19 October 2026 Legal Update

National Hash and URL Database, Two-Hour Reporting and Exemplary Fines Framework to Curb Child Sexual Abuse Material Online; Right to Access Internet Held a Fundamental Right : Supreme Court

Case details

Case: Just Rights for Children Alliance and Another v. S. Harish and Others (M.A. Nos. 2553-2554 of 2026 in Criminal Appeal Nos. 2161-2162 of 2024) [2026 INSC 1149]
Court: Supreme Court of India (Criminal Appellate Jurisdiction)
Bench: Justice J.B. Pardiwala and Justice K.V. Chandran
Nature of order: an interim order in miscellaneous applications that continue the Court's supervision of its judgment of 23.09.2024 in Just Rights for Children Alliance v. S. Harish (2024 INSC 716). It sets out proposed frameworks and directs the Union of India to act and report back by affidavit.

Parties and proceedings (simplified)

Applicants: Just Rights for Children Alliance and another, who placed before the Court news reports on paid promotion of child sexual exploitation and abuse material (“CSEAM”) on social media platforms through redirect links and websites.
Union of India: represented by the Solicitor General, Mr. Tushar Mehta, and asked to act through the Ministry of Electronics and Information Technology (MeitY) and the Ministry of Law and Justice.
Intermediaries: social media platforms and other intermediaries, whose obligations are the subject of the order. They are not recorded as appearing.

Background

In Just Rights (23.09.2024) the Court noted an alarming increase in CSEAM circulating on social media and how indirect links to it were being shared and sold to avoid Section 15 of the POCSO Act and Section 67B of the Information Technology Act, 2000 (IT Act). It held that an intermediary cannot claim safe harbour under Section 79 of the IT Act unless it reports such material to the Special Juvenile Police Unit (SJPU) or local police under Sections 19 and 20 of the POCSO Act and Rule 11 of the POCSO Rules, and that reporting only to the US-based NCMEC does not suffice.
By an order of 14.08.2026 the Court had expressed concern about serious lapses by intermediaries in complying with those directions.
In this order the Court said that, more than two years on, there has been no progress worth the name. It referred to news reports of advertisements promoting tools and links to produce or reach CSEAM, noting that of 55 advertisements reported on one platform, 43 were held not to violate its advertising standards, 11 were said to be already removed, and one drew no reply. The Court said it had no choice but to take matters in its own hands, with the Union's help, and put a workable framework in place.

Legal provisions and precedents

POCSO Act, 2012: Section 15 (storage or possession of child pornography), Sections 19 to 21 (mandatory reporting and punishment for failure) and Sections 43 and 44 (awareness duties of the government and child rights commissions); POCSO Rules, 2020, Rule 11.
IT Act, 2000: Section 67B (online offences relating to child sexual abuse material and the exploitation of children) and Section 79 (safe harbour for intermediaries).
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules): Rule 3(1)(b) (due diligence and content “harmful to child”), Rule 3(1)(d) (removal within three hours of a court order or government intimation), Rule 3(2) (grievance redressal: 36 hours for sexually exploitative content, two hours when the depicted individual complains, seven days otherwise), Rule 3A (Grievance Appellate Committee), Rule 4(1) (significant social media intermediaries must appoint officers and publish monthly reports), Rule 4(4) (proactive detection tools) and Rule 4(6) (complaint tracking). The Court noted the 2026 amendments on synthetically generated information.
Constitution: Articles 14, 19(1)(a), 19(1)(g) and 21.
Cases: Just Rights for Children Alliance v. S. Harish (2024 INSC 716), Anuradha Bhasin v. Union of India ((2020) 3 SCC 637), Pragya Prasun v. Union of India (2025 INSC 599), Secretary, Ministry of Information and Broadcasting v. Cricket Association of Bengal ((1995) 2 SCC 161) and Shankar Kisanrao Khade v. State of Maharashtra ((2013) 5 SCC 546).

Issues addressed

How CSEAM can be detected and removed across the internet, including through hash matching and URL listing and a national database.
How CSEAM should be reported, by intermediaries and by the public, and how grievances should be handled.
What consequences should follow persistent failure by intermediaries beyond loss of safe harbour under Section 79.
Whether children should be kept off the internet or social media, and what awareness and education measures are needed.

Contentions

The order records that counsel for the applicants and the Solicitor General for the Union of India were heard, but it does not set out their submissions. The Court's reasoning rests on the news reports before it and on identifying gaps in the existing IT Rules, and it repeatedly seeks the Union's response.

