Supreme Court Seeks National Database to Detect and Remove Child Sexual Abuse Material Online

A Digital Problem That Cannot Be Addressed Platform by Platform

The internet has transformed how information is created, shared and accessed. However, the same technological infrastructure has also enabled the circulation of exploitative material involving children, often through interconnected platforms, private groups, external websites and indirect links.

The Supreme Court has recognised that conventional mechanisms for removing such material are inadequate when digital content can move almost instantaneously between platforms.

In its order dated 15 October 2026, the Bench of Justice J.B. Pardiwala and Justice K.V. Chandran examined the shortcomings of India’s existing framework for combating CSEAM.

The proceedings arose from miscellaneous applications filed in connection with the Court’s earlier judgment in Just Rights for Children Alliance & Anr. vs S. Harish & Ors., reported as 2024 INSC 716.

The Court observed that despite its previous directions, the circulation of exploitative material remained a serious concern. Reports placed before it suggested that harmful content was being promoted through indirect links, including arrangements involving monetary payments.

The Bench expressed its concern in unequivocal terms:

“We cannot emphasize this enough, that there can be no space for non-consensual sexually exploitative and abusive material on the internet”

The central issue was no longer limited to whether individual platforms could remove prohibited content. It concerned whether India’s digital ecosystem could develop a coordinated mechanism capable of preventing the same material from repeatedly resurfacing elsewhere.

Background: Why the Supreme Court Revisited the Issue

The Court’s earlier judgment dated 23 September 2024 had examined the legal implications of accessing, storing, possessing and circulating child sexual exploitation material.

It had also addressed the obligations of social media intermediaries under the Protection of Children from Sexual Offences Act, 2012 (POCSO Act) and the Information Technology Act, 2000.

Particular attention was given to Section 15 of the POCSO Act and Section 67B of the Information Technology Act. The earlier judgment highlighted how individuals involved in distributing prohibited material could exploit technological arrangements by sharing links instead of directly uploading or downloading files.

The Court had further clarified that intermediaries could not rely exclusively on compliance with the Information Technology Act to escape their independent reporting obligations under the POCSO framework.

Under Sections 19 and 20 of the POCSO Act, read with Rule 11 of the POCSO Rules, intermediaries are required to report relevant offences to the prescribed authorities.

The Court had emphasised that reporting to international organisations such as the National Center for Missing & Exploited Children (NCMEC) could not substitute reporting to Indian authorities.

Nevertheless, the subsequent proceedings revealed continuing concerns regarding compliance, enforcement and technological preparedness.

In the present order, the Court noted that the existing arrangements had failed to produce the level of coordinated action necessary to protect children effectively.

The Fundamental Weakness: Fragmented Detection Systems

One of the most important observations in the order concerns the fragmented nature of content detection. At present, social media platforms generally identify harmful material through user complaints, internal monitoring systems or directions received from competent authorities.

When one platform identifies and removes CSEAM, that removal does not necessarily lead to its identification on other platforms.

Consequently, identical material may continue circulating elsewhere until another intermediary independently detects it.

The Court identified this lack of coordination as a fundamental weakness. Even where platforms voluntarily cooperate, such arrangements may remain informal and dependent upon individual corporate policies.

The Bench considered that an effective response required a system capable of sharing verified technical identifiers of prohibited material across platforms.

This led to its examination of two technological mechanisms: hash matching and URL listing.

How Hash Matching Can Help Identify Prohibited Material

Hash matching is a technological process used to identify digital files through numerical or alphanumeric identifiers.

When a particular image or video is confirmed to contain CSEAM, specialised software can generate a digital identifier associated with that material.

This identifier can then be compared against other files to detect matching content. The Court examined the usefulness of this technology in preventing repeated circulation of material that has already been identified.

However, conventional hash matching has limitations. Changes in file size, formatting or other technical characteristics may affect whether a file can be recognised.

The Court therefore considered perceptual hashing, which uses characteristics of visual or audiovisual content to identify material even when certain modifications have been made.

The significance of this technology lies in its potential to detect altered versions of previously identified harmful content.

The Court also examined URL listing, a mechanism directed towards identifying internet addresses through which prohibited material is hosted or accessed.

This is particularly relevant where social media posts do not contain the prohibited files themselves but redirect users to external websites.

By combining perceptual hash matching with URL listing, platforms could develop a more comprehensive approach to identifying both directly uploaded content and indirect distribution networks.

The Court directed the Union Government to frame appropriate guidelines or standard operating procedures governing the use of these technologies by significant social media intermediaries.

National Hash and URL List Database: The Central Direction

The most consequential part of the order concerns the creation of a National Hash and URL List Database. The Supreme Court directed the Union of India to establish a central repository containing verified technical identifiers of material confirmed to constitute CSEAM.

Unlike existing platform-specific databases, the proposed national system would enable participating intermediaries and law enforcement agencies to access a common set of identifiers.

The objective is straightforward: once prohibited material is identified and verified, its technical identifier should become available for detection across the digital ecosystem.

