Supreme Court orders a national hash database against child abuse material, and refuses to keep children offline
Justices J.B. Pardiwala and K. Vinod Chandran directed a national hash and URL database, two-hour reporting and dedicated grievance officers, and said safety measures must target harmful material, not children.
In September 2024 the Supreme Court decided Just Rights for Children Alliance v. S. Harish, held that viewing and storing child sexual exploitation and abuse material is an offence, and set out what social media platforms owe to children. Two years later the same Bench was shown reports that sexually exploitative material was still being promoted on platforms through paid advertisements and redirect links. In an order of 15 October 2026 on miscellaneous applications in that case, Justices J.B. Pardiwala and K. Vinod Chandran said there had been no progress worth the name. They directed the Union to build a national database of hash identifiers and URLs to detect and remove such material, set two-hour reporting deadlines for platforms, required dedicated grievance officers, and asked the Union to consider exemplary fines and the disgorgement of revenue earned from paywalled content. The Court also held that children's safety is to be achieved by targeting harmful material, not by keeping children off the internet.
Why the Court came back to the case
The 2024 judgment had dealt with a specific way the law was being evaded. Sellers of such material were sharing only links, sometimes sold for between ₹40 and ₹5,000, so that neither they nor the buyers ever stored anything on a device and both could escape provisions that punished storage. The Court had also held that platforms which failed to report this material to the Special Juvenile Police Unit or the local police under Sections 19 and 20 of the POCSO Act and Rule 11 of the POCSO Rules would lose the safe-harbour protection of Section 79 of the Information Technology Act.
In an order of 14 August 2026, the Bench recorded serious lapses by platforms in complying with those directions. The present order begins from there. More than two years after the judgment, it says, recent news reports reveal an even more unsettling reality. The applicants had placed before the Court reports of paid promotions of such material through redirect links and websites, which the Court described as one rare instance among millions that may never reach the authorities. The Court said it was left with no choice but to take matters into its own hands, and acted with the assistance of the Ministry of Electronics and Information Technology and the Ministry of Law and Justice. The Solicitor General, Mr Tushar Mehta, appeared for the Union.
What the platforms got wrong
Part of the order corrects how platforms had read the 2024 judgment. According to the news report before the Court, some of the advertisements did not show any sexual act. They advertised tools and applications that can manipulate photographs and videos into exploitative material, and they passed the platforms' advertising standards for that reason. If that was so, the Court said, it was prima facie “an egregious error on the part of intermediaries”.
The Court explained that its 2024 emphasis on a visual depiction of abuse was made only in the context of the POCSO Act. A penal statute that applies to platforms and individuals alike has to be read strictly, and criminal liability needs an actual act. The Information Technology Act and its Rules are different: much of that framework regulates how platforms behave. Under it a platform must do more than remove material that explicitly depicts abuse. It must prevent harmful material from being uploaded, hosted, promoted or circulated in the first place. Section 67B of the IT Act, the Court recalled, also covers material showing children in obscene or indecent contexts, and the advertising and promotion of such material.
The way complaints had been handled added to the Court's concern. The report described 84 such advertisements running in India, of which 55 could be reported through the platform's own system. For 43 the reply was that the advertisement did not breach the platform's advertising standards. For 11 the content had already been removed, and one received no reply. The Court noted that the IT Rules have required acknowledgement of every complaint within twenty-four hours since 2021, and that significant social media intermediaries must publish monthly reviews of their grievance mechanisms. It asked the Union what five years of those reviews had produced and why platforms were still flouting the Rules.
A national hash and URL database
The main structural direction is a National Hash and URL List Database to be built by the Union, either within the Indian Cyber Crime Coordination Centre's Sahyog portal or as a separate repository, and used only to detect and remove such material. An entry may be made only after verification at several levels. Software may do a preliminary screening, but at least three trained human analysts must independently confirm that the material qualifies. Only the perceptual hash or the URL of confirmed material goes into the database, and entries are to be made through encrypted channels.
Platforms must check content against the database and remove matches. Law enforcement agencies will use it to find matching material elsewhere on the internet. The process is in addition to platforms' existing detection, not a replacement for it.
The order distinguishes two kinds of material. Material of known origin, meaning content that matches a database entry, must be disabled and removed immediately without further verification by the platform. Material of unknown origin, meaning content a platform finds itself, must be removed only after proper verification and due diligence under the IT Rules. It must then be reported to the authorities and to the body maintaining the database, which will assess it and add it if confirmed. Wherever material is removed, the platform must display a notice in its place stating whether the removal followed its own detection or a database match.