Reasoning and proposed framework

1. Detection and removal (hash matching and URL listing)

Detection today depends on individual reports, and a removal by one platform does not trigger removal elsewhere. The Court described “perceptual hashing” (a hash that survives resizing and reformatting) and “URL listing” (blocking external locations hosting CSEAM), noted how the US, UK, South Korea and Australia require such measures, and found that India has no equivalent specific requirement.
Rule 4(4) of the IT Rules requires only “appropriate technical measures” for material previously removed “on the computer resource of such intermediary”. The Court found this wording ambiguous and too narrow, since it leaves out material already removed on other platforms and CSEAM hosted externally and shared only through links. It accepted that tools should not be fixed in statute but said periodically revisable guidelines can require widely used proven tools uniformly.

2. National Hash and URL List Database

A shared database is needed because each intermediary now keeps its own incomplete list. It would hold only hash identifiers and URLs, never the material itself, and could sit inside the I4C's Sahyog Portal (which now only routes reports and takedown notices) or be a standalone repository.
Entry safeguards: a three-stage process of sourcing, assessment and entry, where software screening is followed by at least three trained human analysts who independently confirm the material is CSEAM, with encrypted entries, signed findings, full records of each entry and each access, periodic independent audits, prompt delisting of wrongful entries with restoration of content, and a complaint route to the managing authority.
Known and unknown origin: CSEAM of “Known Origin” (matching a database entry) must be removed immediately without further verification and reported only in a consolidated weekly report, which also helps catch wrong entries. CSEAM of “Unknown Origin” needs verification and due diligence, must be reported promptly to the authorities and the database body, and then assessed for entry.
Notice and challenge: wherever material is removed as CSEAM, a notice must appear in its place saying whether removal followed the intermediary's own detection or a database match, without describing the material and without prejudice to preserving evidence. Challenges to the intermediary's own detection go through its grievance mechanism and the Grievance Appellate Committee, while challenges to a database match go to the authority maintaining the database.

3 Reporting and grievance redressal

Lacunas. The Court found no timeline for intermediaries to report CSEAM to the authorities under Rule 11 of the POCSO Rules. The IT Rules timelines for removal are not specific to CSEAM, and Rule 3(2)(b) applies only when the depicted individual (or someone for them) complains, although a child victim seldom knows of the circulation. It also found uneven publication of grievance officer details, confusing reporting categories that vary between platforms, and demands for personal details from reporters.
Reporting channel and timelines. Intermediaries must report to the SJPU, local police and/or cyber-crime portal under Rule 11. For CSEAM of unknown origin, the report is due within two hours of resolving a complaint, within two hours of removal on the intermediary's own detection, and within two hours of removal on a court order or government intimation. A standard machine-readable report form should be prescribed, covering the hash or URL, time, descriptive details, type of material, mode of circulation, whether a real or synthetic depiction, origin, detection mechanism and the reasons and e-signatures of the analysts.
Reporting mechanism. Each platform must have a distinct, simply named CSEAM category reachable within two steps and uniform across platforms. It should not demand unnecessary personal details, should protect the reporter's anonymity and should give an acknowledgement with a tracking number.
What counts as CSEAM. The Court said platforms had misread Just Rights. Its emphasis on visual depiction applied only to the strictly construed penal provisions of the POCSO Act. The IT Act and Rules are largely regulatory, so for them CSEAM covers any electronic material that facilitates, promotes or enables the exploitation or abuse of children, even with no explicit depiction. Advertisements for tools that can turn children's photos into abusive material, or that link to sites offering CSEAM, fall within Section 67B(d) and Rule 3(1)(b), and cannot stay up under “advertising standards”.
Dedicated, trained officers. Because general grievance officers carry urgent complaints of many kinds, every intermediary must have a dedicated grievance officer or team for CSEAM, adequately trained and resourced, with no CSEAM complaint closed without review by a trained officer (automated tools may only assist). The officer must record findings and sign digitally, acknowledge within 24 hours, give reasons to the complainant, and the intermediary must publish monthly compliance reports with a separate CSEAM section, audited independently. The Court asked the Union to extend Rule 4(6) and Rule 4(1)(d) to all intermediaries for CSEAM complaints and to say how it monitors Grievance Appellate Committee orders.

4. Penalties beyond Section 79

Under the IT Act the only consequence for non-compliance is losing safe harbour under Section 79, which attaches only after an offence occurs. The Court called Section 79 too drastic to use for every default and too remote to deter it, and asked whether the IT Rules should remain a “toothless tiger”.
It reviewed fines in the US, UK, EU, Australia and South Korea (scaled to size, turnover, gravity and recurrence) and asked the Union to frame an exemplary monetary fine regime, limited to duties relating to CSEAM (detection, removal, grievance redressal and complaint resolution). Section 79 remains a last resort.
Paywalled content. Paywalled and subscription content faces lighter scrutiny, so intermediaries were put on strict notice to scrutinise it. Revenue derived from CSEAM or other prohibited material offered through a paywall should be forfeited and disgorged in addition to fines, and no sexually explicit or prurient content may be promoted to children or accessible to them.