Importantly, the proposed database would not store the exploitative images or videos themselves. It would contain the relevant hash identifiers and URLs.

This distinction is significant because the system is intended to facilitate detection and removal without creating another central repository of abusive content.

The Court indicated that the database could either operate as a standalone facility or be integrated with the Government’s existing Sahyog Portal.

Can the Sahyog Portal Become the Foundation?

The Supreme Court examined the role of the Indian Cyber Crime Coordination Centre (I4C) and its Sahyog Portal. The portal has been developed to facilitate coordination between authorities and digital intermediaries regarding unlawful online content.

The Court acknowledged that this was a positive development. However, it distinguished between a system that merely processes individual takedown requests and one that continuously shares verified identifiers for proactive detection.

The Sahyog Portal, in its existing form as described in the order, primarily facilitates the routing of reports and removal notices.

A national hash database would perform an additional function by allowing previously identified content to be recognised across multiple platforms.

The Court therefore sought clarity regarding the portal’s technological capabilities and the feasibility of integrating the proposed database into its infrastructure.

The distinction reflects the broader shift contemplated by the order: from reactive removal of reported content to coordinated detection of previously identified material.

Human Verification Must Accompany Automated Detection

Although the Court supported the adoption of advanced technological tools, it recognised that automated systems are not infallible. Incorrect classification could result in lawful material being removed across several platforms simultaneously.

To prevent such consequences, the Court prescribed a verification process before material could be entered into the national database.

The process may begin with preliminary screening by specialised software. However, the final determination must be undertaken independently by at least three trained human analysts.

Only after the material is confirmed to constitute CSEAM may its hash identifier or URL be added to the database.

The Court also emphasised the importance of maintaining records of assessments, ensuring accountability and preserving audit trails.

Entries must be transmitted through encrypted channels, and the database must remain confined to the technical identifiers of verified material.

These safeguards are essential because a centralised detection system, while potentially effective, also creates the possibility of widespread erroneous removal if its entries are inaccurate.

Known Origin and Unknown Origin: Two Different Procedures

The Court introduced an important distinction between material of Known Origin and Unknown Origin for the purposes of the proposed database.

Material of Known Origin refers to content that matches an existing verified entry in the national database. Where such a match is detected, the intermediary must immediately disable or remove the material without undertaking another independent verification.

Material of Unknown Origin, on the other hand, refers to content detected by an intermediary through its own monitoring systems, complaints or other mechanisms, but which does not match an existing database entry.

Such material must undergo appropriate verification before removal under the applicable framework. Once identified and removed, it must also be reported to the relevant authorities and the body maintaining the national database.

The designated authority would then independently assess whether the material qualifies for inclusion in the common repository.

This distinction is intended to ensure that already verified material can be removed promptly while newly identified material undergoes sufficient scrutiny.

Reporting Obligations: Two Hours for Newly Identified Material

The Supreme Court also addressed delays in reporting CSEAM to competent authorities. The order reiterates that intermediaries must comply with the reporting framework established under the POCSO Act and its Rules.

Depending upon the circumstances, reports must be made to the Special Juvenile Police Unit, local police or the cybercrime portal, as specified under Rule 11 of the POCSO Rules.

For material of Unknown Origin, the Court prescribed strict reporting timelines.

• Where the removal follows the resolution of a complaint, the report must be made immediately upon resolution and, in any event, within two hours thereafter.
• Where an intermediary independently detects and removes such material, reporting must take place within two hours of removal.

The same two-hour requirement applies where removal follows an order of a competent court or a reasoned intimation from the appropriate government.

For material of Known Origin removed following a database match, the Court provided for consolidated weekly reporting to the designated database authority.

The distinction recognises that newly detected material may require immediate investigation, whereas previously verified material can be monitored through periodic reporting.

Social Media Platforms Must Improve Complaint Mechanisms

The Court examined another practical problem: the difficulty users may face when attempting to report child sexual exploitation material.

A reporting mechanism may technically exist, yet remain ineffective if users cannot locate it easily or if complaints are categorised incorrectly.

The Bench therefore required intermediaries to provide a distinct and clearly labelled reporting category for CSEAM. The reporting option must be accessible within two steps from the relevant content, profile, group or link.

The Court also emphasised that reporting terminology should be understandable regardless of a user’s age, literacy or familiarity with technology.

Every complaint concerning CSEAM must be acknowledged within 24 hours, accompanied by a reference number enabling the complainant to track its status.

Decisions must be communicated with reasons. The Court further required complaints to be reviewed by trained grievance officers rather than being disposed of solely through automated systems.

Monthly compliance reports must separately disclose complaints relating to CSEAM, the action taken and the time required for resolution.

The Court also contemplated independent audits to assess compliance with the applicable requirements. These measures seek to make the grievance redressal process more accessible, transparent and accountable.

Safeguards Against Wrongful Removal and Digital Censorship

The Court recognised that the proposed database must operate within a framework of procedural fairness. A wrongly classified entry could result in legitimate material being removed from several platforms.

