India's Supreme Court Orders Shared Database to Remove Child Sexual Abuse Material, Rejects Blanket Internet Bans

A shared detection system, with children still allowed online

India's Supreme Court has ordered the Union government to create a National Hash and URL List Database to help platforms identify and remove confirmed child sexual exploitation and abuse material across services. Each entry must undergo independent assessment by at least three trained human analysts, and the database will hold digital identifiers and internet addresses rather than the abusive images or videos themselves.

The 136-page order, dated October 15, 2026, also sets reporting deadlines for social media companies, demands accessible complaint systems and calls for digital safety education in schools. The government must submit an affidavit describing implementation progress by the next hearing on December 10, 2026.

Justices J. B. Pardiwala and K. Vinod Chandran issued the directions in Just Rights for Children Alliance & Anr. v. S. Harish & Ors., following applications alleging failures to comply with the court's September 23, 2024 judgment.

The bench paired stronger duties for technology companies with a constitutional finding: children have a fundamental right to access and use the internet. It declined to endorse blanket restrictions based on age, favouring parental guidance, safer account settings and action against those creating, circulating or profiting from abusive material.

Why separate platform removals are falling short

The court identified a practical weakness in the existing system. When one company detects and removes abusive material, another platform may continue carrying the same image, video or link because it has not identified it independently.

Rule 4(4) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 refers to content previously removed on the particular intermediary's own computer resources. The bench considered that approach too narrow to support coordinated detection across services.

The applications also drew attention to alleged paid promotions that directed users to abusive material through links and external websites. Of 84 advertisements examined in India, 55 were reported through a platform's reporting system. Of those 55, 43 were deemed compliant with its advertising standards, roughly 78 percent of the advertisements reported.

For the court, the problem involved both repeated uploads and the routes through which users were being directed towards exploitation. Its framework therefore covers identifying known material, checking external addresses, reporting to police and examining the money earned through distribution.

How the national database would work

The National Hash and URL List Database may operate within the Sahyog Portal of the Indian Cyber Crime Coordination Centre, known as I4C, or as a separate repository. Sahyog currently routes complaints and removal notices; the proposed database would add a shared reference system for detecting confirmed abusive material.

A hash is a digital identifier generated from a file, comparable to a fingerprint. Platforms can compare identifiers to recognise material already identified elsewhere. Perceptual hashing goes further by helping detect similar images or videos after changes such as resizing or reformatting.

A URL is an internet address. Listing these addresses helps platforms act against links that send users to known locations hosting abusive material, including when the material is stored outside the platform carrying the link.

The government must develop guidelines or standard operating procedures for significant social media intermediaries to use perceptual hash matching and URL listing. The court favoured guidance that can be revised periodically as technology changes.

Platforms would check their services against database entries, while law enforcement agencies would use the shared identifiers to locate matching material elsewhere online. A confirmed finding could therefore support action across several services, rather than starting a fresh detection process at each company.

Three human assessments before an entry is accepted

The court required several verification stages before material can be represented in the database. Software may carry out preliminary screening, but at least three trained human analysts must each independently assess whether the material constitutes child sexual exploitation and abuse material, or CSEAM.

Entries must be submitted through encrypted channels. The repository must store only the relevant hashes and URLs, with records of assessments, access logs and independent audits. Incorrect entries must be removed promptly.

People affected by removals based on database entries must have access to a grievance process. Removal notices should explain the basis for the action so that a person knows whether to approach the platform or the body maintaining the database.

These safeguards connect a powerful shared detection system with a route to correct mistakes. Because an entry can trigger action across platforms, the accuracy of the initial assessment matters to every later removal.

Which actions have a two hour reporting deadline?

The court set different procedures for newly identified material and material already represented in the national database. In this framework, material of unknown origin means content being assessed through a platform's own detection or complaints process. Known material is content matched against a confirmed database entry.

• When a platform independently detects and removes material of unknown origin, it must report the removal within two hours.
• When removal follows a complaint, the platform must report immediately after resolving the complaint, and within two hours of that resolution at the latest.
• When content matches an existing database entry, the platform must disable and remove it immediately and submit a consolidated report of such removals each week.

Platforms must verify newly identified material before removing and reporting it through this process. They must inform the authorities designated under Indian law, including the Special Juvenile Police Unit, local police or the cybercrime portal, as applicable under Rule 11 of the Protection of Children from Sexual Offences Rules, 2020. The designated database body must also be informed where it is a different authority.

The two hour deadlines concern reporting after removal or complaint resolution. The weekly reporting procedure applies to matches against material already confirmed in the database, alongside the requirement for immediate removal.

The September 2024 judgment had already tied reporting duties to Section 79 of the Information Technology Act, 2000. That section provides conditional protection, often called safe harbour, against liability for material posted by users. The court held that intermediaries must carry out due diligence and comply with reporting obligations under the child protection law to claim that protection.

Complaints must reach a trained person

Platforms must offer a distinct, plainly named CSEAM reporting category reachable within two steps. Reporting must preserve anonymity without compulsory personal details, and grievance officer information must be easy to find on websites and applications.

Each complaint must receive an acknowledgement within 24 hours and a reference number. A trained grievance officer must review it, and the complainant must receive the decision and the reasons. Automated tools may assist with preliminary screening, while a trained officer remains responsible for reviewing the complaint.

