India already banned what Meta is on trial for in America! It just isn't enforced yet

The case against Meta that opened in Oakland this week rests, in its federal part, on a law written in 1998 that protects children under the age of 13.

India's equivalent protects everyone under 18, requires a parent's verified consent before a company may process their data at all, and prohibits tracking, behavioural monitoring and targeted advertising directed at them.

By the letter of the statute, India has already outlawed most of what twenty-nine American states are spending five weeks in court trying to establish.

The Gap Between The Two Laws

The Children's Online Privacy Protection Act sets its threshold at 13. Above that age, its protections stop. A 14-year-old in the United States is, for the purposes of that statute, an adult.

That is why the states' complaint has two halves. The COPPA claim covers under-13s who were allowed onto Facebook and Instagram without parental consent. Everything concerning teenagers — the design features, the addictive mechanics, the mental health allegations — has to be brought under state consumer protection law instead, as unfair or deceptive practice.

India's Digital Personal Data Protection Act does not have that gap. It defines a child as a person under 18. Processing their data requires verifiable parental consent, with the parent's identity and age validated against government-issued proof. And it bans, in terms, tracking, behavioural monitoring and targeted advertising aimed at children.

The threshold is stricter than the European Union's, which sits between 13 and 16 depending on the member state, and considerably stricter than the American one.

What That Would Mean If It Were Running

Consider the features the American states are asking a court to order removed: engagement-optimised recommendation, ephemeral content, infinite scroll, autoplay, beauty filters.

The mechanism underneath most of them is behavioural: the system observes what a user responds to and adjusts what it serves in order to extend attention. Applied to an Indian user under 18, that is behavioural monitoring of a child, which the DPDP Act prohibits without needing a court to find it addictive or harmful.

The states in Oakland must prove that Meta's design was unfair or deceptive, that the company knew, and that harm followed. Under the Indian statute the question is narrower and far easier to answer: was the user a child, and was their behaviour monitored or used for targeting.

That is the difference between a consumer protection theory and a bright-line rule.

Why It Has Not Bitten

The reason no Indian regulator is doing what four American attorneys general are doing is that the machinery has not been switched on.

The Act passed in 2023. The rules that give it operational effect have moved slowly, and the hardest provision to implement is precisely the one that matters here: verifiable parental consent. Requiring a company to confirm that a consenting adult is genuinely the parent of a specific child, at national scale, without building a surveillance apparatus in the process, is a genuinely difficult problem, and it has not been solved anywhere in the world.

In early 2026 the Ministry of Electronics and Information Technology held at least three private consultations with social media companies on whether age-based access controls are technically feasible. That is the state of play: a statute with real teeth, and a live conversation about whether the teeth can be fitted.

There is a second constraint. Enforcement under the DPDP framework runs through a Data Protection Board rather than through litigation brought by state governments. India has no equivalent of an attorney general who can take a company to trial on behalf of a state and seek an order redesigning its product. The remedy structure is administrative, and administrative penalties are capped in ways that a court's equitable powers are not.

The Pattern This Fits

This is a recognisable shape in Indian technology regulation, and it appeared again only recently.

The AI Governance Guidelines released by MeitY chose voluntary compliance, self-certification and regulatory sandboxes over binding mandates, and nine months later only one of the three institutions they proposed exists. The rules are drafted ambitiously and implemented cautiously.

There are defensible reasons for that caution. Rules that cannot be complied with produce either mass technical non-compliance or an enforcement regime that lands arbitrarily. A government that legislates first and works out feasibility afterwards can find itself unable to act at all.

But the cost is visible in exactly this comparison. The country with the weaker statute is the one currently extracting internal documents, putting Mark Zuckerberg on a witness stand, and asking a federal judge to order features deleted from an app worldwide. The country with the stronger statute is holding consultations.

What Indian Readers Should Take From The Trial

The Oakland proceedings will produce something India's framework has not yet generated: a public evidentiary record.

Discovery in the American case has already forced out internal research Meta sought to withhold, after a federal court ruled the company could not use attorney-client privilege to keep documents about teen harm out of the states' hands. Zuckerberg and Instagram head Adam Mosseri are expected to testify under oath.

Whatever the judgment, that record becomes available to every regulator on earth, including India's. It is the raw material a Data Protection Board would need, and it is being produced at American expense under an American statute that protects fewer children than the Indian one does.

If India's rules are eventually enforced, the evidence for the first case is being generated right now, in a courtroom in California.