The Supreme Court has directed the Union Government to create a national database of digital identifiers and web links for detecting and removing child sexual exploitation and abuse material (CSEAM), while prescribing strict reporting timelines and greater accountability for online intermediaries.
A Bench of Justice J.B. Pardiwala and Justice K.V. Chandran, in an order dated October 15, 2026, issued extensive directions covering content detection, human review of complaints, grievance redressal, scrutiny of subscription-based content and digital safety education.
For newly identified material described in the order as CSEAM of “unknown origin”, intermediaries must report its removal to the appropriate authorities within the prescribed two-hour window. Material matching an existing entry in the proposed national database must be removed immediately, with details submitted through consolidated weekly reports to the database authority.
Buy Now: 90+ Supreme Court Judgments – September 2026
The Court also asked the Centre to consider a framework for exemplary monetary penalties against intermediaries that breach their statutory duties, and said revenue derived from prohibited content behind paywalls should be forfeited and disgorged.
Background Of The Proceedings
The order arose from miscellaneous applications in Just Rights for Children Alliance & Anr. v. S. Harish & Ors., following the Court’s September 23, 2024 judgment concerning child sexual exploitation and abuse material.
The Bench recalled that, in an earlier order dated August 14, 2026, it had expressed concern over serious lapses by social media platforms in complying with the directions issued in the 2024 judgment.
The proceedings examined how online platforms could prevent the circulation of abusive material more effectively, including indirect promotion through links, advertisements and tools that facilitate its creation or distribution.
Platform Duties Extend Beyond Explicit Images And Videos
A central legal issue was whether intermediaries could confine their action to material that expressly depicts the sexual exploitation or abuse of a child.
The Court rejected such a narrow understanding of their obligations under the Information Technology Act and the IT Rules.
It explained that its earlier observations concerning visual depictions had to be understood in the context of the penal provisions of the Protection of Children from Sexual Offences Act. Criminal liability under that enactment requires strict construction and the existence of the prohibited act.
The regulatory duties of intermediaries under the IT framework, however, extend further. Platforms must address electronic material that facilitates, promotes or enables the creation, circulation or consumption of sexually exploitative or abusive material involving children, even where the material being assessed contains no explicit visual depiction.
The Bench specifically observed that an advertisement promoting a tool capable of manipulating photographs or videos of children into sexually exploitative material cannot escape scrutiny merely because the advertisement itself does not depict a child.
Such promotion, the Court explained, could fall within Section 67B(d) of the IT Act and the prohibition against information harmful to children under the IT Rules.
National Database To Identify And Remove Known Material
The Court directed the Union Government to establish a National Hash & URL List Database, exclusively for detecting and removing CSEAM. It may operate within the Indian Cyber Crime Coordination Centre’s Sahyog Portal or as a standalone repository.
Hash identifiers act as digital fingerprints that enable matching systems to recognise previously identified material. URL lists identify web locations associated with that material.
Before an entry is included, the underlying material must undergo multiple levels of verification. Specialised software may assist preliminary screening, but the final assessment must be undertaken independently by at least three trained human analysts.
Once confirmed as CSEAM, the material’s perceptual hash identifier and/or URL may be entered into the database through encrypted channels. Database entries must remain confined to those identifiers and links.
Intermediaries must cross-check content against the database, while law enforcement agencies must use it to identify and secure removal of matching material across the internet. This mechanism will supplement existing detection and removal processes.
Immediate Removal For Database Matches
The Bench distinguished between CSEAM of “known origin” and “unknown origin” for the purposes of the proposed mechanism.
“Known origin” refers to material matching an entry already verified and included in the national database. On detecting such a match, an intermediary must immediately disable and remove the material without undertaking a fresh verification exercise.
“Unknown origin” concerns material identified outside that existing database. An intermediary must exercise proper verification and due diligence before removing it, and must promptly report it to the appropriate authorities and the designated database authority, where they are different.
The database authority must then independently assess the reported material before adding its identifiers to the repository.
Two-Hour Reporting Timeline For Newly Identified Material
The Court prescribed separate reporting requirements depending on how material of unknown origin is detected.
Where removal follows a user complaint, the intermediary must report the matter forthwith upon resolution of the complaint and, in any event, within two hours of that resolution.
Where removal follows the intermediary’s own due diligence, reporting must occur within two hours of removal. The same two-hour period applies where removal follows an order of a competent court or a reasoned government intimation.
The appropriate reporting authorities are those specified under Rule 11 of the POCSO Rules, including the Special Juvenile Police Unit, local police and/or the cybercrime portal.
For material removed because it matches a database entry, intermediaries must submit consolidated weekly reports to the designated database authority. The Union Government may prescribe additional recipients for those reports.
These reporting deadlines are distinct from the direction requiring immediate removal of material matching the national database.
