FACTS

In its earlier judgment dated 23.09.2024 in Just Rights for Children Alliance & Anr. v. S. Harish & Ors. (2024 INSC 716), the Supreme Court had taken note of an alarming increase in Child Sexual Exploitation and Abuse Material (“CSEAM”) being circulated on social media platforms, and had directed intermediaries to detect, remove, and report such content in compliance with Sections 19 and 20 of the POCSO Act read with Rule 11 of the POCSO Rules, failing which they would forfeit the “safe harbour” protection under Section 79 of the IT Act.

More than two years later, the applicants placed before the Court fresh news reports revealing that CSEAM continued to be circulated and even sold on social media platforms, with sellers circumventing detection by sharing redirect links rather than the material itself — a modus operandi the Court had itself anticipated in its 2024 judgment. The Court found that despite its earlier directions, there had been no progress worth the name, and that regulatory authorities and intermediaries alike had shown no earnest initiative.

ISSUE

Whether, in the continued absence of an effective, industry-wide mechanism for the detection and removal of CSEAM, the Court ought to lay down a binding technological and procedural framework of its own; and whether the right to access and use the internet — including by children — is a fundamental right under Article 21 read with Article 19(1)(a) of the Constitution, such that any blanket age-based restriction on children’s internet access would itself be constitutionally impermissible.

MAIN ARGUMENTS

The applicants submitted that the existing complaint-driven mechanism for detecting CSEAM was wholly inadequate, since detection by one platform did not automatically result in removal across others, allowing the same content to continue circulating. They urged the Court to mandate the use of internationally recognised tools — Hash Matching and URL Listing — and a centralised national database, so that content confirmed as CSEAM on one platform could be instantly flagged and removed across the internet.

The learned Solicitor General, appearing for the Union of India, assisted the Court in examining comparative regulatory frameworks from the United States, United Kingdom, South Korea, and Australia, and in considering the feasibility of a National Hash & URL List Database, appropriate safeguards for its use, and penalties for persistent non-compliance by intermediaries, including possible disgorgement of profits derived from paywalled content hosting such material.

On the question of children’s internet access, it was urged that any measure for child safety must be directed at the harmful material and those responsible for it, and not at children themselves — since blanket restrictions have, in other jurisdictions, proved to be disproportionate, driving children towards unregulated and less safe platforms without any demonstrated improvement in safety.

DECISION

The Supreme Court did not confine itself to adjudicating the immediate complaint but laid down a comprehensive, ten-point regulatory and constitutional framework governing the detection, removal, reporting and prevention of CSEAM, the accountability of intermediaries, and the digital rights of children. The key directions and holdings are summarised below.

1. Detection and Removal of CSEAM through Hash Matching and URL Listing

• The Union of India shall, by way of an affidavit, disclose the tools and technological measures presently deployed by intermediaries for the detection and removal of CSEAM.
• Appropriate guidelines or a Standard Operating Procedure (“SOP”) shall be framed by the Union of India mandating the use of perceptual hash-matching and URL listing by all significant social media intermediaries, with corresponding amendments to the IT Rules where necessary.
• Such guidelines/SOP shall be periodically revised by the Ministry of Electronics and Information Technology, and the Union shall indicate, by affidavit, the feasibility of industry-wide deployment of such tools.

2. Creation and Use of a National Hash & URL List Database

• The Union of India shall create a National Hash & URL List Database solely for the detection and removal of CSEAM — either as part of the existing Sahyog Portal or as a standalone repository.
• Every entry shall be made only after assessment through multiple tiers of verification, with final determination made independently by at least three trained human analysts.
• Confirmed material shall have its hash identifier and/or URL entered into the database through encrypted channels, strictly confined to that identifier.
• Intermediaries shall use the database to cross-check and remove matching content on their own platforms; law enforcement agencies shall use it to identify and remove such content across the internet. This process operates in addition to, not in substitution of, the ordinary existing mechanisms of detection.
• For CSEAM of “Known Origin” (i.e., matching a database entry), the intermediary must immediately disable and remove the content without awaiting further verification. For CSEAM of “Unknown Origin”, removal must be preceded by due diligence under the IT Rules, followed by reporting to the proper authorities and to the database-maintaining body.

