How will platforms detect child abuse material? Supreme Court proposes a National Hash & URL Database, Time-Bound Reporting; Recognises right to internet access

Supreme Court: In a case concerning the continued circulation of child sexual exploitation and abuse material (CSEAM) on social media platforms, a Division Bench of J.B. Pardiwala and K.V. Chandran, JJ., emphasised the need for a comprehensive framework for its detection, removal and reporting. The Court called for a National Hash & URL List Database, time-bound reporting obligations, effective grievance redressal and accountability of intermediaries. It further held that the right to access and use the internet is a fundamental right under Article 21 read with Article 19(1)(a) of the Constitution, observing that children’s safety must be ensured by targeting harmful material rather than restricting their internet access. The Court also underscored the need for proportionate online safeguards, age-appropriate sex education and digital safety awareness. The Union of India has been directed to file an affidavit of compliance, and the matter will be heard next on 10 December 2026.

Background

The present proceedings arise out of concerns expressed by the Court over the continued circulation of CSEAM on social media platforms, despite the directions issued in Just Rights for Children Alliance v. S. Harish, 2024 SCC OnLine SC 2611, decided on 23 September 2024. In the said judgment, the Court had flagged the use of indirect links and redirect mechanisms to circulate such harmful material and circumvent the rigours of Section 15 of the Protection of Children from Sexual Offences) Act, 2012 (POCSO Act) and Section 67B of the Information Technology Act, 2000 (IT Act), as well as the failure of social media intermediaries to report such activities to the Special Juvenile Police Unit, as required by law. The Court had further clarified that such non-compliance would disentitle social media platforms from the protection of safe harbour under Section 79 of the IT Act.

Despite the directions issued in the aforesaid judgment, the Court, in its order dated 14 August 2026, expressed serious concerns over the alleged paid promotion of CSEAM through redirect links and websites on social media platforms. Observing that there had been no progress worth the name in curbing the circulation of such material, the Court noted that numerous similar incidents might remain undetected and unreported in the absence of collective action by all stakeholders. In view of the continued inaction on the part of the regulatory authorities and social media intermediaries, the Court proposed to put in place a workable framework to ensure a safer cyberspace for children, with the assistance of the Union of India through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, and sought the Union of India’s response on the issues identified by it.

Analysis

FRAMEWORK FOR THE DETECTION AND REMOVAL OF CSEAM.

1) Advanced Mechanisms for the Detection and Removal of CSEAM

1. Some Problems in the Existing Mechanism

   The Court observed that the existing mechanism for detecting and removing CSEAM relies primarily on individual reports by users or authorities, followed by removal by the concerned intermediary. The absence of coordination amongst platforms results in delayed detection and removal, allowing such material to continue circulating. The Court noted that existing coordination arrangements, wherever available, remain informal and dependent on the initiative of individual platforms.

2. Matching and Listing of Hash & URL of CSEAM

   The Court highlighted the significance of “Hash and URL Data Matching & Listing” for effective detection and removal of CSEAM. While hash listing identifies content through its unique digital identifier, perceptual hashing accounts for its audio-visual characteristics to prevent detection evasion through manipulation. URL listing, on the other hand, identifies and blocks external links hosting CSEAM, including indirect links circulated on social media platforms. The Court noted that these technological measures are deployed in various jurisdictions to facilitate effective detection and removal of such material.

3. The Position in India

   The Court observed that India lacks specific requirements mandating the uniform deployment of hash listing and URL listing. Although Rules 3 and 4 of the Information Technology Rules, as amended in 2026, require reasonable efforts and appropriate technical measures for detecting and removing CSEAM, Rule 4(4) prima facie limits detection obligations to content previously flagged or removed on the intermediary’s own computer resource. This leaves unresolved the simultaneous removal of such content across platforms and the blocking of indirect links to external sources. Emphasising the need for uniform adoption of proven technological measures, the Court sought the Union of India’s response on existing detection mechanisms, the feasibility of industry-wide deployment of perceptual hash-matching and URL listing, and the formulation of comprehensive, periodically revisable guidelines prescribing the technological measures to be adopted by all intermediaries.

