Protecting Children from Online Harm in India: A Consumer Protection and Cyber Law View

Abstract

Digital platforms, edtech services, mobile applications, and child-facing online environments have reshaped how children in India consume, learn, play, and interact. Yet this shift has opened new vulnerabilities. Data harvesting, behavioural targeting, deceptive interface design, and platform-driven exploitation now define large parts of the digital experience for minors. Children, constrained by age and limited decisional autonomy, are especially prone to manipulative digital practices that erode informed consent and generate commercial and cyber harms. Against this backdrop, the paper asks whether India's legal framework adequately protects children as vulnerable online consumers, focusing on the convergence of consumer protection law, data protection law, and cyber law. It analyses the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, the Consumer Protection Act, 2019, the Consumer Protection (E-Commerce) Rules, 2020, and the CCPA's dark pattern framework of 2023. Practices such as profiling, targeted advertising, behavioural monitoring, subscription traps, deceptive consent mechanisms, and hidden monetisation are evaluated against these instruments. Documented incidents of edtech data exposure, platform insecurity, and cyber fraud affecting children are examined to reveal enforcement limitations. India's framework, the paper argues, is fragmented and reactive. It leans too heavily on parental consent, post facto complaints, and general consumer remedies instead of imposing strong ex ante duties on platforms. A child-centric regulatory model built around data minimisation, age-appropriate design, mandatory transparency, platform accountability, and targeted enforcement is proposed. Treating children not simply as data subjects but as vulnerable digital consumers, the paper enters the growing discourse on digital rights, consumer autonomy, and child protection within India's evolving regulatory architecture.