allocated. This underscores the urgent need to evolve platform liability through the imposition of a statutory duty of care.[3] Yet, there is a limited but important role for parental responsibility.
The scale of the internet complicates effective regulation. Complete supervision of every person’s digital footprint is not logistically possible, and attempting it risks the right to freedom of speech and expression, potentially turning into excessive censorship, as emphasized in Shreya Singhal v. Union of India (2015).[4] Conflating addictive and deceptive digital interfaces with free speech, however, constitutes a conceptual error, since this is a question of child welfare and meaningful self-expression,[5] not of censorship.
The existing regulatory framework reveals a structural limitation: legislative reform has consistently struggled to keep pace with rapid technological advancement, a concern also recognised in the Economic Survey 2020–21.[6] Rather than attempting to prescribe exhaustive rules for every emerging digital practice, the law should establish broad regulatory principles capable of adapting to technological change. The resulting gap between legislative intent and regulatory implementation has left children’s digital interactions insufficiently protected. Consequently, the protection of children in digital spaces must be reconceptualised through a liability-based framework that clearly allocates responsibility among the State, platforms, and parents. The government should adopt a balanced approach in law making, evaluating its existing and upcoming laws against three core objectives: market integrity, protection of children’s expression, and a regulated ecosystem, thereby establishing a foundational framework to avoid legal ambiguities. A further limitation lies in the application of intermediary safe harbour, which currently prioritises platform immunity over proactive child protection. For platforms predominantly accessed by children, the availability of safe harbour should therefore be conditioned upon demonstrable compliance with child-safety obligations. This proposal is consistent with the existing framework of intermediary liability. Section 79 does not provide intermediaries with absolute immunity; its protection is subject to certain conditions and due-diligence requirements. The proposed framework therefore does not impose automatic liability on platforms. Rather, continued safe-harbour protection would depend on compliance with specific child-safety standards. Accordingly, a platform that knowingly uses age-inappropriate design or manipulative monetisation practices should not continue to enjoy safe-harbour protection if it has failed to take reasonable steps to protect children. Because children are often too young to navigate online risks on their own, a stricter application of the conditional safe harbour framework under Section 79 of the Information Technology Act, 2000[7] is necessary. This includes mandating age-appropriate design standards, a robust age-verification mechanism using identity-based processes to distinguish minors from adults, and periodic independent audits of algorithmic systems. Further, platforms must impose regulated time-use limits for users below a specified age and strictly regulate in-app purchases, loot boxes, and similar monetization tools that target children’s vulnerability. Where platforms fail to adopt such safeguards, legal liability must accordingly shift to them. Platforms already possess the technology and capability to apply these safeguards. However, where the State fails to effectively monitor or enforce these statutory obligations despite being aware of systemic non-compliance, it should incur liability for regulatory failure. Violation of safety standards by platforms must lead to stringent action, including blocking or cancellation of the concerned platforms. Such action, however, cannot be automatic or absolute. It must be proportionate to the violation, with blocking used only as a last resort, after warnings and a fair chance to fix the problem, rather than the State’s first response.
At the tertiary level, parental responsibility also assumes significance. In the modern era, parents hand over smartphones to children with limited supervision and to avert disturbance in their personal lives, a problem further intensified by uneven levels of technological literacy among parents. At the same time, it is important to recognize that several technological tools for parental supervision do exist, including child monitoring apps, tracking systems, and child-locks mechanisms, where parents consciously fail to acknowledge such readily available safeguards, which may give rise to reasonable negligence. This concern becomes more significant given the illegal content already prohibited by the Government of India, making parental supervision increasingly important. However, parental responsibility should not be regarded as absolute. Within the three-tier liability model, parental liability functions only as a supplementary layer of protection, it does not displace platform or governmental responsibility.