3. Display of Proper Notices in Place of Removed Material

• Wherever an intermediary removes material as CSEAM, it must prominently display a notice in its place, indicating whether the removal followed the intermediary’s own detection or a match against a known database entry.

4. Grievance Redressal Against Removal

• Where content is removed pursuant to the intermediary’s own detection, challenges shall lie under the ordinary grievance redressal mechanism and, thereafter, before the Grievance Appellate Committee under Rules 3(2) and 3A of the IT Rules.
• Where content is removed on the basis of a match with the National Database, the challenge shall lie before the authority designated to maintain that database, for which the Union of India shall frame appropriate guidelines.

5. Proper Authority for Reporting of CSEAM by Intermediaries

• Removal or disabling of CSEAM in consequence of Section 15 POCSO / Section 67B IT Act must be reported in accordance with Rule 11 of the POCSO Rules to the Special Juvenile Police Unit, local police, and/or the cyber-crime portal.
• CSEAM of “Unknown Origin” must also be reported to the authority maintaining the Hash & URL List Database. CSEAM of “Known Origin” (database matches) must be reported through a consolidated weekly report to that authority.

6. Timelines for Reporting of CSEAM

• CSEAM of Unknown Origin removed pursuant to a complaint: reported forthwith upon resolution, and in any case within two hours thereof.
• CSEAM of Unknown Origin removed on the intermediary’s own due diligence, or on the order of a court or reasoned intimation of the appropriate government: reported within two hours of removal.
• CSEAM of Known Origin (database matches): consolidated weekly reports to the authority maintaining the database, irrespective of whether removal followed a complaint.

7. Publication of Grievance Officer Details and Redressal Mechanism

• Every intermediary must prominently display, on its home page/screen, the details of its grievance officer(s) and the complaint mechanism, in accordance with Rule 3(2)(a) of the IT Rules, and keep this information regularly updated.
• The Union of India shall furnish an affidavit on the extent of compliance by various intermediaries and the action taken against defaulters.

8. Accessibility of the Grievance Redressal Mechanism

• Every intermediary must provide a distinct, clearly labelled category for reporting CSEAM, using simple nomenclature understandable irrespective of a user’s age, literacy or technological familiarity.
• The reporting mechanism must be accessible within two steps from the content, profile, group or link in question, and must be uniform across all intermediaries, for which the Union shall frame guidelines.

9. Working of the Grievance Redressal Mechanism and Dedicated Officers

• Every CSEAM report/complaint must be thoroughly assessed having regard to Sections 15 and 67B of the POCSO Act and IT Act, examining the content as a whole — text, captions, keywords, links, and the function of any tool/application involved.
• Grievance officers must be adequately trained to identify CSEAM, including material that is not explicit on its face but nevertheless carries a likelihood of harm to children, with periodic refresher training on emerging modus operandi.
• Intermediaries must allocate adequate resources to the grievance mechanism; no CSEAM report may be disposed of without review by a trained grievance officer — automated tools may assist preliminary screening, but the final decision must be human.
• Each assessment must be recorded and digitally signed by the officer for accountability. Every report must be acknowledged within twenty-four hours with a trackable reference number, and the outcome communicated to the complainant with reasons.
• The Union of India shall, by suitable amendment to the IT Rules, extend the complaint-tracking and reasoned-disposal requirements presently confined to “significant” social media intermediaries under Rule 4(6) to all intermediaries, insofar as CSEAM complaints are concerned.
• Every intermediary must publish a monthly compliance report disclosing complaints received, action taken, resolution timelines, and content removed (whether on complaint or own due diligence), with CSEAM complaints disclosed under a separate section and subjected to periodic independent audit by an authority designated by MeitY.

