SC Orders National Hash & URL Database For Child Sexual Abuse Material, Two-Hour Reporting Deadline For Social Media Platforms

The Bench of Justices JB Pardiwala and K Vinod Chandran passed the 136-page order on miscellaneous applications filed by the Just Rights for Children Alliance in the matter in which the Court had, on September 23, 2024, delivered its judgment in Just Rights for Children Alliance & Anr. v. S. Harish & Ors. That judgment held, among other things, that intermediaries lose "safe harbour" under Section 79 of the Information Technology Act, 2000 unless they also report CSEAM to the Special Juvenile Police Unit or local police under the POCSO Act. Solicitor General Tushar Mehta appeared for the Union.

The applicants had placed before the Court news reports flagging paid promotions of CSEAM on social media through redirect links and websites. The order records that the Court had, on August 14, 2026, already expressed concern over "certain serious lapses" by intermediaries in complying with the 2024 directions.

The Bench did not mince words about the state of compliance. It said, "Despite more than two years having gone by since our judgment, it appears that there has been no progress worth the name. If anything, the recent news reports instead reveal an even more unsettling reality when it comes to the safety and wellbeing of our children."

It added, "There comes a time when we must ask ourselves, how many more victims of such harmful content must continue to suffer, before our conscience is stirred into making collective effort in the right direction."

"Due to the lack of any earnest initiative shown on the part of either the regulatory authorities or the social media intermediaries for all these years, we are left with no choice but to take matters in our own hands," the Court said.

Blanket bans target the victim, not the wrongdoer

The Bench said it had given the idea "anxious consideration" and "decided consciously not to endorse the same". "…any measure for the safety of children must be directed at the harmful material and those responsible for the same, and not at the children themselves."

It said, "…insofar as CSEAM is concerned, the wrongdoer is the person who creates, circulates, sells or seeks out such material, and the intermediary which fails to detect and remove the same. To keep the child away from the internet on account of such failures would be to mistake the victim for the problem."

The Court found that age-verification itself is an overreach, since it requires "identifying and ascertaining the age of each and every user, continuous collection and monitoring of sensitive data and an overall disproportionate risk of misuse and surveillance, the kind which finds no place within the right to privacy of our people."

Tracing to precedents, the Bench held: "…the right to access and use the internet is a fundamental right of every individual under Article 21 read with Article 19(1)(a) of the Constitution. Our children, irrespective of their age enjoy the same rights, and to deny the same altogether would be as absurd as saying children below a certain age do not have a conscience worth protecting or a freedom of speech worth expressing. The safety of our children and their freedom are not at odds with each other. Our children are entitled to both."

The Court observed that children "do not cease to use the internet merely because the law prohibits them from doing so", and instead move to platforms that are "unregulated and even more unsafe". Such restrictions, it said, also make children who are being enticed or threatened online reluctant to tell their parents for fear of reprisal, which would "defeat the avowed object of the POCSO Act". It concluded: "All that we are trying to say is that any blanket restriction on the access of internet by children is nothing more than unproven measures of proven disproportionality. No jurisdiction has, so far, been able to demonstrate that children are any safer on account of such measures."

The Bench clarified that this "does not mean that there should be no age-based restrictions". It suggested a system placing "greater emphasis on parental consent, guidance and oversight" along with a dedicated "child mode", which may include accounts that are private by default, restrictions on contact and messages from unknown adults, and moderation of advertising and content, for pre-teens, with "a reasonable and proportionate means to verify parental consent". The modalities were left to the Union. The Court also made clear that the Union is not precluded from restricting children's access to "specific categories of content or services that are inherently harmful to them, such as adult content websites etc."

On the detection of CSEAM, the Court found that the existing system relies on individual reports and that a removal on one platform does not automatically lead to removal of the same content elsewhere. It explained the global practice of hash matching, in which each image or video carries a unique digital identifier, and the newer technique of "perceptual hashing", which survives resizing and reformatting. It also referred to URL listing, which targets indirect links to material hosted elsewhere, the very practice disclosed in the news report placed before it.

Examining Rules 3 and 4 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended in 2026, the Court said that the phrase "on the computer resource of such intermediary" in Rule 4(4) "narrowly confines the extent to which the technical measures must be deployed". Under that rule, it noted, a platform is under no obligation to remove material already detected and removed by another platform until it happens to find the material itself.