Accordingly, the order requires intermediaries to display an appropriate notice whenever content is removed as CSEAM. The notice must indicate whether the removal resulted from the intermediary’s independent assessment or a match with the national database.

Where removal follows an intermediary’s own determination, the affected person may approach the intermediary’s grievance redressal mechanism and, where necessary, the Grievance Appellate Committee.

Where removal results from a database match, the challenge must be directed to the authority maintaining the database. The Union Government has been directed to develop an appropriate grievance redressal framework for such cases.

The Court also emphasised the need for maintaining audit records and periodically reviewing the accuracy of database entries.

These protections reflect an important constitutional consideration: technological enforcement must remain accountable and capable of correcting mistakes.

Financial Penalties and Profits from Prohibited Content

Another significant aspect of the order concerns the financial consequences of non-compliance. The Court observed that existing reliance on the withdrawal of safe-harbour protection under Section 79 of the Information Technology Act may not sufficiently deter persistent failures by intermediaries.

It therefore directed the Union Government to consider a framework for imposing exemplary monetary penalties for violations of statutory duties.

The quantum of such penalties should reflect the seriousness, duration and recurrence of the default, as well as the intermediary’s size and turnover.

The Bench also examined the circulation of prohibited material through paid subscriptions and paywalled content.

Where an intermediary derives revenue from prohibited material hosted, promoted or circulated through such arrangements, the Court stated that the revenue attributable to that content should be forfeited and disgorged.

The Court further called for rigorous scrutiny of subscription-based content to ensure that prohibited material is not made available through commercial arrangements.

Importantly, the monetary penalty framework remains a matter requiring further governmental action. The order does not itself establish a complete statutory penalty schedule.

Children’s Right to Access the Internet Must Also Be Protected

The order goes beyond content moderation to examine the relationship between child safety and the constitutional right to access the internet.

The Court considered proposals involving age-based restrictions on internet access but declined to endorse a general exclusionary approach.

It reasoned that children should not be deprived of access to digital resources merely because platforms and regulatory authorities have failed to prevent harmful content.

The Bench observed that protective measures should principally target exploitative material and those responsible for creating, distributing or facilitating it.

The Court’s approach recognises that the internet is increasingly connected with education, communication, information and participation in contemporary society.

Protecting children, therefore requires making digital spaces safer rather than treating children themselves as the source of the problem.

The order places this discussion within the broader constitutional framework of Article 21, while recognising the importance of proportionate safeguards.

Digital Safety Education and Institutional Responsibility

The Supreme Court also stressed the importance of preventive education. Referring to its earlier judgment, the Court discussed the need for age-appropriate sex education and awareness regarding online exploitation.

The measures examined include integrating digital safety into educational curricula, training teachers to recognise signs of exploitation and making reporting mechanisms more accessible.

The Court highlighted the importance of awareness about grooming, online harassment, confidentiality and the legal obligations associated with reporting offences against children.

It also discussed the visibility of support services, including the Child Helpline 1098, Cyber Crime Helpline 1930 and the National Cyber Crime Reporting Portal.

The underlying principle is that technological intervention cannot replace education, institutional awareness and support for affected children.

An effective child protection framework must therefore combine legal enforcement, responsible platform governance, technological detection and preventive education.

What Has the Supreme Court Directed the Government to Do?

In its concluding directions, the Supreme Court required the Union of India, acting through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, to take appropriate steps towards implementing the proposed framework.

The principal directions include:

1. Establishing a National Hash and URL List Database exclusively for detecting and removing CSEAM.

2. Framing guidelines for perceptual hash matching, URL listing and other technological detection measures.

3. Ensuring independent human verification before material is entered into the national database.

4. Introducing standardised procedures for reporting, removing and reviewing prohibited material.

5. Strengthening intermediary grievance redressal mechanisms and reporting obligations.

6. Considering exemplary financial penalties and measures to prevent commercial exploitation through paywalled content.

7. Introducing appropriate amendments to the Information Technology Act and the Information Technology Rules, wherever necessary.

The Union Government has also been directed to file an affidavit detailing the progress made and the steps taken towards compliance.

The matter has been listed for further hearing on 10 December 2026.

Click Here to Read the Official Judgment

Conclusion: Towards a Coordinated System of Online Child Protection

The Supreme Court’s order in Just Rights for Children Alliance & Anr. v. S. Harish & Ors. marks an important development in the regulation of online child sexual exploitation material.

Its central contribution lies in recognising that individual takedown requests and isolated platform-level moderation cannot adequately address a problem that operates across interconnected digital networks.

By directing the establishment of a national database of verified technical identifiers, the Court has sought to create the foundation for coordinated detection and removal.

At the same time, its insistence on independent human verification, transparent grievance procedures, accountability and proportionality demonstrates that technological enforcement must be accompanied by safeguards.

The effectiveness of the framework will ultimately depend upon its implementation, cooperation between intermediaries and law enforcement agencies, and continued regulatory oversight.

The order thus moves India’s approach towards a broader principle of digital responsibility: the protection of children online must be a shared and enforceable obligation, rather than a fragmented exercise undertaken only after harmful material is reported.