2) Comprehensive National Database for the Detection and Removal of CSEAM

1. Need for a National Database for Hash & URL Lists of CSEAM

   The Court observed that a national “Hash & URL List Database” was essential to enable simultaneous detection and removal of child sexual exploitation and abuse material (“CSEAM”) across platforms, as individual intermediaries presently maintain fragmented and incomplete lists. The proposed database would serve as a common, real-time repository of verified hash identifiers and URLs, accessible to intermediaries and law enforcement agencies, without storing the harmful material itself.

2. Indian Cyber Crime Coordination Centre’s Sahyog Portal

   The Court acknowledged that the Sahyog Portal, managed by the Indian Cyber Crime Coordination Centre (I4C), was a step in the right direction and could serve as the foundation for the proposed database. However, it noted that the portal, in its existing form, merely facilitates the routing of individual reports and takedown notices, rather than enabling continuous detection and removal across platforms. Accordingly, the Court sought the Union of India’s response on whether the proposed database could be established within the Sahyog Portal or as a standalone repository, its existing capabilities and the timeline for its full operationalisation.

3. Safeguards and Standard Operating Procedure for the Maintenance and Use of Hash & URL List Database

   The Court emphasised that the database must incorporate a robust verification mechanism to prevent erroneous entries and the removal of lawful content. It envisaged a three-step process involving preliminary software screening, independent assessment by at least three trained human analysts, and entry of the verified hash identifiers and URLs into the database through encrypted channels, without storing the CSEAM itself.

i. Procedural Difference viz-a-viz CSEAM of ‘Unknown Origin’ and ‘Known Origin’

The Court distinguished between CSEAM of “Unknown Origin”, detected through an intermediary’s own mechanisms, and CSEAM of “Known Origin”, identified through a match with an existing database entry. In the former case, intermediaries would be required to remove the material, generate its hash and URL identifiers, and promptly report it to the Special Juvenile Police Unit, local police or cyber-crime portal, as well as the database-maintaining authority for independent verification. In the latter case, the intermediary would be required to immediately disable and remove the matching material without awaiting further verification, while furnishing consolidated weekly reports to the database authority for accuracy checks and correction of erroneous entries.

ii. Requirement of Proper Notice and Grievance Redressal

The Court held that intermediaries must prominently display a notice indicating whether the material was removed through their own detection mechanisms or pursuant to a match with the database. While challenges to removals based on an intermediary’s own detection would lie under the grievance redressal mechanism and, where necessary, before the Grievance Appellate Committee, challenges to database-based removals would lie before the authority maintaining the database. Such notice, however, would not dilute the intermediary’s obligation to preserve the material and associated data and report the same to the competent authorities, nor should it reproduce or describe the removed material.

iii. Additional Safeguards Required for the use of Hash & URL List Database

The Court underscored the need for adequate safeguards, including

Independent verification: Each entry must undergo multiple tiers of verification, with the final assessment mandatorily undertaken by two or three trained human analysts, independently determining whether the material constitutes CSEAM.

Digitally signed assessment reports: The database-maintaining authority must maintain a report of the assessment findings for each entry, bearing the digital signatures of the analysts concerned.

Maintenance of records and audit trails: Complete records must be maintained of every database entry, the source of the material, the analysts involved, their findings and the date of entry. Every access to the database must also be logged, with records preserved to facilitate audits and accountability.

Periodic independent audits: The database and its entries must be subjected to periodic independent audits, with the findings placed in the public domain, at least in an aggregated form.

Prompt removal of erroneous entries: Any wrongly entered hash identifier or URL must be promptly removed, and such removal communicated to all intermediaries to ensure immediate restoration of content removed pursuant to the erroneous entry.

Effective grievance redressal mechanism: Any person aggrieved by the removal of content must be able to raise a complaint before both the concerned intermediary and the authority maintaining the database, particularly where removal is based on a database match.