The Bench directed the Union to create a National Hash & URL List Database "for the sole purpose of the detection and removal of CSEAM", either as part of the I4C's Sahyog Portal or as a standalone repository. No entry is to be made without multiple tiers of verification, with the final determination to be made by "at least three trained human analysts". Entries are to be made through encrypted channels and confined to hash identifiers and URLs; the material itself is never to be stored. Intermediaries are to cross-check their platforms against every entry, and law enforcement agencies are to use the same process across the internet. The Union has also been asked to file an affidavit on the tools intermediaries currently use, and to frame periodically revisable guidelines for the use of perceptual hash-matching and URL listing by all significant social media intermediaries.

The Court distinguished between CSEAM of "Unknown Origin", detected through a platform's own tools or complaints, and CSEAM of "Known Origin", matched against an existing database entry. In the latter case, the intermediary must "immediately disable and remove the same, without awaiting any further verification at its end", and furnish a consolidated weekly report of all such removals to the authority maintaining the database. In the former, the intermediary must verify the material, report it to the authorities under Rule 11 of the POCSO Rules and send it to the database authority for independent verification and inclusion.

Conscious that an erroneous entry would lead to removal of lawful content "from every platform connected to the database", the Court required the Union to frame a Standard Operating Procedure incorporating digitally signed assessment reports by analysts, logs of every entry and every access, periodic independent audits with findings published at least in aggregate form, prompt de-listing and restoration of wrongly removed content, and a grievance mechanism within the database authority itself. Every removal is to be replaced by a notice stating whether it followed the platform's own detection or a database match, so that the person aggrieved knows where to go. The Bench stressed that the database and similar measures "shall be confined to the detection and removal of CSEAM alone".

The applicants' news report recorded that of 84 advertisements run in India, 55 were reported through the platform's own system, and for 43 of them the response was that the ad "doesn't go against our Advertising Standards". Some of these advertisements did not themselves depict children but promoted tools capable of manipulating photographs and videos into sexually exploitative material.

The Court said that, if true, this was prima facie "an egregious error on the part of intermediaries in their understanding of what constitutes CSEAM". It explained that the emphasis on visual depiction in Just Rights was made in the context of the penal provisions of the POCSO Act, which must be strictly construed, whereas the IT Act and the IT Rules are largely regulatory and "much broader in their sweep". It held, "For the purposes of the IT Act and the Rules thereunder, CSEAM encompasses every form of electronic material that is harmful to children, including any material having the propensity or likelihood to facilitate, propagate or enable their exploitation and abuse."

It said, "An advertisement or promotion cannot escape the rigours of the IT Act and the IT Rules merely because it does not itself contain any depiction of a child."

An advertisement promoting a tool capable of turning children's images into such material, the Court held, "facilitates the very creation of CSEAM" and falls within Section 67B(d) of the IT Act and Rule 3(1)(b) of the IT Rules. Advertisements redirecting users to sites where CSEAM is offered are "still, in substance an advertisement of CSEAM itself". Such content "cannot be permitted to remain on any platform under the guise of conformity with 'advertising standards'", and community guidelines and advertising standards must be brought in line accordingly.

The Court found that none of the existing timelines in the IT Rules is tailored to CSEAM. A complaint by a member of the public, as opposed to the person depicted, falls outside Rule 3(2)(b) and is left to the general grievance mechanism. It also found that neither the IT Rules, the POCSO Act nor the POCSO Rules prescribe any timeline within which an intermediary must report an offence, which it called "a glaring omission".

Accordingly, where an intermediary removes CSEAM of unknown origin on the basis of a complaint, it must report the removal "forthwith upon the resolution of such complaint, and in any case no later than two hours after such resolution". Where the removal follows the platform's own due diligence, or an order of a court or a reasoned intimation from the appropriate government, it must be reported within two hours of removal. Reports are to go to the Special Juvenile Police Unit, the local police or the cyber-crime portal under Rule 11 of the POCSO Rules, in a standard, machine-readable format covering, among other particulars, the hash or URL, the time of detection, the type of material, whether it depicts a real or synthetically generated individual, and how it was detected.

On the reporting side, the Court criticised the "multiple convoluted channels" used by platforms and the practice of closing complaints because they were filed under the wrong heading. "In matters involving CSEAM, where every hour of delay aids circulation, such an approach is wholly unacceptable," the Bench said. Every intermediary must now provide a distinct and clearly labelled category for reporting CSEAM, in language any person can understand "irrespective of age, literacy or familiarity with technology", accessible within two steps from the content in question and uniform across platforms. Reporters' anonymity must be maintained at all stages.

