Supreme Court Directs Framework to Detect and Remove Child Sexual Exploitation Material Online

2026 INSC 1149 REPORTABLE IN THE SUPREME COURT OF INDIA CRIMINAL APPELLATE JURISDICTION M.A. NOS. 2553-2554 OF 2026 In Criminal Appeal Nos. 2161-2162 of 2024

IN THE MATTER OF: JUST RIGHTS FOR CHILDREN ALLIANCE & ANR. …APPLICANTS

S. HARISH & ORS. …RESPONDENTS

Digitally signed by VISHAL ANAND Date: 2026.10.17 10:17:00 IST Reason: Signature Not Verified

M.A. Nos. 2553-2554 of 2026 Page 1 of 136 INDEX I. BACKGROUND ......................................................................................... 3 II. FRAMEWORK FOR THE DETECTION AND REMOVAL OF

CSEAM. ......................................................................................................... 8 A. Advanced Mechanisms for the Detection & Removal of CSEAM 8 i. Some Problems in the Existing Mechanism. ............................... 8 ii. Matching and Listing of Hash & URL of CSEAM. .................... 9 iii. The Position in India. ..................................................................... 14 B. Comprehensive National Database for the Detection and Removal

of CSEAM. ............................................................................................... 21 i. Need for a National Database for Hash & URL Lists of

CSEAM. ............................................................................................. 21 ii. Indian Cyber Crime Coordination Centre’s Sahyog Portal. ... 23 iii. Safeguards and Standard Operating Procedure for the

Maintenance and Use of Hash & URL List Database. ............. 25 a. Procedural Difference viz-a-viz CSEAM of ‘Unknown

Origin’ and ‘Known Origin’ ................................................... 27 b. Requirement of Proper Notice and Grievance Redressal .. 32 c. Additional Safeguards Required for the use of Hash & URL

List Database. ............................................................................ 34 C. Mechanisms for the Reporting of CSEAM. ...................................... 37 i. Some Lacunas in the Existing Mechanism. ................................ 42 ii. Streamlining & Standardization of Reporting Mechanism. .. 45 iii. Efficacy of the Grievance Redressal Mechanism relating to

CSEAM. ............................................................................................. 49 a. Misconception on what constitutes “CSEAM” and

Misreading of our decision in Just Rights (supra). ............. 50 b. Dedicated Grievance Officers for managing CSEAM and

reports related thereto. ............................................................ 63 c. The Proper Authority and Timelines for reporting of

CSEAM by Intermediaries. ..................................................... 70 d. Need for a Prescribed Form for the Reporting of CSEAM by

the intermediaries. ................................................................... 74

M.A. Nos. 2553-2554 of 2026 Page 2 of 136 e. Safeguards for the Grievance Redressal Mechanism in

respect of CSEAM. ................................................................... 77 D. Penalties for persistent failures by Intermediaries in complying

with the requirements of IT Rules. .................................................... 83 i. Need to rethink and move beyond Section 79 of the IT Act. . 83 ii. Exemplary Monetary Fines and Penalties. ................................. 87 iii. Scrutiny and Disgorgement of “Profits” from Paywalled

Content. ............................................................................................. 96 E. Article 21 and the Right to Access Internet. ................................... 100 F. Awareness on Digital Safety, Sex Education and Measures to

support Wellbeing of Children. ....................................................... 108 III. SUMMARY OF OUR CONCLUSION ............................................... 122

M.A. Nos. 2553-2554 of 2026 Page 3 of 136 I. BACKGROUND

1. We heard the learned counsel appearing for the applicants and Mr. Tushar Mehta, the learned Solicitor General appearing for the Union of India. 2. In our previous order dated 14.08.2026, we had expressed concerns over certain serious lapses on the part of various social media intermediaries and platforms, particularly in complying with the directions that were issued in our judgment dated 23.09.2024 in Just Rights for Children Alliance & Anr. v. S. Harish & Ors. reported in 2024 INSC 716.

3. In Just Rights (supra) we had taken note of an alarming increase in child sexual exploitation and abuse material (“CSEAM”) that were being circulated on social media platforms.

4. At that time, we had flagged how indirect links to such harmful material were being promoted and shared through social media algorithms to bypass the rigours of the special penal provisions

M.A. Nos. 2553-2554 of 2026 Page 4 of 136 designed for the protection of children within the cyberspace, namely Section(s) 15 and 67B of the POCSO Act1 and the IT Act2, respectively.

5. In our judgment, more particularly at paragraph 109, we had this to say: - “109. During the course of hearing, our attention was also drawn to a recent news article that reported how on social media, links to view child pornography were being circulated and sold for anywhere between Rs. 40 to Rs. 5,000. The news report indicates, how social media platforms are rife with child sexual abuse, and gave certain insight about the modus operandi of the distribution of such material on these platforms. It explained how the sellers and distributors of child pornographic material rather than sharing any downloads to such material, would ingeniously only share links to such material instead in lieu of money, so as to circumvent the penal provisions of the POCSO and IT Act, which criminalized only the storage of such material. By indefinitely forwarding links, they completely bypass the requirement of first storing such material onto any device, and similarly those who view such material also only use the links, without ever downloading such material onto their device.”