Accordingly, the Court sought the Union of India’s formulation of a comprehensive Standard Operating Procedure delineating the respective roles of the database authority, intermediaries and law enforcement agencies, incorporating the aforesaid safeguards.

3. Mechanisms for the Reporting of CSEAM.

The Court observed that the efficacy of any mechanism for the removal of child sexual exploitation and abuse material (“CSEAM”) depends upon the promptness of its reporting and removal. It noted that the existing framework suffers from cumbersome reporting mechanisms, inadequate prioritisation of CSEAM complaints, and the absence of prescribed timelines for reporting such material to the authorities. The Court accordingly examined the need to streamline reporting, strengthen grievance redressal and ensure timely reporting by intermediaries.

a) Some Lacunas in the Existing Mechanism

The Court observed that although the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules) prescribe timelines for removing unlawful and sexually exploitative content, no specific timeline adequately addresses complaints of CSEAM reported by members of the public other than the individual depicted therein. Such complaints are often relegated to the ordinary grievance redressal mechanism, resulting in delays. The Court identified the cumbersome nature of reporting mechanisms, the absence of dedicated prioritisation and the lack of prescribed timelines for reporting CSEAM to the competent authorities as major shortcomings.

b) Streamlining and Standardization of Reporting Mechanism

The Court noted that reporting mechanisms across intermediaries lack uniformity, often employ confusing categories and may insist upon unnecessary personal details, thereby discouraging complaints. It emphasised that every intermediary must provide a distinct and clearly labelled category for reporting CSEAM, accessible within two steps from the relevant content, profile, group or link. The mechanism must be uniform across platforms, preserve the anonymity of the complainant and provide an acknowledgement and reference number to track the complaint and action taken.

c) Efficacy of the Grievance Redressal Mechanism relating to CSEAM

The Court observed that an accessible reporting mechanism is of little value unless complaints are properly assessed and resolved. According to a news report placed before it, of 84 advertisements that ran in India, 55 could be reported; for 43 of these, the platform replied that the advertisement did not violate its Advertising Standards. Prima facie, the Court found this an egregious error in understanding what constitutes CSEAM. . The Court accordingly examined the need to broaden the understanding of CSEAM, establish dedicated grievance officers and prescribe clear reporting obligations.

i. Misconception on what constitutes “CSEAM” and Misreading of our decision in Just Rights (supra)

The Court clarified that the requirement of visual depiction discussed in Just Rights for Children Alliance & Anr. v. S. Harish & Ors., 2024 INSC 716, was in the context of criminal liability under the POCSO Act and could not be extended to restrict the broader regulatory obligations under the IT Act and the IT Rules. For the purposes of the latter, CSEAM includes electronic material that facilitates, promotes or enables the creation, circulation or consumption of sexually exploitative or abusive material involving children, even where no explicit visual depiction is present. Accordingly, advertisements promoting tools capable of generating such material, or indirect links directing users to websites hosting CSEAM, cannot escape scrutiny merely because the advertisements themselves contain no explicit depiction. The Court emphasised that intermediaries must assess the content as a whole, including its text, captions, keywords, links and the functionality of the tools being promoted, and sought comprehensive guidelines to align their community guidelines and advertising standards accordingly.

ii. Dedicated Grievance Officers for managing CSEAM and reports related thereto

The Court observed that entrusting complaints of CSEAM to grievance officers handling multiple categories of complaints may undermine effective and timely resolution. It therefore considered it appropriate for every intermediary to appoint a dedicated grievance officer or team to handle CSEAM complaints, oversee compliance with detection and removal requirements, and ensure proper reporting to the authorities. Such officers must be adequately trained, supported with sufficient resources and assisted by a mechanism capable of identifying and routing CSEAM complaints irrespective of the category under which they were initially reported. No complaint should be disposed of without review by a trained grievance officer, whose findings must be recorded and digitally signed.

iii. The Proper Authority and Timelines for reporting of CSEAM by Intermediaries

The Court noted that the IT Act, the IT Rules and the POCSO Act framework do not prescribe specific timelines for intermediaries to report CSEAM to the competent authorities. It accordingly proposed the following requirements:

Proper authorities: CSEAM removed for violation of Section 15 of the POCSO Act or Section 67B of the IT Act must be reported in accordance with Rule 11 of the POCSO Rules to the Special Juvenile Police Unit, local police and/or cyber-crime portal, as applicable. CSEAM of “Unknown Origin” must also be reported to the database-maintaining authority, while removals of CSEAM of “Known Origin” must be reported to that authority through consolidated weekly reports.