The court also called for reports in a uniform format that computer systems can process. Consistent reporting would give authorities information in a usable form rather than forcing them to reconcile different company formats.

The Union government was asked to extend accountability requirements across intermediaries through suitable amendments to the IT Rules. For users, the intended change is concrete: an accessible reporting route, a trackable complaint and a decision that explains what action was taken.

Advertising and subscription income face scrutiny

The bench directed intermediaries to prevent CSEAM and other prohibited harmful material from being offered, hosted, uploaded, promoted or circulated through paywalls or subscriptions, directly or indirectly. A paywall is a payment barrier that users must pass to access content.

The court said revenue earned from prohibited material distributed through those services should be forfeited and surrendered. It asked the government to develop the necessary framework and consider exemplary monetary penalties for breaches of duties under the IT Act and its rules.

Penalty levels should reflect the seriousness, duration and repetition of a breach, together with the company's size and turnover. This would allow the response to account for both a repeated failure and the scale of the business responsible.

The order also addresses electronic material that enables exploitation, including advertisements for tools that manipulate images into abusive material or redirect users towards it. The court treated the regulatory reach of the IT Act and Rules as extending beyond visual depictions alone, referring to Section 67B(d) and Rule 3(1)(b).

Before the order, the Ministry of Electronics and Information Technology told the court that it had issued a notice to Meta's compliance officer in July 2026 over paid advertisements promoting CSEAM. Those proceedings were continuing. The government's account also described discussions after which Google and Meta agreed to report cases directly to Indian law enforcement agencies.

Why the court rejected a blanket ban for children

The bench recognised internet access and use as a fundamental right under Article 21, which protects life and personal liberty, read with Article 19(1)(a), which protects freedom of speech and expression. It said children enjoy these rights regardless of age.

Justices Pardiwala and Chandran explained the relationship between protection and access in their order:

The safety of our children and their freedom are not at odds with each other. Our children are entitled to both.

The court reasoned that children may continue using the internet secretly after a prohibition, moving towards less regulated services. A child facing threats or manipulation might then hesitate to seek help because they fear punishment for going online.

The bench also raised privacy concerns about systems that require every user to establish their age through extensive collection and monitoring of sensitive information. Instead, it suggested parental consent, guidance and oversight, alongside a dedicated child mode.

Possible settings include accounts that are private by default, limits on contact from unknown adults and controls over advertising and content. For children below their teenage years, the court suggested proportionate ways to verify parental consent. It left the detailed arrangements to the Union government and allowed for targeted restrictions on inherently harmful services, including adult content websites.

Schools are part of the protection plan

The court directed that digital safety and sex education suitable for each age should form part of the core curriculum. Lessons should cover consent, safe and unsafe touch, healthy relationships, protection of personal information, online exploitation and ways to report abuse.

The National Council of Educational Research and Training and the State Councils of Educational Research and Training are to develop the content with child psychologists, educators and parenting experts. The court also called for helpline numbers to be displayed in schools and awareness programmes to begin at primary level.

For children, this means learning how to recognise danger and tell a trusted adult, alongside the technical measures companies are expected to operate. The education component addresses situations in which a child encounters manipulation or threatening behaviour before any image or link has been identified by a platform.

The court's terminology also reflects that focus on harm. In its September 2024 judgment, it asked Parliament to consider replacing the term "child pornography" in the POCSO Act with language describing child sexual exploitation and abuse material, to reflect the nature of the offences more accurately.

What the government must do before December 10

The Ministries of Electronics and Information Technology and Law and Justice must take steps to implement the framework through guidelines, standard operating procedures and suitable changes to the IT Rules and, where necessary, the IT Act. The government's affidavit must describe progress, including the technological tools intermediaries currently use.

MeitY had already submitted a draft procedure prepared with the Ministry of Women and Child Development, Ministry of Home Affairs, Department of Telecommunications and other stakeholders. Solicitor General Tushar Mehta sought more time to finalise it.

The proceedings have developed over several stages:

• September 23, 2024: The Supreme Court delivered its earlier judgment on CSEAM, including intermediaries' reporting duties.
• February 2026: The government amended the intermediary rules to add specific due diligence obligations concerning CSEAM.
• July 2026: MeitY issued a notice to Meta's compliance officer over paid advertisements promoting such material.
• August 14, 2026: The court recorded concern about serious compliance lapses.
• October 15, 2026: The bench issued the database, reporting, education and accountability framework.
• December 10, 2026: The court is scheduled to hear the matter again, with the government's progress affidavit due by then.

The order gives no launch date for the database or final amounts for monetary penalties. December's hearing will require the government to explain the steps taken towards shared detection, reliable reporting and safer online access for children.

Key Points

• A national database will store hashes and URLs of confirmed child sexual exploitation and abuse material, rather than the material itself.
• At least three trained human analysts must independently assess every proposed entry.
• Specified removals require reporting within two hours; matches against existing database entries require immediate removal and weekly reports.
• Platforms must acknowledge complaints within 24 hours and provide trained human review.
• The court barred distribution through paywalls and subscriptions and called for a framework addressing penalties and prohibited revenue.
• Children retain a fundamental right to internet access, with targeted safeguards preferred over blanket bans.
• The government must report implementation progress by the December 10, 2026 hearing.