(Emphasis supplied)

6. We had further taken note of the disquieting failure on part of the social media platforms in reporting such harmful activities to the Special Juvenile Police Unit, as required by the law.

1 The Protection of Children from Sexual Offences Act, 2012 (for short, the “POCSO Act”). 2 The Information Technology Act, 2000 (for short, the “IT Act”).

M.A. Nos. 2553-2554 of 2026 Page 5 of 136 7. In this regard we had this to say: - “256. It has been brought to the notice of this Court that social media intermediaries do not report such cases of child abuse and exploitation to the local authorities specified under POCSO and rather only comply with the requirements stipulated in the MOU. In view of the salutary object and the mandatory character of the provisions of Sections 19 and 20 of the POCSO read with Rule 11 of the POCSO Rules, we are of the considered view, that an intermediary cannot claim exemption from the liability under Section 79 of the IT Act for any third-party information, data, or communication link made available or hosted by it, unless due diligence is conducted by it and compliance is made of these provisions of the POCSO. We are also of the view that such due diligence includes not only removal of child pornographic content but also making an immediate report of such content to the concerned police units in the manner specified under the POCSO Act and the Rules thereunder.

258. In view of the overriding effect of the POCSO Act and the rules thereunder, merely because an intermediary is in compliance of the requirements specified under Section 79 of the IT Act, will not absolve it of any liability under the POCSO, unless it duly complies with the requirements and procedure set out under it, particularly Section 20 of POCSO Act and Rule 11 of the POCSO Rules. It is a settled position of law, that when a statute describes or requires a thing to be done in a particular manner; it should be done in that manner or not at all. Thus, social media intermediaries in addition to reporting the commission or the likely apprehension of commission of any offence under POCSO to the National Centre for Missing & Exploited Children (NCMEC) is also obligated to report the same to authorities specified under Section 19 of POCSO i.e., the Special Juvenile Police Unit (SJPU) or the local police.”

(Emphasis supplied)

M.A. Nos. 2553-2554 of 2026 Page 6 of 136 8. We had clarified in no uncertain terms that such failures would strip the social media platforms of the “Safe Harbour” protection provided by Section 79 of the IT Act.

9. We had hoped that the above inter-alia directions would bring a quietus to the disturbing widespread circulation of CSEAM on the internet.

10. We had hoped that we would not have to, once again, be confronted with the same sad state of affairs.

11. Despite more than two years having gone by since our judgment, it appears that there has been no progress worth the name. If anything, the recent news reports instead reveal an even more unsettling reality when it comes to the safety and wellbeing of our children.

12. We are deeply saddened to note that the news reports placed before us by the applicants flagging alleged incidents of paid promotions of CSEAM on social media platforms through redirect links and websites is only one rare instance of such harmful activities being discovered and brought to light.

M.A. Nos. 2553-2554 of 2026 Page 7 of 136 13. There are millions of more such incidents freely available on social media platforms that may never come to the knowledge of the proper authorities, if no collective action is taken today by all stakeholders.

14. There comes a time when we must ask ourselves, how many more victims of such harmful content must continue to suffer, before our conscience is stirred into making collective effort in the right direction.

15. We are afraid that we cannot afford to wait any longer for an answer. Due to the lack of any earnest initiative shown on the part of either the regulatory authorities or the social media intermediaries for all these years, we are left with no choice but to take matters in our own hands.

16. We cannot emphasize this enough, that there can be no space for nonconsensual sexually exploitative and abusive material on the internet, particularly on platforms that are readily accessible to the most impressionable and vulnerable of our society.

17. Thus, with the assistance from the Union of India through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, respectively, we propose to take the strictest of actions by

M.A. Nos. 2553-2554 of 2026 Page 8 of 136 putting in place a workable framework for a safer future of our children.

18. In this regard, there are certain aspects which we must point out that merit a considered response, and we would like to hear the Union of India on the same.

II. FRAMEWORK FOR THE DETECTION AND REMOVAL OF CSEAM.

A. Advanced Mechanisms for the Detection and Removal of CSEAM

i. Some Problems in the Existing Mechanism.

19. As far as we understand, the current mechanism for the detection and removal of CSEAM relies heavily on individual instances of content being reported and subsequently removed. These reports originate either at the behest of the authorities or the users themselves.

20. Although, various social media intermediaries have deployed their own safeguards for a seamless continued detection and removal of such content, yet what is missing is any form of synergy insofar as detection and removal is concerned, across the internet.

M.A. Nos. 2553-2554 of 2026 Page 9 of 136

21. When one social media platform detects and removes CSEAM, that detection does not automatically result in the same content being flagged and removed from all other social media platforms.

22. It is only when such content is also found by the other platforms, through their own mechanisms and safeguards that, the same comes to be removed.

23. This isolated mechanism of detection delays the removal of CSEAM across different platforms, delays which enable the continued circulation of such content to the various corners of the internet.