Timelines: CSEAM of “Unknown Origin” detected through a complaint must be reported within two hours of resolution of the complaint; where detected through the intermediary’s own due diligence, within two hours of removal; and where removed pursuant to a court order or reasoned intimation from the appropriate Government, within two hours of removal. For CSEAM of “Known Origin”, consolidated weekly reporting to the database-maintaining authority would suffice.

d. Need for a Prescribed Form for the Reporting of CSEAM by the intermediaries

The Court emphasised the need for a standard prescribed pro forma for reporting the detection and removal of CSEAM. The report must be in a uniform, machine-readable format capable of automated processing and integration with the Hash & URL List Database, the National Crime Records Bureau, the National Database on Sexual Offenders and other relevant systems. This would facilitate coordination amongst intermediaries, Internet Service Providers and law enforcement agencies, while assisting investigations, identification of distribution networks and rescue of victims.

e. Safeguards for the Grievance Redressal Mechanism in respect of CSEAM

The Court reiterated the following safeguards to ensure effective and accountable grievance redressal:

1. Every intermediary must prominently display and regularly update the details of its grievance officers and complaint mechanism.

2. A simple, clearly labelled CSEAM reporting category must be accessible within two steps and implemented uniformly across platforms.

3. Complaints must be assessed in light of Sections 15 of the POCSO Act and 67-B of the IT Act, considering the content as a whole. Grievance officers must receive regular training and adequate resources.

4. No CSEAM complaint may be disposed of without review by a trained grievance officer. The officer’s findings must be recorded and digitally signed.

5. Every complaint must be acknowledged within 24 hours, assigned a reference number and followed by communication of the decision and reasons to the complainant. The Court urged amendments to extend these requirements to every intermediary.

6. Every intermediary must publish monthly reports separately detailing CSEAM complaints, action taken, resolution timelines and content removed. Such reports must be periodically audited by an authority designated by the Ministry of Electronics and Information Technology.

The Court also sought the Union of India’s response on the mechanism for monitoring compliance with orders passed by the Grievance Appellate Committee and the action taken against intermediaries failing to comply with such orders.

4) Penalties for persistent failures by Intermediaries in complying with the requirements of IT Rules

1. Need to Rethink and Move Beyond Section 79 of the IT Act

   The Court observed that the persistent failure of intermediaries to comply with the IT Rules may be attributed to the absence of any meaningful consequence for such non-compliance, other than the loss of safe harbour protection under Section 79 of the IT Act. Such protection, once lost, fastens liability only after an offence is committed through particular content hosted on the platform. However, in cases of CSEAM, every instance of circulation, viewing and downloading revictimises the child and causes irreparable harm, which cannot be undone by subsequent prosecution and punishment.

   The Court further observed that Section 79 fails to address systemic lapses and continued non-compliance with regulatory duties, as it does not directly address the failure to comply but only the aftermath thereof. Consequently, the Court held that a distinct set of consequences must be prescribed, capable of being invoked without awaiting the commission of an offence, while remaining proportionate to the nature, gravity and frequency of the default.

2. Exemplary Monetary Fines and Penalties

   The Court examined the regulatory frameworks in the United States, the United Kingdom, the European Union, Australia and South Korea, where non-compliance with regulatory requirements, particularly those relating to CSEAM, attracts substantial monetary penalties. It observed that the quantum of such fines is determined having regard to the gravity, duration and recurrence of the default, as well as the size or turnover of the intermediary, to ensure an effective deterrent.