Challenges follow from that distinction. A removal based on the platform's own detection can be contested through its grievance mechanism and then before the Grievance Appellate Committee under Rules 3(2) and 3A of the IT Rules. A removal based on a database match must be contested before the authority that maintains the database, and the Union is to frame guidelines for a grievance mechanism within that authority.
Two hours to report, and a trained officer on every complaint
Material removed under Section 15 of the POCSO Act or Section 67B of the IT Act must be reported under Rule 11 of the POCSO Rules, to the Special Juvenile Police Unit, the local police or the cyber-crime portal. Material of unknown origin must be reported within two hours, whether the removal followed a complaint, the platform's own due diligence, a court order or a reasoned intimation from the government. Removals based on database matches are to be reported in a consolidated weekly report to the body maintaining the database.
Every platform must show the details of its grievance officers on the home page of its website or app and keep them current. It must offer a separate, clearly labelled category for reporting such material, named simply enough to be understood regardless of age, literacy or familiarity with technology, and reachable within two steps of the content, profile, group or link. The Union is asked to issue guidelines so that this is uniform across platforms.
Every platform must also have a dedicated grievance officer or team for these complaints. Each report must be assessed as a whole, including text, captions, keywords, links and the purpose of any tool being promoted, to decide whether it facilitates or tends to result in the exploitation of children. Automated tools may help with preliminary screening, but no complaint may be closed without review by a trained officer. The officer's findings must be recorded and digitally signed. Complaints must be acknowledged within twenty-four hours with a tracking number, and the decision and reasons must be communicated to the complainant.
The Rules currently require only significant social media intermediaries to provide tracking and to give reasons “to the extent reasonable”. The Court said that falls short for complaints of this seriousness and expects the Union to amend the Rules so that the obligation applies to every platform for these complaints. Platforms must also publish monthly compliance reports with a separate section on such complaints, and those reports are to be independently audited by an authority designated by the Ministry.
Fines and paywalled content
The Court reviewed penalty regimes elsewhere: the United Kingdom's Online Safety Act, 2023, with fines of up to £18 million or 10 per cent of worldwide turnover; the European Union's Digital Services Act; Australia's Online Safety Act, 2021, with civil penalties of up to AU$49.5 million per breach; and South Korea's regime, with surcharges of up to 3 per cent of sales. It asked the Union to consider a framework of exemplary fines for breaches of duties under the IT Act and Rules that relate to removing such material, taking into account the gravity, duration and recurrence of the default and the size and turnover of the platform. It did not consider suspending a platform's operations, as some of those jurisdictions allow, and said that for persistent and serious failures Section 79 remains available as a last resort.
The Court also addressed content placed behind paywalls or offered on subscription. It found that such content receives far less scrutiny from platforms, which often earn a share of the fees, and that this makes paywalls a means of circulating harmful material or links to it. Where such material is found to have been offered behind a paywall that earns a platform revenue, that revenue should be forfeited and disgorged. Platforms must ensure that sexually explicit or prurient content, paywalled or not, is not promoted to children and that children cannot subscribe to it. The Union is to issue guidelines on scrutinising paywalled content and on proportionate moderation of what children can access.
No age bans: target the material, not the child
The Court then turned to a proposal that has been gaining ground elsewhere: restricting access to the internet and social media for children below a certain age. It said it had given the idea anxious consideration and had consciously decided not to endorse it.
The Court did not question the good faith behind such proposals, and acknowledged that the internet is far from safe for children. But it held that safety measures must be directed at the harmful material and those responsible for it. The wrongdoers are the people who create, circulate, sell or seek out this material, and the platforms that fail to detect and remove it. Keeping a child off the internet because of those failures, the Court said, would be “to mistake the victim for the problem”.
The Court also objected to how such bans are enforced. Age restrictions require identifying every user's age, collecting and monitoring sensitive data continuously, and accepting a disproportionate risk of misuse and surveillance, which it held has no place within the right to privacy. It relied on Cricket Association of Bengal for the right to receive information under Article 19(1)(a), on Anuradha Bhasin v. Union of India, and on Pragya Prasun v. Union of India, where a Bench that included Justice Pardiwala held digital access to be part of the right to life under Article 21. For many children in remote areas, the Court said, the internet is often their only source of learning, and for children with special needs it is often the only place they find others like themselves. The order also includes a section on digital safety awareness and age-appropriate sex education.
Order
The Union, acting through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, has been directed to oversee and implement the measures and safeguards set out in the order, and to frame guidelines, standard operating procedures and amendments to the IT Act and Rules where needed. It must file affidavits on the detection tools platforms have in place, the feasibility of rolling them out across the industry, and compliance with the grievance officer requirements together with any action taken against defaulters. Its affidavit on progress is due by the next date. The matter is listed on 10 December 2026.