NCPCR to draft social media child-safety rules, finalise in 2027

India's child rights regulator will release draft social media guidelines for public consultation in 2026 and finalise them in early 2027, according to an anonymous official quoted in Aditi Agarwal's The Tech Trace newsletter.

On November 12, the National Commission for Protection of Child Rights (NCPCR), under the Ministry of Women and Child Development, meets technology companies on the proposed rules. Invitations went to Meta, Google/YouTube, X (formerly Twitter), Snapchat, Reddit, Roblox and Discord.

NCPCR has already met companies and civil society organisations, individually and in groups, and has drafted the text for four months. In August 2026, MediaNama, citing a Hindustan Times report, said the commission was building a "social media code of conduct to strengthen safeguards for children online".

Takeaway: the timetable is fixed, the legal weight is not — the same official called the inputs being sought "exploratory in nature".

What does the Child Safety Implementation Matrix require?

The commission has reportedly sent platforms a "Child Safety Implementation Matrix". Its provisions:

• Safety by design: child safety "embedded in the design, development and operation" of platforms, on by default rather than left for a parent to find; every new feature and algorithmic change reviewed against the principle.
• Age assurance: "robust, accurate, proportionate, and privacy-preserving" checks instead of self-declaration; younger children and older teenagers handled as separate groups, not one "under-18" category.
• Safe defaults: accounts private from creation; no contact from unknown or adult accounts by message, request, comment or tag; real-time location sharing off by default.
• Data and advertising: only necessary data collected; minors' behavioural profiles "should not be created or used for advertising purposes" and not shared with advertisers, data brokers or analytics partners.
• Spending limits: caps, parental PINs or authorisation on gaming and in-app purchases, plus transparent refunds for unauthorised spending.
• CSAM and grooming: automated detection "across videos, images, and text", with text detection working in Indian languages, including Romanised and code-mixed text.
• Behavioural detection: flags where "an adult account poses as a minor or a single account contacts a large number of children"; preventive action must "follow immediately", and exploitation or grooming accounts permanently removed, not suspended.
• Harmful content: age-inappropriate content classified, recommendation systems configured differently for minors, and new minor accounts tested over a defined period with findings recorded.
• Anti-addictive design: infinite scroll, autoplay, streaks and engagement loops disabled or redesigned; night-time quiet mode on by default; likes and follower counts hidden.
• Reporting and redressal: single-step reporting, published timelines for CSAM, non-consensual and morphed intimate imagery, grooming and cyberbullying, and links to NCPCR and the National Cyber Crime Reporting Portal.
• Parents and governance: simple-to-activate parental tools, safety information in Indian languages, regular Child Rights and Safety Impact Assessments, periodic independent child-safety audits.

Takeaway: the matrix asks platforms to rebuild defaults — private accounts, quiet hours, no ad profiling — not to patch settings after a complaint.

Will the rules bind platforms?

The matrix lists ten "Requirement Areas", each with "Recommended Child Safety Guardrails". For every guardrail, a platform must state whether it is "Already Implemented" or a "Future Plan", with comments. The official said the inputs sought are "exploratory in nature", which suggests the measures may not be binding even as the commission moves to finalise them.

Takeaway: the matrix functions as a disclosure form, not yet as an enforcement instrument.

What is MeitY doing on platform liability?

Storyboard18 reported that the Ministry of Electronics and Information Technology continues talks with social media intermediaries to make them more accountable for published content. "Platforms must start taking some responsibility… The platform has to be part of the solution," an anonymous government official told Storyboard18.

The obstacle sits in the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which define a publisher as "a publisher of news and current affairs content or a publisher of online curated content" — language that fits OTT streaming services, whose catalogue runs to "audio-visual content, other than news and current affairs content". Social media intermediaries transmit user-generated content without editorial control, so treating them as publishers in the newspaper sense would stretch the Rules.

Takeaway: MeitY is negotiating accountability while the Rules still treat social platforms as transmitters, not editors.

Where does the Supreme Court stand?

An October judgment upheld internet access as a fundamental right and rejected a blanket ban on children's social media use, ruling that "access and use [of] the internet is a fundamental right of every individual under Article 21 read with Article 19(1)(a)". It also set out a detection, removal and reporting framework for child sexual exploitation and abuse material (CSEAM/CSAM), while cautioning that "Age-based restrictions are themselves an overreach" because they require identifying every user's age and collecting sensitive data continuously, with "an overall disproportionate risk of misuse and surveillance".

Meta and Google have said they will report CSAM incidents directly to the Ministry of Home Affairs' Indian Cyber Crime Coordination Centre (I4C), rather than the US-based non-profit National Center for Missing & Exploited Children (NCMEC), which coordinates hash-sharing that lets platforms detect, report and remove material.

Which petitions are driving the same debate?

• Kirti Dua v. Union of India (Delhi High Court, August 2026): sought restrictions for under-13s and overnight curfews for 13-16-year-olds. The court ordered no ban, treated the plea as a representation and asked the Centre for a reasoned order.
• Just Rights for Children Alliance v. Union of India (Supreme Court, September 2026): sought IT Rules amendments requiring e-KYC parental consent for minors' accounts; the court asked the Centre to examine the rules governing those accounts.
• Dr Vikas Kathuria v. Union of India (Delhi High Court, September 2026): challenged infinite scroll, autoplay and algorithmic feeds. The government called software-design regulation an executive policy matter; the hearing was adjourned.
• Emerald Heights International School and Siddharth Singh Girnar's PIL (Supreme Court, October 2026): sought a national framework protecting children; the court issued notices to three Union ministries and NCPCR.
• Just Rights for Children Alliance v. S. Harish (Supreme Court, October 2026): proposed a national hash and URL database, dedicated grievance redressal, mandatory reporting and penalties for non-compliant intermediaries, while flagging surveillance risks from age verification.
• Sreerupa Chowdhury v. Union of India (Supreme Court, November 2026): challenges algorithmic addiction and dark patterns on Facebook, Instagram and WhatsApp, alleging Meta applies weaker safety-by-design safeguards in India than in the West; the court issued notices to the Centre and Meta.

NCPCR has set a date, the courts have set the standard, and every invited platform must now mark each guardrail as shipped or planned.