24. Even if some social media platforms are coordinating their efforts for the simultaneous removal of CSEAM once so detected by either of one of them, such arrangements are only informal, dependent entirely on which platforms choose to undertake such initiative and for how long.

ii. Matching and Listing of Hash & URL of CSEAM.

25. From what we have been able to understand, the practice that is globally in vogue for the seamless detection and removal of CSEAM is a process termed as “Hash and URL Data Matching & Listing”.

M.A. Nos. 2553-2554 of 2026 Page 10 of 136

26. The process works on a simple principle. Every component of a CSEAM content, be it the video frame or image or multiples of both, carries a unique digital data print identifier in alphanumeric form, which is known as the “Hash” identifier of that material. The hash identifier of any particular content remains unique to it, irrespective of where it is uploaded or by whom.

27. When any content is identified as CSEAM, specialised software is used to extract and generate the hash identifier and the same is added to a consolidated database known as a “Hash List”.

28. This Hash List can then be used to crosscheck all other content, whether on the very same platform or on another. Where a match is found against a particular hash identifier, the algorithm automatically flags and removes that content without the need to rely on the conventional means of detection.

29. However, the above mechanism is not without limitations. Expert insights indicate that a new modus operandi has emerged for circumventing the hash list detection process. This is usually done by manipulating the video frame or imagery of the content, or a

M.A. Nos. 2553-2554 of 2026 Page 11 of 136 combination of both, either by way of resizing it or reformatting it, so as to avoid detection.

30. It is for this reason that “Perceptual Hashing”, an improved process of recent vintage assumes significance. Shorn of the details, this process, from what we understand, combines the original technique of extracting the hash identifier with an additional step of generating the audio-visual characteristics of the content. Characteristics such as colour-coding, object composition, audio cues, etc., are also used to generate the hash identifier for a content detected as CSEAM, which remains unique dehors any manipulation.

31. One another technological measure of similar significance that has caught our attention is URL Listing, which targets indirect links to CSEAM and other harmful content that are merely shared or exchanged on social media platforms without uploading or storing the same on the platform.

32. The news report that has been placed before us by the applicant herein reveals the prevalence of this very practice. It highlighted the circulation and promotion of CSEAM through links which would then

M.A. Nos. 2553-2554 of 2026 Page 12 of 136 redirect users to other websites and platforms where such materials were offered for monetary considerations.

33. “URL Listing” thus, assumes significance. Unlike Hash Listing that generates a unique identifier for the CSEAM content, URL Listing proceeds by generating an identifier for the external location where the CSEAM content is hosted. It extracts all possible unique webaddresses where the CSEAM has been confirmed to have been uploaded, and then uses that data to block any future attempts to access it.

34. Various jurisdictions across the world have, in some form or manner, called for the deployment of one, or a combination of the aforesaid measures, with a view to ensure the effective detection and removal of CSEAM. Country Measures Provision

United States

Hash Matching

18 U.S.C. § 2258C(a)(2) "The elements authorized under paragraph (1) may include hash values or other unique identifiers associated with a specific visual depiction, including an Internet location and any other elements provided in a CyberTipline report that can be used to identify, prevent, curtail, or stop the transmission of child pornography and prevent the online sexual exploitation of children."

URL Listing

M.A. Nos. 2553-2554 of 2026 Page 13 of 136 United Kingdom Hash Matching

Ofcom, Illegal Content Codes of Practice for User-to-User Services, Recommendation ICU C9 "ICU C9.3 The provider should ensure that, where technically feasible, perceptual hash matching technology is used effectively to analyse relevant content to assess whether it is CSAM.

ICU C9.4 The provider should ensure that appropriate measures are taken to swiftly take down (or prevent from being generated, uploaded or shared) detected content that is CSAM [...]"

URL Listing

South Korea

Hash Matching

Enforcement Decree of the Telecommunications Business Act, Article 30- 6(2) “2. Measures to restrict the transmission of search results, such as deleting search results by identifying whether the information the user is searching for corresponds to illegal footage, etc. that has previously been requested for reporting or deletion pursuant to Article 22-5(1) of the Act, by comparing the search term entered by the user with the title, name, etc. of the illegal footage;

3. Measures to restrict the posting of the information after analyzing the characteristics of the information that the user wishes to post, comparing and identifying whether it corresponds to information that has been reviewed and decided by the [Korea Communications Standards Commission] as illegally filmed material, etc. In this case, comparison and identification must be made using any of the following technologies: (a) Technology developed and provided by national organizations; (b) Technology that has passed a performance evaluation conducted within the last two years by an institution or organization determined and notified by the Korea Communications Commission”

URL Listing

Hash Matching Online Safety (Relevant Electronic Services— Class 1A and Class 1B Material) Industry Standard 2024 “19 Detecting and removing known child sexual abuse material (1) This section applies to the following: (a) a pre-assessed relevant electronic service; (b) a Tier 1 relevant electronic service.

