Bench directs Centre to create hash and URL database for swift cross-platform takedowns, tighten intermediary duties, and reject blanket internet bans on children
In a significant order aimed at protecting children online, the Supreme Court on October 15, 2026 directed the Union Government to create a comprehensive national framework for detecting, removing and reporting child sexual exploitative and abuse material (CSEAM) across internet platforms.
A Bench of Justice J.B. Pardiwala and Justice K. Vinod Chandran, hearing applications in Just Rights for Children Alliance v. S. Harish, said social media intermediaries had shown persistent failure in complying with earlier directions issued by the Court in 2024 on tackling online child sexual abuse material.
Expressing deep concern over the continued circulation of such material, including through redirect links, paid promotions and external websites, the Court said isolated platform-wise action was inadequate because harmful content removed from one platform often continued to circulate on others. To address this, the Court directed the Union of India to create a National Hash & URL List Database, either within the existing Sahyog Portal or as a standalone repository.
The database will contain only perceptual hash identifiers and URLs of content confirmed as CSEAM, and not the abusive material itself. The Court said each entry must be subjected to a multi-tier verification process, including preliminary software screening and final independent assessment by at least three trained human analysts. Once verified, intermediaries across platforms must use the database to automatically detect and remove matching material.
The Court also ordered the Centre to frame guidelines or standard operating procedures for industry-wide deployment of perceptual hash-matching and URL listing, along with other technological tools, to proactively identify and take down CSEAM. It said significant social media intermediaries must not be left to vague standards of “reasonable efforts” and should instead follow uniform, periodically updated guidance.
Drawing a distinction between CSEAM of “unknown origin” and “known origin”, the Court said that where a platform independently detects abusive material not already in the national database, it must verify the content, generate internal hash or URL identifiers, remove it, and promptly report it to the Special Juvenile Police Unit (SJPU), local police, cyber-crime portal, and the database authority. If the removal is based on a database match, the intermediary must immediately disable access without waiting for further verification, but submit weekly consolidated reports to the database authority to guard against errors.
The Bench further mandated that every removal of content as CSEAM must be accompanied by a clear notice stating whether it was taken down through the intermediary’s own detection or due to a match with the national database. It also laid down separate grievance mechanisms: challenges to intermediary-detected removals will lie before the platform’s grievance system and then the Grievance Appellate Committee, while challenges to database-based removals will lie before the authority maintaining the database.
To make reporting easier, the Court directed that all intermediaries create a distinct, simple and clearly labelled reporting category for CSEAM, accessible within two steps from the offending content, profile, group or link. It said reporting systems must protect anonymity, avoid unnecessary personal details, issue acknowledgments within 24 hours, provide tracking reference numbers, and communicate reasons for action taken.
The judgment also clarified that CSEAM under the Information Technology Act and the IT Rules is not limited to explicit visual depictions of child sexual abuse. It includes advertisements, tools, applications, links, promotions or redirections that facilitate, enable or promote the creation, circulation or consumption of abusive material involving children. The Court said platforms must assess content as a whole, including captions, keywords, links and the function of promoted tools, and update their community guidelines and advertising standards accordingly.
On mandatory reporting, the Court held that where content is removed for violating Section 15 of the POCSO Act or Section 67B of the IT Act, intermediaries must report it to the SJPU, local police and/or the cyber-crime portal in terms of Rule 11 of the POCSO Rules. In cases of independently detected CSEAM, such reporting must be made forthwith and no later than two hours after removal or resolution of complaint. The Union Government was also asked to prescribe a machine-readable standard reporting format.
In a notable constitutional finding, the Supreme Court held that the right to access and use the internet is a fundamental right under Article 21 read with Article 19(1)(a) of the Constitution. The Bench rejected blanket age-based internet or social media bans on children as disproportionate and unsupported by evidence. It said children should not be excluded from the internet because of failures by wrongdoers and intermediaries.
At the same time, the Court said proportionate child-safety safeguards could be adopted, including parental consent systems, child-mode accounts, privacy-by-default settings, restrictions on unknown adult contact, and moderation of content and advertising accessible to children.
The Court also emphasized that online child safety cannot depend on regulation alone. It directed the Union and State Governments, child rights bodies, schools, and intermediaries to promote digital safety education, age-appropriate sex education, awareness campaigns, teacher and parent sensitisation, helpline displays, institutional safety filters, and counselling support for victims.
Noting that loss of safe harbour under Section 79 of the IT Act may not be enough to deter repeated non-compliance, the Court asked the Union Government to consider a framework of exemplary monetary fines based on the gravity, duration, recurrence, size and turnover of intermediaries. It further said that where CSEAM or prohibited material is circulated through paywalled or subscription-based content generating revenue for a platform, such revenue should be forfeited and disgorged.
The Union of India, through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, has been directed to formulate guidelines, SOPs and, where needed, amendments to the IT Act and IT Rules, and file an affidavit on progress by the next hearing on December 10, 2026.
Bottom Line:
Child sexual exploitative and abuse material (CSEAM) - Supreme Court directed Union of India to create a comprehensive framework for detection, removal and reporting of CSEAM - National Hash & URL List Database to be created, preferably through Sahyog Portal or otherwise - Intermediaries to deploy perceptual hash-matching, URL listing, dedicated grievance mechanisms, prompt reporting to SJPU/local police/cyber-crime portal, and strict safeguards - Court also held that right to access and use internet is a fundamental right under Article 21 read with Article 19(1)(a), and blanket age-based internet bans on children are disproportionate.
Statutory provision(s): Section 79, Section 67B of the Information Technology Act, 2000, Rules 3, 3A, 4 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Sections 15, 19, 20, 21, 43, 44 of the Protection of Children from Sexual Offences Act, 2012, Rule 11 of the Protection of Children from Sexual Offences Rules, 2020, Articles 19(1)(a), 21 of the Constitution of India
Just Rights for Children Alliance v. S. Harish, (SC) : Law Finder Doc id # 2998846
