Welcome to The Esya Dispatch, a weekly snapshot of the policy debates shaping India’s digital economy. Each edition brings together key developments in technology policy, from platform governance and AI regulation to data protection and competition — along with the Esya Centre’s perspective on what they mean for innovation, businesses, and users.
Here’s a quick recap of two key tech policy developments from the past week:
1. CENTRAL GOVT TO PREPARE SOP FOR CHILD SEXUAL ABUSE MATERIAL
Officials from the Ministry of Electronics and IT (MeitY) said that they will be meeting representatives from the Ministry for Women and Child Development, the Department of Telecom, the Indian Cybercrime Coordination Centre and the Ministry of Home Affairs to consult on an SoP to report child sexual abuse material. MeitY may follow the same approach it uses for non-consensual intimate imagery (NCII).
Esya’s take: MeitY’s proposed SOP for reporting CSAM is a welcome step towards strengthening online child safety. However, MeitY’s 2025 SOP on NCII has faced concerns regarding coordination between authorities, institutional capacity and victim support. To avoid similar challenges, MeitY should encourage a centralized reporting mechanism for CSAM that builds on existing institutional infrastructure. Meta’s recent commitment to report child safety cases directly to the National Cybercrime Reporting Portal managed by I4C is a useful starting point. However, centralization alone may not be sufficient. Researchers at Stanford University have found that the US’ CyberTipline, which is a centralized system for reporting online child exploitation that is managed by the National Center for Missing & Exploited Children, is fraught with incomplete reports, difficulties in prioritising cases and limited law enforcement capacity, which can undermine the effectiveness of established reporting mechanisms. Thus, MeitY’s CSAM SOP should draw on these lessons by standardizing reporting requirements, clear referral protocols and mechanisms to prioritise actionable cases.
2. GOOGLE APPEALS EC ORDERS UNDER DMA TO THE GENERAL COURT
Recently, Google challenged two specification decisions issued by the European Commission under the Digital Markets Act (“DMA”) before the EU’s General Court. Under the first of these decisions, Google was directed to ensure that third-party developers of AI services have access to the same Android OS features as its own AI services in accordance with Article 6(7) of the DMA by August 1, 2027 at the latest. Meanwhile, under the second decision, the EC directed Google to share anonymized search data with eligible third- party online search engines under fair, reasonable and non-discriminatory terms under Article 6(11) of the DMA.
Esya’s take: The EC’s decision directing Google to grant third-party AI assistants effective interoperability with Android features presumes that mobile operating systems are a key gateway for users to access AI assistant services. But this presumption is not supported by evidence. Research shows that EU users predominantly rely on desktop browsers, rather than mobile OSes to use AI assistant services. Thus, presently, Android is not the primary distribution channel for such services. It is also unclear whether this will change in the future – the market for AI assistants and agents is still evolving, and it is possible that users will rely on multiple avenues to access them. Not only is the EC’s decision unsupported by evidence, it may also create considerable privacy and security risks for users. For example, Google will have to provide any third-party AI services with access to app data stored on-device and background access to their camera and microphone, among other things. This increases the attack surface of the mobile system, and it is unclear who is liable in case any cyberattack or security vulnerabilities occur.
The EC’s decision directing Google to provide rival search engines with access to anonymized search data raises additional concerns. For example, the EC specifies that the data shared must be aggregated and anonymized to protect user privacy. But these measures reduce rivals’ ability to understand the context behind individual searches, diminishing the utility of the shared data and potentially undermining the effectiveness of the obligation itself. Additionally, data is subject to diminishing returns, meaning that the value of large datasets diminishes over time as market conditions and consumer preferences evolve. These concerns are relevant given that the EC limits access to Google’s search data to a maximum of five years per beneficiary. Thus, it is unclear whether access to such data will even improve rivals’ ability to compete during this period, or enable them to sustain their competitiveness once access expires.