(2) The provider of a service must implement appropriate systems, appropriate processes and appropriate technologies to: (a) detect and identify known child sexual abuse material that:

M.A. Nos. 2553-2554 of 2026 Page 14 of 136 (i) is stored on the service; or (ii) is accessible by an end-user in Australia using the service; or (iii) is being or has been accessed or distributed in Australia using the service; and (b) remove known child sexual abuse material from the service as soon as practicable after the provider becomes aware of it.

Note 1: The technologies that the provider may use include hashing technologies and machine learning.”

iii. The Position in India.

35. From what we can discern, no such provision exists in India, requiring social media intermediaries to employ tools for Hash or URL Listing, at least to the same extent as found in other jurisdictions.

36. The closest analogue to any such statutory requirement in India can be found in some parts of Rule(s) 3 and 4 of the IT Rules3. The same reads as under: - “3. (1) Due diligence by an intermediary: (b) the intermediary shall inform its rules and regulations, privacy policy and user agreement to the user in English or any language specified in the Eighth Schedule to the Constitution in the language of his choice and shall make reasonable efforts by itself, and to cause the users of its computer resource to not host, display, upload, modify, publish, transmit, store, update or share any information that,— (i) is obscene, pornographic, paedophilic, invasive of another’s privacy including bodily privacy, insulting

3 The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (for short, the “IT Rules”)

M.A. Nos. 2553-2554 of 2026 Page 15 of 136 or harassing on the basis of gender, racially or ethnically objectionable, relating or encouraging money laundering or gambling, or an online game that causes user harm,] or promoting enmity between different groups on the grounds of religion or caste with the intent to incite violence; (ii) is harmful to child;

3. (3) Due diligence in relation to synthetically generated information: (a) Where an intermediary offers a computer resource which may enable, permit, or facilitate the creation, generation, modification, alteration, publication, transmission, sharing, or dissemination of information as synthetically generated information, it shall ensure that,— (i) it deploys reasonable and appropriate technical measures, including automated tools or other suitable mechanisms, to not allow any user to create, generate, modify, alter, publish, transmit, share, or disseminate, as the case may be, any such synthetically generated information that violates any law for the time being in force, including the Act, Bharatiya Nyaya Sanhita, 2023 (45 of 2023), Protection of Children from Sexual Offences Act, 2012 (32 of 2012), Explosive Substances Act, 1908 (6 of 1908), and includes any such synthetically generated information that,— (I) contains child sexual exploitative and abuse material, non-consensual intimate imagery content, or is obscene, pornographic, paedophilic, invasive of another person’s privacy, including bodily privacy, vulgar, indecent or sexually explicit; or

4. Additional due diligence to be observed by significant social media intermediary and online gaming intermediary. (4) A significant social media intermediary shall deploy appropriate technical measures, including automated tools or

M.A. Nos. 2553-2554 of 2026 Page 16 of 136 other suitable mechanisms to proactively identify information that depicts any act or simulation in any form depicting rape, child sexual abuse or conduct, whether explicit or implicit, or any information which is exactly identical in content to information that has previously been removed or access to which has been disabled on the computer resource of such intermediary under clause (d) of sub-rule (1) of rule 3, and shall display a notice to any user attempting to access such information stating that such information has been identified by the intermediary under the categories referred to in this subrule:

Provided that the measures taken by the intermediary under this sub-rule shall be proportionate having regard to the interests of free speech and expression, privacy of users on the computer resource of such intermediary, including interests protected through the appropriate use of technical measures:

Provided further that such intermediary shall implement mechanisms for appropriate human oversight of measures deployed under this sub-rule, including a periodic review of any automated tools deployed by such intermediary:

Provided also that the review of automated tools under this sub-rule shall evaluate the automated tools having regard to the accuracy and fairness of such tools, the propensity of bias and discrimination in such tools and the impact on privacy and security of such tools.”

(Emphasis supplied)

37. These rules which came to be inserted by the Information Technology Amendment Rules, 2026, although a step in the right direction, yet, fall short as they do not speak of the specific tools and measures a social media intermediary must adopt.

M.A. Nos. 2553-2554 of 2026 Page 17 of 136 38. Rule 3(1) sub-clause (b), inter-alia, requires that intermediaries make reasonable efforts to ensure that their users do not host, upload or disseminate any CSEAM and other non-consensual sexually exploitative and abuse material, including those generated artificially, and to further remove such material under sub-clause (c).

39. Whereas Rule 4(4), inter-alia, requires a “significant social media intermediary” to also deploy “appropriate technical measures” for the detection and removal of CSEAM, including materials which are identical in content to any material that was previously flagged and deleted “on the computer resource of such intermediary”.

40. We would be remiss not to point out that the expression “on the computer resource of such intermediary” used in Rule 4 sub-rule (4) admits of certain ambiguities which need to be addressed.

41. In our considered view, the said expression narrowly confines the extent to which the technical measures must be deployed for the detection and removal of CSEAM.