Existing Regulatory Framework
India’s digital governance framework is primarily rooted in the Information Technology Act, 2000, which establishes the fundamental legal structure for regulating online activities. It is further supplemented by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. While these frameworks impose due diligence obligations on intermediaries, they largely adopt a reactive approach by focusing on the removal of unlawful content rather than addressing platform design that manipulates children’s behaviour. The gap here is one of design: the law responds to harmful content after it appears, but does nothing to prevent the manipulative architecture, addictive recommendation algorithms, exploitative gaming mechanics, that produces the harm in the first place. One of the significant developments is the Digital Personal Data Protection (DPDP) Act, 2023, which is intended to provide the operational backbone for compliance and user protection in the digital ecosystem, and marks a welcome step towards legislating child-specific data protection provisions. It requires verifiable parental consent for processing children’s personal data (Section 9). However, as a law regulating the processing of personal data, it leaves a second gap untouched: it does not address manipulative interfaces, addictive recommendation algorithms, or behavioural monetisation that directly shape children’s online interactions.
At the international level, the United Kingdom’s Age-Appropriate Design Code (2021)[8] reflects an emerging child-centric approach to digital governance. It is one of the world’s strongest digital protection frameworks. The objective of the Code is that digital platforms must place the best interests of the child at the centre of their design and operation. It imposes fifteen enforceable standards on platforms likely to be accessed by children. The code draws on principles from both Data Protection Act 2018 and General Data Protection Regulation (GDPR)[9]. These frameworks impose proactive duties on platforms and carry strong penalties for non-compliance. India has no equivalent design-code obligation, marking the third and most significant gap, and leaving platform design outside the reach of Indian law.
Conclusion
The digital environment that children inhabit today was built to capture and monetize their attention. India’s legal architecture, however, has not kept pace with this reality. Looking at children’s engagement with platforms demonstrates that harm is created not only by content, but by the design of the platforms themselves. A balanced digital ecosystem can be maintained by sharing responsibility among the state, platforms, and parents, ensuring a move beyond reactive enforcement towards coordination that prioritizes accountability, safety, and the best interests of the child. While government must set clear standards, platforms bear the heightened duty of care towards children’s behaviour and decision-making. Ultimately, transforming digital spaces from being digital shadows into environments that foster children’s autonomy, dignity, and meaningful participation require a regulatory framework that protects not only children from digital harm but also their right to free and meaningful expression.
[1] Kumar Sandeep, ‘Game on, Parents off?’ (Cult Current, 2 September 2025) https://www.english.cultcurrent.in/ArticlesDetails.aspx?Article=237&WebUrl=Game-on%2C-Parents-off%3F accessed 9 July 2026.
[2] Committee on the Rights of the Child, General Comment No 25 (2021) on Children’s Rights in Relation to the Digital Environment https://www.right-to-education.org/resource/general-comment-no-25-2021-children-s-rights-relation-digital-environment accessed 30 May 2026.
[3] Online Safety Act 2023, c. 50 (U.K.), https://www.legislation.gov.uk/ukpga/2023/50/pdfs/ukpga_20230050_en.pdf
[4] Shreya Singhal v. Union of India, 2015 5 S.C.C. 1 (India).
[5] Stanford Law School, ‘Shreya Singhal v Union of India, No. 167/2012’ (World Intermediary Liability Map, Stanford University) https://wilmap.stanford.edu/entries/shreya-singhal-v-union-india-no-1672012 accessed 29 May 2026.
[6] Government of India, Ministry of Finance, Department of Economic Affairs, Economic Survey 2020–21, Volume II (2021) https://www.indiabudget.gov.in/budget2021-22/economicsurvey/doc/echapter_vol2.pdf accessed 29 May 2026.
[7] Information Technology Act 2000 (India Code) https://www.indiacode.nic.in/show-data?actid=AC_CEN_45_76_00001_200021_1517807324077&orderno=105 accessed 29 May 2026.
[8] Adele Harrison, ‘The UK’s Age-Appropriate Design Code Comes into Force in September 2021’ (Orrick, Herrington & Sutcliffe LLP, 27 July 2021) https://www.orrick.com/en/Insights/2021/07/The-UKs-Age-Appropriate-Design-Code-Comes-into-Force-in-September-2021 accessed 30 May 2026.
[9] 5Rights Foundation, ‘Setting New Standards for Children’s Data Privacy: The Children’s Code’ (5Rights Foundation) https://5rightsfoundation.com/resource/setting-new-standards-for-childrens-data-privacy-the-childrens-code/ accessed 30 May 2026.