   Accordingly, the Court requested the Union of India to give serious thought to devising a similar framework of penalties suitable and workable for India, addressing continued breaches of duties under the IT Act and the IT Rules. The proposed framework would be confined to duties relating to or aiding the removal of CSEAM, including its detection and removal, maintenance of a proper grievance redressal mechanism and effective resolution of complaints. The Court clarified that exemplary fines would suffice for the present, while Section 79 would remain available as a last resort in cases of serious and persistent failures.

3. Scrutiny and Disgorgement of “Profits” from Paywalled Content

   The Court expressed concern that paywalled and subscription-based content often receives a lower threshold of scrutiny, thereby facilitating the indirect circulation of illicit and harmful material, including CSEAM. It observed that certain intermediaries may continue to profit from such content while turning a blind eye to its nature, until the circulation of CSEAM is exposed.

   The Court, therefore, held that where CSEAM or other prohibited material is hosted, uploaded, promoted or circulated, directly or indirectly, through a paywall or subscription from which an intermediary derives revenue, such revenue should be forfeited and disgorged, in addition to exemplary fines for the contravention of statutory duties.

   The Court further put all intermediaries to strict notice that paywalled and subscription-based content must be subjected to rigorous scrutiny to ensure compliance with the IT Act, the IT Rules and other applicable laws. Intermediaries must ensure that CSEAM, or any material having the propensity or likelihood to harm children, is not offered, hosted, uploaded, promoted or circulated through such mechanisms. They must also take measures to prevent children from accessing content that is obscene, indecent, sexually explicit, lascivious or prurient in nature.

   Accordingly, the Court requested the Union of India to frame appropriate guidelines for scrutiny of paywalled and subscription-based content and for adopting reasonable and proportionate measures to regulate the content accessible to children, keeping in mind Articles 14, 19 and 21 of the Constitution. The Union of India was also requested to consider whether the prescribed penalties should include disgorgement of revenue derived by intermediaries through the misuse of paywalls and subscriptions for the promotion, circulation or dissemination of CSEAM.

5) Article 21 and the Right to Access Internet

The Court held that the right to access and use the internet is a fundamental right under Article 21 read with Article 19(1)(a) of the Constitution. Measures for children’s safety must target harmful material and those responsible for it, rather than the children themselves. Keeping children away from the internet on account of such failures would be to mistake the victim for the problem.

The Court observed that blanket age-based restrictions are unproven measures of proven disproportionality, which may expose children to more unsafe platforms and discourage them from reporting online abuse. Such restrictions cannot substitute the efforts required from intermediaries, law enforcement agencies and other stakeholders for the detection and removal of CSEAM.

However, the Court recognised the need for proportionate age-based safeguards, including parental consent and oversight, dedicated child mode accounts, private accounts by default, restrictions on contact from unknown adults and moderation of advertisements and content accessible to children. The Union of India may also restrict access to specific categories of content inherently harmful to children, such as adult content websites.

The Court clarified that the use of Hash and URL List databases and similar measures must remain confined to the detection and removal of CSEAM and the creation of an online space free from such harm.

6) Awareness on Digital Safety, Sex Education and Measures to support Wellbeing of Children

The Court observed that the safety of children is not complete without inculcating in them the awareness to recognise danger, the confidence to speak up and the safe practices to follow, on and off the internet. It emphasised that digital safety and positive age-appropriate sex education are not two separate subjects, but two sides of the same coin. Such education must extend to consent, healthy relationships, respect for others, safe and unsafe touch, online privacy, and recognising grooming, sexual extortion and other exploitative practices.

The Court expressed concern that, despite the suggestions made in Just Rights for Children Alliance v. Union of India, more than two years had passed, and sought to understand the steps taken by the Union of India towards their implementation. It reiterated that children must be encouraged to report incidents without fear of reproach and assured of help, support and complete confidentiality.

The Court emphasised that

“…awareness of digital safety and sex education are not two separate subjects, but two sides of the same coin, and must be addressed as such.”