42. The emphasis placed by Rule 4(4) on only that CSEAM content, which has been either detected or previously removed from the

M.A. Nos. 2553-2554 of 2026 Page 18 of 136 intermediary’s own computer resource, leaves unresolved two possible scenarios. First, the possibility of simultaneous flagging and removal of CSEAM content that was already removed on some other platform. Secondly, CSEAM content that is hosted on an external source and merely circulated on a particular platform via indirect links.

43. To state plainly, under this rule, even if a particular CSEAM was previously detected and removed by one intermediary, there is no corresponding obligation cast upon other intermediaries to automatically look for and remove the same, at least not until, such material happens to also be detected by them in due course of time.

44. This, in our view, confines the entire obligation of detection and removal of CSEAM exclusively to material that has been uploaded, circulated and detected on one intermediary’s own resources.

45. We, prima facie, find this to be a matter of some concern, particularly when there are reported instances of CSEAM being indirectly circulated, and a less than ideal rate at which such material is currently being detected and removed. It is needless to reiterate that every

M.A. Nos. 2553-2554 of 2026 Page 19 of 136 moment of delay in removing such harmful content only serves to add to the certain likelihood of further circulation to other platforms.

46. Even otherwise, the cumulative effect of the above rules is that social media intermediaries are only required to “make reasonable efforts” and “deploy appropriate technical measures” for the proactive detection and removal of CSEAM and other non-consensual sexually exploitative and abusive material from their platforms.

47. We are conscious of the fact that, at the current pace of advancement in technology, it is impractical to statutorily prescribe any particular set of tools and measures for a thriving, safe, and secure cyberspace. That being said, we see no reason why widely used tools and measures of proven mettle cannot be stipulated in the form of periodically revisable guidelines to ensure their uniform and proper adoption by one and all.

48. We do not, for a moment, doubt that certain social media intermediaries may already have employed one or more of the aforementioned tools and measures, or even a combination of all of them. However, the efficacy of such tools depends not only on their

M.A. Nos. 2553-2554 of 2026 Page 20 of 136 deployment by some, but on their proper and uniform adoption by all, and that is precisely what specific guidelines in this regard can ensure.

49. All that we are trying to say is that while a rigid statutory prescription may not be the appropriate course, yet the same does not, however, mean that no guidelines should be put in place.

50. We would, therefore, like to hear from the Union of India on the tools and technological measures that have been put in place by intermediaries for the detection and removal of CSEAM from their platforms, including the use of perceptual hash-matching and URL listing. This is because, in the absence of such information, it would be difficult for us to assess whether the obligation to "make reasonable efforts" is, in practice, being discharged in any meaningful manner. We would further like to hear on the feasibility of a industry-wide use and deployment of such tools, if not already in use. Lastly, we would like the Union of India to come up with some comprehensive guidelines on the tools and technological measures that every intermediary would be expected to deploy for the detection and removal of CSEAM.

M.A. Nos. 2553-2554 of 2026 Page 21 of 136 B. Comprehensive National Database for the Detection and Removal of CSEAM.

i. Need for a National Database for Hash & URL Lists of CSEAM.

51. We must, however, point out that the deployment of these tools cannot be the end of the matter. Unless the hashes and URLs of CSEAM identified by one intermediary are made accessible to all others, the very process of simultaneous flagging and removal of such material across platforms would remain illusory.

52. It is in this context that a national “Hash and URL List Database” assumes significance. As the name suggests, it is a common repository or pool of the hash identifiers and URL lists of all material which has been flagged and confirmed to be CSEAM across all platforms. The database is continuously updated in real time, and made accessible to all intermediaries and law enforcement agencies, to enable a seamless process of detection and removal of CSEAM on a rolling basis.

53. The significance of such a database may best be appreciated by contrasting it with the current state of affairs. At present, each intermediary, at best, maintains its own list of known CSEAM, compiled from what it has encountered on its own platform. The

M.A. Nos. 2553-2554 of 2026 Page 22 of 136 result is a multitude of fragmented lists, each incomplete in itself. The multiplicity in efforts in the detection and removal of CSEAM that we seek to avoid cannot take place without such a database.

54. In other words, intermediaries would be in a position to crosscheck the content on their own platforms against the entire database, and not merely against what they themselves have encountered in the past. It is of note that such a database would not contain the harmful material itself, but only the hash identifiers and URLs by which it may be recognised.

55. There are outstanding examples of such databases that have played a pivotal role in reducing the circulation of CSEAM. Various jurisdictions have entrusted the maintenance of such databases to designated bodies and organisations that verify each entry before its inclusion and ensure that the database remains current. Country Database Maintaining Authority

United States NCMEC Industry Hash Sharing Platform

National Center for Missing & Exploited Children. NCMEC NGO Hash Sharing Platform United Kingdom IWF Image Hash List

Internet Watch Foundation and Home Office, Government of United Kingdom. Child Abuse Image Database Canada Project Arachnid Canadian Centre for Child Protection.