10. Other Significant Measures and Safeguards

• The Union of India shall consider a framework for exemplary monetary fines on intermediaries for breach of duties under the IT Act/IT Rules, with quantum determined by the gravity, duration and recurrence of default, and the intermediary’s size and turnover. Serious breaches may also attract action under Section 79 IT Act and appropriate penal law.
• Where CSEAM or prohibited material is found hosted, promoted or circulated — directly or indirectly — through any paywall or subscription from which the intermediary derives revenue, such revenue shall be liable to forfeiture and disgorgement.
• All intermediaries are placed on strict notice that paywalled/subscription content must be rigorously scrutinised to ensure no CSEAM or other child-harmful material is offered, hosted, promoted or circulated through it, directly or indirectly, and that no child is able to subscribe to or access such content.
• The Union of India shall frame guidelines for proper scrutiny of paywalled/subscription content and for reasonable and proportionate measures to moderate content accessible to children, consistent with Articles 14, 19 and 21 of the Constitution.

Article 21 — Right to Access and Use the Internet

• The Court held, in unambiguous terms, that the right to access and use the internet is a fundamental right of every individual — including children, irrespective of age — under Article 21 read with Article 19(1)(a) of the Constitution, building upon Anuradha Bhasin v. Union of India (2020) 3 SCC 637 and Pragya Prasun & Ors. v. Union of India (2025 INSC 599).
• The Court declined to endorse blanket age-based restrictions on children’s access to the internet or social media, holding such measures to be “unproven measures of proven disproportionality.” It reasoned that such bans achieve the means through an overreach — continuous data collection, age-verification surveillance, and a disproportionate risk of misuse — that itself offends the right to privacy; that children continue to access the internet regardless, migrating instead to unregulated and more dangerous platforms; and that such restrictions make children reluctant to report abuse for fear of losing access altogether, undermining the very object of the POCSO Act.
• The Court clarified that any measure for child safety must be directed at the harmful material and those responsible for it, not at the children themselves, since the safety of children and their freedom are not at odds — children are entitled to both.
• Instead of blanket bans, the Court endorsed proportionate safeguards: a dedicated “child mode”, private-by-default accounts, restrictions on contact/messages from unknown adults, moderation of advertising and content, and a reasonable, proportionate system of parental consent and oversight for pre-teens — leaving the precise modalities to the Union of India.
• This holding does not preclude the Union of India from restricting children’s access to specific categories of inherently harmful content or services (such as adult content websites). The Court also clarified that the Hash & URL List Database and similar measures discussed in the judgment are confined strictly to the detection and removal of CSEAM and must not be repurposed for any other end.

Sex Education and Support for Child Wellbeing

• Reaffirming its 2024 observations, the Court reiterated that positive, age-appropriate sex education — covering consent, healthy relationships and respect for others, not merely reproductive biology — plays a critical role in preventing harmful sexual behaviour, including the viewing and distribution of CSEAM, and in countering the widespread societal misconceptions that have limited its implementation in India.
• The obligation of the appropriate Government and the Commissions for Protection of Child Rights under Sections 43 and 44 of the POCSO Act extends beyond merely publicising the Act’s provisions to actively imparting sex education and awareness to the public, children, parents, guardians, schools and educational institutions.
• The Union and State Governments, together with the Commissions for Protection of Child Rights, shall create awareness amongst all stakeholders regarding digital safety measures and available helplines/support portals, across social media, telecommunication channels, SMS, OTT platforms, print media and public signage, and shall sensitise parents, guardians, teachers and others in loco parentis on the appropriate response to incidents of abuse.
• Intermediaries must put in place periodic safety reminders for children, including cautionary prompts when a child attempts to connect with an unknown adult, and warnings on CSEAM-related search terms or queries.
• The Union and State Governments shall establish support mechanisms for victims of online or offline abuse/exploitation, including free, readily accessible counselling and psychological therapy by trained professionals for as long as necessary, with proper follow-up mechanisms to oversee victims’ continued wellbeing.

Final Directions

• The Union of India, through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, is directed to take appropriate action to oversee and implement all the measures and safeguards discussed in the judgment, including the formulation of appropriate guidelines, Standard Operating Procedures, and suitable amendments to the IT Act and IT Rules.
• The Union of India shall, by the next date of hearing, file an affidavit indicating the progress made and the steps taken in compliance with the directions issued.