Every intermediary must also have a dedicated grievance officer or team for CSEAM complaints, trained to identify material that "may not be explicit on its face" but is harmful to children. No CSEAM complaint may be disposed of without review by a trained grievance officer, whose findings must bear a digital signature. Complaints must be acknowledged within 24 hours with a tracking reference number, and the reasons for any decision must be communicated to the complainant. The Court urged the Union to extend the tracking and reasons requirement in Rule 4(6), now limited to significant social media intermediaries, to every intermediary for CSEAM complaints, and to require monthly compliance reports with a separate CSEAM section, subject to independent audit.

The Bench also posed pointed questions to the Union on the monthly compliance reports under Rule 4(1)(d): "What has been the extent of compliance by such intermediaries in the past five years.? Why is it that, even to this date, intermediaries continue flouting the IT Rules?" It further sought to know how compliance with orders of the Grievance Appellate Committee is monitored.

The Court observed that the only consequence the IT Act attaches to an intermediary's non-compliance is the loss of safe harbour under Section 79, which operates only after an offence has been committed through particular content. That, it said, cannot work for CSEAM, "The harm that is occasioned by such material is not confined to the moment of its creation. Every instance of its circulation, every view, and every download, revictimizes the child depicted therein."

"Section 79 of the IT Act, in such situations, proves to be an unusually inept provision. It is too drastic to be invoked for every instance of non-compliance, and too remote to deter the same. The result is that routine defaults go unchecked, while the consequence prescribed by law is seldom invoked," the Bench said. 

Asking whether the IT Act should "remain a toothless tiger in such situations", the Bench answered: "The answer to the same must be an emphatic 'no'." After surveying penalty regimes in the United States, the United Kingdom, the European Union, Australia and South Korea, it asked the Union to consider a framework of exemplary monetary fines for breach of CSEAM-related duties, with the quantum determined by "the gravity, duration and recurrence of the default as well as the size and turnover of the intermediary".

The Court reserved its sharpest language for paywalled and subscription content, which it said enjoys "a far lower threshold of scrutiny" and is a "potent means" of circulating CSEAM or links to it. Noting that intermediaries often share in the revenue, it said stricter penalties were needed to end "this clandestine approach of some intermediaries of 'profiteering until prohibited'". It held that where CSEAM or prohibited material is circulated through any paywall or subscription from which an intermediary earns revenue, "the revenue so derived from such content should be forfeited and disgorged", in addition to any fine. All intermediaries were put "to strict notice" that paywalled content must be rigorously scrutinised and that no child should be able to subscribe to or access obscene, indecent or sexually explicit content.

Digital Safety and Sex Education 

Recalling its 2024 observations on sex education and the suggestions it had then made to the Ministry of Women and Child Development, the Court sought to know from the Union what steps it had taken "in all these years" to implement them. It said that awareness of digital safety and sex education "are not two separate subjects, but two sides of the same coin".

The Bench said that the Union and State Governments, the child rights commissions, educational institutions and intermediaries must undertake a series of measures. Children from the primary stage are to be taught, in an age-appropriate manner, about their bodies, safe and unsafe touch and consent, as well as safe use of the internet and the signs of enticement and sexual extortion. Digital safety and age-appropriate sex education are to form part of the core curriculum developed by NCERT and the SCERTs. The Child Helpline 1098, the Cyber Crime Helpline 1930 and the National Cyber Crime Reporting Portal are to be displayed in every classroom, hostel, library and computer laboratory. School devices and networks are to have filters, and teachers are to be trained on grooming, disclosure and the duty to report under Sections 19 and 21 of the POCSO Act. Schools are to hold regular awareness programmes for parents. Intermediaries are to display cautionary prompts when a child tries to connect with an unknown adult and warnings when a user searches for terms associated with CSEAM. Governments are to provide free counselling and psychological support to victims "for as long as may be necessary".

Centre directed to frame guidelines 

In its operative directions, the Court directed the Union, through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, "to take appropriate action for overseeing and implementing the suggestions, measures and safeguards discussed in the earlier parts of this judgment". For this purpose, the Union "shall formulate appropriate guidelines, Standard Operating Procedures and suitable amendments to the IT Act and the IT Rules, where necessary".

The Union has been directed to file an affidavit by the next date of hearing indicating "the progress made in this regard and the steps taken towards compliance of the aforesaid directions, along with any other suggestions that it may deem fit to offer". The matter will next be heard on December 10, 2026.

Case Title: Just Rights for Children Alliance & Anr. v. S. Harish & Ors.