M.A. Nos. 2553-2554 of 2026 Page 23 of 136 Korea Illegally Filmed Material Database Korea Communication Standards Commission

Netherlands Instant Image Identifier and Hash Check Service Centre for Expertise on Online Sexual Child Abuse (EOKM) and the Dutch National Police.

CNCPO "black list" National Center for the Prevention of Child Pornography on the Internet. New Zealand Digital Child Exploitation Filtering System Department of Internal Affairs.

ii. Indian Cyber Crime Coordination Centre’s Sahyog Portal.

56. In this regard, we are given to understand that some progress has taken place in the right direction. The Union of India has already developed and put in place a dedicated platform known as the “Sahyog Portal” to inter-alia streamline and automate the process of reporting and removal of unlawful content including CSEAM.

57. The Indian Cyber Crime Coordination Centre (I4C), the authority designated to manage and maintain the portal, has been onboarding social media intermediaries onto the same, with a view to coordinate the reporting and removal of CSEAM with the police machinery.

58. We acknowledge that the Sahyog Portal is, no doubt, a step in the right direction. It is also not lost on us that the portal, by virtue of having

M.A. Nos. 2553-2554 of 2026 Page 24 of 136 already onboarded a considerable number of intermediaries, may well be the natural foundation upon which a Hash & URL List Database could be built.

59. That being said, we are mindful of the fact that, the portal, in its current form, functions only as a common platform to route individual reports and takedown notices.

60. Our expectations from the portal, however, are much more than what it is, as of now, capable of doing, and we are hopeful that the Union of India shares the same vision.

61. We say so because there is a discernible difference between a common portal that routes individual reports and takedown notices, and one which pools together the hash identifiers and URLs of all material confirmed to be CSEAM. The former acts only upon each instance of CSEAM as and when it is reported. Whereas the latter ensures that such material, once identified, is continuously detected and removed across all platforms, without waiting for it to be reported afresh.

62. We would, therefore, like to know from the Union of India whether it is contemplating the creation of a Hash & URL List Database either

M.A. Nos. 2553-2554 of 2026 Page 25 of 136 within the fold of the Sahyog Portal, or as a standalone repository. If the Sahyog Portal is indeed contemplated to serve such a role, we would like to be apprised of the extent to which, it in its existing form is equipped to do so, and the time by which it can begin to fully function in that role.

iii. Safeguards and Standard Operating Procedure for the Maintenance and Use of Hash & URL List Database.

63. The creation of a Hash & URL List Database of the kind indicated above naturally gives rise to certain attendant concerns, particularly the operation and procedural integrity of the same.

64. If the experiences of existing databases in other jurisdictions is any lodestar, the process by which a particular material comes to be entered into the database as CSEAM, and thereby earmarked for detection and removal, is perhaps the most sensitive of all.

65. From what we have been able to understand, the process by which a hash identifier or URL finds its way into any such database generally unfolds in three distinct stages: -

M.A. Nos. 2553-2554 of 2026 Page 26 of 136 (i) The first step of the process begins with the source of the material. The material which is ultimately entered into the database may come from a variety of sources. It may be reported by a member of the public, flagged by an intermediary on its own platform, forwarded by a law enforcement agency, or discovered by the body maintaining the database in the course of its own proactive search. It is of note, however, that the source of the material, by itself, is of little consequence, except in cases of hash matching, which we shall discuss in the later parts. Irrespective of where it originates, no material is to be mechanically entered into the database merely because it has been reported or flagged as CSEAM. (ii) The second, and perhaps the most crucial stage, is that of assessment, through multiple tiers of verification. This begins with a preliminary screening of the material by specialised software, which makes an initial determination, based on certain characteristics of the material, as to whether it is likely to be CSEAM. The software, however, does not have the final word. At the second tier, the material so flagged is assessed by at least three trained human analysts, who would independently

M.A. Nos. 2553-2554 of 2026 Page 27 of 136 determine whether the same constitutes CSEAM. This combination of software and human verification minimises erroneous inclusions and ensures that the database remains reliable to act upon. (iii) It is only upon such material being confirmed to be CSEAM that the third stage commences, wherein the hash identifier and/or the URL of the material is generated and entered into the database. This entry is then made available to all intermediaries and law enforcement agencies to cross-check against and remove any content matching the same.

66. The above process is to be carried out on a continuous basis, and the database updated at regular intervals. The entries within the database are to be made through encrypted channels and strictly confined to the hash identifier and/or URL of the material confirmed to be CSEAM. At no point should the CSEAM itself be stored within the database.

a. Procedural Difference viz-a-viz CSEAM of ‘Unknown Origin’ and ‘Known Origin’

M.A. Nos. 2553-2554 of 2026 Page 28 of 136 67. Since the above exercise for the detection and removal of CSEAM through means of ‘Hash Matching’ would be over and above the existing ordinary process of detection and removal, namely by way of due diligence and receipt of reports, certain additional aspects emerge that require clarification.

68. While the object of the above two parallel processes remains the same, that being the removal of CSEAM, yet there are certain differences between the two, which must be reflected in the standard operating procedure that would eventually come to be.