Accordingly, the Court highlighted the following measures:

1. Age-appropriate education: Children must be taught about their bodies, safe and unsafe touch, consent, healthy relationships and respect for the dignity of others.

2. Digital safety awareness: Children must be educated about online privacy, protection of personal data, and recognising grooming, sexual extortion and other exploitative practices.

3. Reporting mechanisms: Children must know whom to approach in cases of abuse, both online and offline, and be encouraged to report incidents without fear of reproach, with an assurance of support and complete confidentiality.

4. Awareness of legal rights: Children must be made aware of the POCSO Act and the IT Act, particularly the provisions criminalising the viewing, possession and circulation of CSEAM, as well as their rights under these enactments.

5. Curriculum integration: Digital safety and age-appropriate sex education must form part of the core curriculum, developed by the NCERT and SCERTs in consultation with child psychologists, educators and parenting experts.

6. Display of helplines: Child Helpline ‘1098’, Cyber Crime Helpline ‘1930’, the National Cyber Crime Reporting Portal and State-wise nodal officers’ details must be displayed in classrooms, hostels, libraries, computer laboratories and on educational institutions’ websites.

7. Content filtering: Devices and networks in schools and educational institutions must be equipped with reasonable and proportionate filters to prevent access to harmful content, with greater rigour in hostels, child care institutions, tuition and coaching centres.

8. Training of teachers and staff: Teachers and other school staff must be trained to identify grooming, abuse and online harassment, respond appropriately to disclosures by children, comply with reporting obligations under Sections 19 and 21 of the POCSO Act, and maintain confidentiality.

9. Parental awareness: Schools and educational institutions must organise regular awareness programmes for parents and guardians regarding online risks, parental controls, safety settings and signs of distress, while ensuring that parental supervision does not create mistrust or miscommunication.

10. Sustained public awareness campaigns: The Union and State Governments, along with the respective Commissions for Protection of Child Rights, must conduct sustained campaigns on the POCSO Act, child abuse and exploitation, particularly CSEAM, through television, social media, telecommunication channels, SMS, OTT platforms, print media and public signage.

11. Stakeholder sensitisation: Awareness must be created among parents, guardians, teachers and other stakeholders regarding digital safety measures, available helplines and the appropriate response to incidents of abuse and exploitation.

12. Safety measures by intermediaries: Intermediaries must provide periodic reminders on safe platform usage, safety centres, privacy settings and help options, display cautionary prompts when children attempt to interact with unknown adults, and issue appropriate warnings for searches associated with CSEAM.

13. Support for victims: The Union and State Governments must establish support mechanisms providing free counselling, psychological support and therapy through trained professionals for as long as necessary, along with proper follow-up to ensure victims’ continued well-being.

Decision

1. Detection and Removal of CSEAM through Hash Matching and URL Listing

The Court directed the Union of India to furnish an affidavit detailing the tools and technological measures deployed by intermediaries for the detection and removal of CSEAM. It called for appropriate guidelines or standard operating procedures governing perceptual hash matching and URL listing, along with periodic revisions and necessary amendments to the IT Rules.

2. Creation and Use of National Hash & URL List Database

The Court directed the creation of a National Hash & URL List Database exclusively for detecting and removing CSEAM. Each entry must undergo multiple tiers of verification, including independent assessment by at least three trained human analysts. Intermediaries must immediately remove content matching known entries, while material of unknown origin must undergo due verification and be promptly reported to the appropriate authorities.

3. Display of Proper Notices in place of any material Removed as CSEAM

The Court directed intermediaries to prominently display a notice wherever CSEAM is removed, indicating whether the removal resulted from their own detection or a match against a known entry in the National Hash & URL List Database.

4. Grievance Redressal against any material Removed as CSEAM

The Court clarified that challenges to removals based on an intermediary’s own detection would lie under the existing grievance redressal mechanism and, where necessary, before the Grievance Appellate Committee. Challenges to removals based on a known database match would lie before the authority designated to maintain the National Database, for which the Union of India must establish an appropriate grievance redressal mechanism.