Complaints Must Receive A Trained Human Review
The Court directed that no CSEAM complaint should be disposed of without review by a trained grievance officer.
Automated systems may assist preliminary screening, but the ultimate decision must be taken by a trained officer. The assessment must consider the content as a whole, including captions, keywords, links and the functions of any promoted tool or application.
The officer must record the findings and digitally sign the assessment to ensure accountability. Platforms must provide periodic training and adequate resources to those handling such complaints.
Every complaint must be acknowledged within 24 hours, accompanied by a reference number for tracking. The complainant must receive the decision and the reasons supporting it.
The Court also expected suitable amendments to extend complaint-tracking and reason-giving requirements to every intermediary dealing with CSEAM complaints.
Reporting Facility Must Be Accessible Within Two Steps
Intermediaries must provide a distinct, clearly labelled category for reporting CSEAM. Its wording must be understandable regardless of the user’s age, literacy or familiarity with technology.
The reporting mechanism must be accessible within two steps from the content, profile, group or link concerned. The Court requested the Centre to frame guidelines ensuring uniformity across platforms.
Intermediaries must also prominently display updated grievance officer details and complaint procedures on their website homepage or application’s home screen.
The Union Government must submit information on compliance with these requirements and action taken against defaulting platforms.
Removal Notices And Avenues To Challenge Errors
The Bench incorporated safeguards against wrongful classification and removal.
Whenever an intermediary removes material as CSEAM, it must prominently display a notice explaining whether the action resulted from its own detection or a match with the national database.
Where removal follows the intermediary’s independent assessment, the challenge will proceed through the grievance mechanism under the IT Rules and, where necessary, the Grievance Appellate Committee.
Where removal follows a database match, the challenge must be considered by the authority maintaining that database. The Centre must frame guidelines establishing the corresponding grievance mechanism.
Monthly Reports And Independent Audits
Every intermediary must publish a monthly compliance report recording complaints received, action taken, resolution timelines and material removed or disabled following complaints or its own due diligence.
CSEAM complaints must appear in a separate section.
The Court directed that these reports be periodically subjected to independent audit by an appropriate authority designated by the Ministry of Electronics and Information Technology.
Exemplary Fines And Scrutiny Of Paywalled Content
The Court asked the Centre to consider a framework for exemplary monetary fines for breaches of duties under the IT Act and IT Rules.
The proposed penalties should account for the gravity, duration and recurrence of the default, alongside the intermediary’s size and turnover. The order does not itself prescribe a fixed monetary penalty.
The Bench also placed intermediaries on strict notice regarding subscription-based and paywalled content. Platforms must rigorously scrutinise such material to ensure compliance with applicable law.
Where an intermediary earns revenue from CSEAM or prohibited material hosted, promoted or circulated through subscriptions or paywalls, the Court said that revenue should be forfeited and disgorged.
Platforms must additionally prevent obscene or sexually explicit content from being promoted to children and take care to ensure that children cannot subscribe to or access it. The Centre must frame guidelines for scrutiny of paid content and proportionate moderation of material accessible to children.
Blanket Internet Restrictions Cannot Replace Safety Measures
Addressing children’s internet access, the Court cautioned against blanket restrictions as a substitute for effective safeguards.
It observed that prohibitions may push children towards less regulated platforms and discourage them from reporting exploitation because they fear punishment for going online.
The Bench nevertheless recognised the need for proportionate age-based protections. It suggested parental consent and guidance, dedicated child accounts, private-by-default settings, restrictions on messages from unknown adults and moderation of advertising and accessible content.
The actual design of these measures was left to the Union Government.
Digital Safety And Age-Appropriate Sex Education
The Court directed that digital safety and age-appropriate sex education form part of the core curriculum, developed by NCERT and SCERTs in consultation with child psychologists, educators and parenting experts.
Children must be taught about bodily autonomy, safe and unsafe touch, consent, healthy relationships, privacy and the warning signs of online exploitation.
Schools and other institutions must train staff, organise awareness programmes for parents and provide accessible information about reporting and support mechanisms. Institutional devices and networks must carry reasonable and proportionate filters against harmful content.
The Bench also called for free counselling, psychological support and therapy for victims for as long as necessary, supported by follow-up mechanisms to monitor their wellbeing.
Centre Directed To Report Progress
The Court directed the Union Government, through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, to oversee implementation of the measures discussed in the order.
It called for appropriate guidelines, standard operating procedures and suitable amendments to the IT Act and IT Rules wherever necessary.
The Centre must file a progress affidavit before the next hearing, scheduled for December 10, 2026.
Membership Required to Access Case Details & Order Copy
To view the complete Case Details and Download Order Copy, you must have an active membership. Please subscribe to continue.
Read More: Tax Audit Deadline Tomorrow: Delay May Attract Penalty Up To ₹1.5 Lakh