69. For this, we propose to draw a distinction between removal of CSEAM of “Unknown Origin” and “Known Origin”.

70. CSEAM of “Unknown Origin” would be all such material that has no corresponding match in the Hash & URL List Database but nevertheless was detected and subsequently removed on the basis of the intermediary’s own tools and mechanisms. In other words, that harmful material, which was found to be CSEAM on the basis of either reports received or as a result of the intermediary’s own due diligence.

M.A. Nos. 2553-2554 of 2026 Page 29 of 136 71. Conversely, CSEAM of “Known Origin” would include all such material that is removed by an intermediary pursuant to a match being found against an already existing entry in the Hash & URL List Database.

72. The distinction is not merely one of nomenclature. It carries with it a significant difference in the procedure that an intermediary would be required to follow, as well as in the obligations that would ensue.

73. Where an intermediary removes CSEAM of “Unknown Origin”, it would be expected that the said decision was preceded by some verification and due diligence on its part.

74. Upon such removal, the intermediary would be required to generate the hash & URL identifiers of such CSEAM for its own internal use, in order to remove all other instances of the material from its platform, pending its verification and inclusion in the national database.

75. In addition, the intermediary would also be obligated to promptly report the same to the proper authorities under the relevant law, and also to the designated body for the Hash & URL List Database, if not the same.

M.A. Nos. 2553-2554 of 2026 Page 30 of 136

76. In the former, this would necessarily entail reporting such CSEAM to the SJPU4, the local police or the cyber-crime portal, as required by Rule 11 of the POCSO Rules5. While in the latter, the report would be forwarded to the authority entrusted with the maintenance of the Hash & URL List Database.

77. Upon receipt, the authority would, in turn, independently verify the flagged content, in the manner indicated above6, and in accordance with such procedure as may be prescribed.

78. Once the flagged content is confirmed to be CSEAM, the hash and/or URL identifier of the same would be entered into the database and made available to all other intermediaries, who would then detect and remove the same, following the process applicable to CSEAM of “Known Origin” which we shall now discuss.

79. Where an intermediary finds a match against an entry within the Hash & URL List Database i.e., CSEAM of “Known Origin”, the intermediary

4 The Special Juvenile Police Unit (for short, the “SJPU”). 5 The Protection of Children from Sexual Offences Rules, 2020 (for short, the “POCSO Rules”. 6 The “Three-Step” Process discussed in Paragraph 66.

M.A. Nos. 2553-2554 of 2026 Page 31 of 136 would be required to immediately disable and remove the same, without awaiting any further verification at its end.

80. However, we acknowledge that no database, irrespective of how carefully it is maintained, is immune from any error.

81. Thus, with a view to obviate the possibility of any inaccuracies, the intermediaries would still be obliged to report all such removals, at least to the authority maintaining the Hash & URL List database.

82. Since this exercise is only to ensure the reliability of the database and the removals in consequence thereof, we see no good reason for applying the same threshold of immediacy to such reporting as required in the case of CSEAM of “Unknown Origin”. The intermediaries may, instead, furnish the details of all such removals in a consolidated form on a weekly basis.

83. These reports would necessarily be required to be reviewed by both the intermediaries and the authorities by cross-verifying whether the material removed did, in fact, correspond to the entry against which the match was found. Such an exercise would serve as a continuous check upon the accuracy of the database itself. With it, the authorities

M.A. Nos. 2553-2554 of 2026 Page 32 of 136 would be in a position to correct or de-list any inaccurate entry at the earliest.

84. An entry that is wrongly included, or a hash identifier that begins to throw up matches against lawful content, would come to light only if the removals made pursuant to it are periodically reported and reviewed. It would also minimise the risk of misuse of the database to remove lawful content from social media platforms.

b. Requirement of Proper Notice and Grievance Redressal

85. One another aspect that we deem necessary to clarify is the form and manner of notice that an intermediary is required to give in the event of removal of any content as CSEAM.

86. In every instance where an intermediary removes any material as CSEAM, it would be required to prominently display a notice in place of such material on its platform. The notice must, inter-alia, indicate whether such removal was pursuant to the intermediary’s own detection, or on account of a match found against a known entry in the Hash & URL List Database.

M.A. Nos. 2553-2554 of 2026 Page 33 of 136

87. This is crucial for ensuring that any person aggrieved by such removal, believing the same to be erroneous, is well aware of the proper authority before whom it may be challenged.

88. Where the removal is based on the intermediary’s own detection, the challenge would lie against the intermediary under the grievance redressal mechanism, and thereafter, if necessary, before the Grievance Appellate Committee, as provided in Rules 3(2) and 3A of the IT Rules, respectively.

89. Where, however, the removal is for reasons of a known match with the Hash & URL List Database, the challenge would, in substance, lie against the correctness of such entry. The same would, therefore, have to be raised before the authority maintaining the database.

90. Thus, without proper notice of the reasons for removal, any person aggrieved would be made to run from pillar to post in search of the appropriate mechanism for redressal.