5. Article 21 and the right to access the internet

The Court consciously declined to endorse blanket age-based bans on children's use of the internet or social media, saying safety measures must target the harmful material and those responsible and not the child. Such bans require age verification and monitoring of every user, have unproven efficacy, push children to unregulated platforms and make them less likely to report abuse.
Relying on Anuradha Bhasin and Pragya Prasun, it held that the right to access and use the internet is a fundamental right of every individual under Article 21 read with Article 19(1)(a), which children also enjoy.
It still accepted some safeguards. It suggested parental consent and oversight and a dedicated “child mode” (private by default, restrictions on contact from unknown adults, moderated advertising, with verifiable parental consent for pre-teens), leaving modalities to the Union, and said the Union may restrict children's access to inherently harmful content such as adult websites. Hash and URL databases may be used only for CSEAM.

6 Digital safety and sex education

Noting that the 2024 suggestions to the Ministry of Women and Child Development and to the government under Sections 43 and 44 of the POCSO Act remain unimplemented, the Court asked what steps had been taken in two years (and since Shankar Kisanrao Khade thirteen years ago). It treated digital safety and positive age-appropriate sex education as two sides of one subject.
It listed measures for the Union, State Governments, child rights commissions, schools and intermediaries. These include teaching about body safety, consent, healthy relationships and safe internet use from primary level; making this part of the core curriculum developed by NCERT and SCERTs; displaying Child Helpline 1098 and Cyber Crime Helpline 1930 details in schools; filters on school and hostel networks; training for teachers and awareness programmes for parents; sustained public campaigns; free counselling for victims; and, for intermediaries, safety reminders to children, prompts when a child contacts an unknown adult, and warnings on searches linked to CSEAM.

Held and directions

The Court, with the Union's assistance, laid down the framework above and directed the Union of India, through MeitY and the Ministry of Law and Justice, to act on it, to frame guidelines, standard operating procedures and suitable amendments to the IT Act and IT Rules, and to file an affidavit on progress by the next date of hearing. The case is listed on 10.12.2026. In summary:

Affidavits: the Union must state what tools intermediaries use for detecting and removing CSEAM and whether industry-wide deployment is feasible, and must report on intermediaries' compliance with publishing grievance officer details and on action against defaulters.
Guidelines and SOP: the Union must frame guidelines or an SOP for use of perceptual hash matching and URL listing by significant social media intermediaries and for other tools, with IT Rules amendments where needed, to be revised periodically by MeitY.
Database: the Union shall create a National Hash and URL List Database (within the Sahyog Portal or standalone) with three-analyst verification, encrypted entries and the safeguards above. Intermediaries must use it to cross-check content, and known-origin matches must be removed immediately.
Notices and challenges: removal notices with the stated basis, and a grievance route within the database authority for database-based removals.
Reporting: reports to the SJPU, local police and/or cyber-crime portal; two-hour deadlines for unknown-origin CSEAM; weekly consolidated reports for known-origin matches.
Grievance mechanism: a distinct, simple CSEAM reporting category within two steps, trained and signed assessments by grievance officers, 24-hour acknowledgement with reference numbers and reasons, and monthly audited compliance reports.
Penalties and paywalls: the Union must consider exemplary fines scaled to gravity, duration, recurrence, size and turnover, forfeiture of revenue from paywalled CSEAM, and guidelines for scrutiny of paywalled and subscription content and for moderating what children can access.

Key legal principles established

For the IT Act and the IT Rules, “CSEAM” is wider than the visual depiction needed under the POCSO Act. It includes any electronic material, including advertisements and tools, that facilitates, promotes or enables the exploitation or abuse of children.
Intermediaries' obligations to detect and remove CSEAM go beyond reactive takedown and include proactive, cross-platform detection through perceptual hash matching and URL listing, supported by a national database that holds only identifiers and never the material.
A database entry must be verified by multiple tiers including at least three human analysts, entries must be auditable and reversible, and users must be able to challenge removals before the right authority.
Intermediaries must report CSEAM to the SJPU, local police or cyber-crime portal within two hours of removal for unknown-origin material, in a standard format, in addition to any reporting to NCMEC.
Loss of safe harbour under Section 79 is not a sufficient deterrent, and the Court asked for exemplary monetary penalties for CSEAM-related regulatory defaults and disgorgement of revenue from paywalled CSEAM.
The right to access and use the internet is a fundamental right under Article 21 read with Article 19(1)(a), and applies to children. Blanket bans on children's access are disproportionate, and proportionate measures such as parental consent and child mode are acceptable.
Digital safety and age-appropriate sex education should form part of the core school curriculum and are essential to the protection of children online.