5. Proper Authority for the reporting of CSEAM by Intermediaries

The Court directed that removals or disabling of CSEAM must be reported in accordance with Rule 11 of the POCSO Rules to the Special Juvenile Police Unit, local police and/or cybercrime portal. Material of unknown origin must additionally be reported to the authority maintaining the National Database, while removals based on known matches must be reported through consolidated weekly reports.

6. Timelines within which CSEAM must be reported by Intermediaries

The Court prescribed a strict timeline of two hours for reporting CSEAM of unknown origin, whether detected through complaints, the intermediary’s own due diligence, or pursuant to a court order or reasoned intimation from the appropriate Government. Removals based on known database matches must be reported through consolidated weekly reports.

7. Publication of requisite details of Grievance Officers and Grievance Redressal Mechanism

The Court directed every intermediary to prominently display the details of its grievance officers and the mechanism for raising complaints on the home page or screen of its website or application. Such information must be regularly updated. The Union of India was directed to furnish details regarding compliance and action taken against defaulting intermediaries.

8. Access to the Grievance Redressal Mechanism

The Court directed that every intermediary’s grievance redressal mechanism must contain a distinct and clearly labelled category for reporting CSEAM. The category must be readily understood irrespective of age, literacy or familiarity with technology, and must be accessible within two steps from the relevant content, profile, group or link.

9. Working of the Grievance Redressal Mechanism and Dedicated Grievance Redressal Officers for Reports relating to CSEAM

The Court emphasised that every complaint relating to CSEAM must be thoroughly assessed by a trained grievance officer, having regard to Sections 15 of the POCSO Act and 67-B of the IT Act. The assessment must consider the content as a whole, including text, captions, keywords, links and the function of the application or tool being promoted.

The Court further directed that:

1. Automated tools may assist preliminary screening, but the ultimate decision must be taken by a trained grievance officer.

2. Assessments must record the officer’s findings and bear the officer’s digital signature.

3. Every complaint must be acknowledged within 24 hours, accompanied by a reference number, and the complainant must be informed of the decision and reasons.

4. The Union of India should extend complaint-tracking and reasoned-decision requirements to every intermediary insofar as CSEAM complaints are concerned, through suitable amendments to the IT Rules.

5. Every intermediary must publish monthly compliance reports detailing complaints received, action taken, resolution timelines and content removed or disabled, with CSEAM complaints disclosed separately.

6. Such reports must be periodically subjected to independent audit by an appropriate authority designated by the Ministry of Electronics and Information Technology.

10. Other Significant Measures and Safeguards

The Court requested the Union of India to consider a framework for imposing exemplary monetary fines for breaches of duties under the IT Act and the IT Rules. The penalties must reflect the gravity, duration and recurrence of the default, as well as the size and turnover of the intermediary.

The Court further emphasised that:

1. Revenue derived from hosting, uploading, promoting or circulating CSEAM or prohibited material through paywalls or subscriptions should be forfeited and disgorged.

2. Paywalled and subscription-based content must undergo rigorous scrutiny to ensure compliance with the IT Act, the IT Rules and other applicable laws.

3. Intermediaries must ensure that CSEAM or other material likely to harm children is not offered, hosted, promoted or circulated through paywalls or subscriptions.

4. Measures must be taken to prevent children from accessing or subscribing to content that is obscene, indecent, sexually explicit, lascivious or prurient.

5. The Union of India must frame appropriate guidelines for scrutiny of paywalled content and prescribe reasonable and proportionate safeguards governing the content accessible or available for subscription to children.

The Court directed the Union of India, through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, to take appropriate steps to implement the measures and safeguards discussed in the judgment. It called for appropriate guidelines, Standard Operating Procedures and necessary amendments to the IT Act and the IT Rules.

The Union of India was directed to file an affidavit by the next date of hearing, indicating the progress made, steps taken towards compliance and any further suggestions. The matter was directed to be listed on 10 December 2026.

[Just Rights for Children Alliance v. S. Harish, Criminal Appeal Nos. 2161-2162 of 2024, decided on 15-10-2026]