91. In this regard, it would be apposite to refer to Rule 4(4) of the IT Rules, which already requires a significant social media intermediary to

M.A. Nos. 2553-2554 of 2026 Page 34 of 136 display a notice to any user attempting to access information identified under the said rule. What we have in mind is only a natural extension of the same.

92. However, we make it abundantly clear that such notice shall be without prejudice to the obligation of the intermediary to preserve the material and all associated data, and to report the same to the proper authorities. Such notice shall also not reproduce or describe the material removed.

c. Additional Safeguards Required for the use of Hash & URL List Database.

93. Apart from the above, certain additional safeguards are also required to be put in place for the proper operation of such a database.

94. This is because an erroneous entry into the database would not only result in the removal of lawful content from one platform alone, but from every platform connected to the database.

95. This assumes all the more significance in the case of CSEAM of Known Origin, where the removal is triggered solely on the basis of a prior entry into the database. The removal follows automatically the

M.A. Nos. 2553-2554 of 2026 Page 35 of 136 moment a match is found, with no occasion for the intermediary to await any independent determination apropos the material.

96. Thus, it goes without saying that the use of Hash & URL List Database indicated above must be accompanied by adequate safeguards, some of which we may indicate, with the actual modalities left to be worked out by the Union of India. They are: - (i) First, each entry into the database must be preceded by multiple tiers of independent verification of the material. The preliminary screening may be through specialised software, but the final assessment must mandatorily be made by two or three trained human analysts, each of whom would independently determine whether the same constitutes CSEAM. (ii) Secondly, for each entry, the authority managing the database must maintain a report of the findings recorded in the course of its assessment. Such report must also bear the digital signatures of the analysts concerned, to ensure accountability for every inclusion. (iii) Thirdly, a complete record must also be kept by such authority of every entry in the database, the source from which the material originated, the analysts who assessed the same, their

M.A. Nos. 2553-2554 of 2026 Page 36 of 136 findings, and the date of its entry. Likewise, each and every access to the database, whether by an intermediary or an agency, must be logged. Such records must be preserved in a manner that permits the entries to be audited, and any lapse to be traced to its source. (iv) Fourthly, the Hash & URL List Database, and the entries made therein, must be subjected to periodic independent audits, the findings of which ought to be placed in the public domain, at least in an aggregated form. (v) Fifthly, where it is found that a particular hash identifier or URL came to be wrongly entered into the database, the same must be promptly removed therefrom. Such removal must also be communicated to all intermediaries, so that the content removed in consequence of such wrong entry is restored with immediate effect. (vi) Sixthly, as stated earlier, there must be an effective mechanism by which any person aggrieved by the removal of content may raise a complaint, not merely with the intermediary, but also with the authority managing the database. The latter is important, where the removal is on account of a match with the

M.A. Nos. 2553-2554 of 2026 Page 37 of 136 database. Since the intermediary would be merely giving effect to an entry made by the authority, it would be of little use to direct the aggrieved person to the intermediary alone.

97. Having regard to all the aforesaid, we would like the Union of India to frame a comprehensive Standard Operating Procedure for the use and operation of the Hash & URL List Database. It must delineate the roles of the authority managing the database, the intermediaries and the law enforcement agencies, and incorporate the safeguards indicated hereinabove.

C. Mechanisms for the Reporting of CSEAM.

98. The efficacy of any mechanism for the removal of CSEAM is ultimately measured by the process and the time within which such material is reported and consequently removed.

99. In Just Rights (supra), we had discussed at length the significance that the law attaches to the reporting of CSEAM, particularly under Section(s) 15, 19, 20 and 21 of the POCSO Act, respectively.

M.A. Nos. 2553-2554 of 2026 Page 38 of 136 100. We observed that: - “87. [...] In other words, the actus reus that is penalized under Section 15 sub-section (1) is the failure to delete, destroy or report any child pornography that was stored or in possession of any person with an intention to share or transmit the same. [...] xxx

90. On the other hand, the mens rea which is required to constitute an offence under Section 15(1) is the intent to share or transmit a pornographic material involving a child, and the said intention is to be gathered or gauged from the actus reus itself i.e., by culling out the manner in which there was an omission to delete, destroy or report such a material or the reason behind the same. [...] Thus, it is the manner in which along with the attending circumstances attributable to the failure to delete, destroy or report that must sufficiently be indicative of the intent to share or transmit any material.

122. Thus, we are of the considered view that any form of intangible or constructive possession of any child pornographic material will also amount to "possession" under Section 15 of the POCSO in terms of the Doctrine of Constructive Possession. There is no requirement of a physical or tangible "storage" or "possession" of such material in Section 15 of the POCSO. We may clarify with a view to obviate any confusion that, where any child pornographic material is in the constructive possession of an accused, there the failure or omission to report the same would constitute the requisite actus-reus for the purposes of Section 15 sub-section (1) of POCSO.

123. [...] Thus, when it comes to constructive possession of an accused, it is the failure or omission to report that constitutes the requisite actus-reus for the purposes of Section 15 subsection (1) of POCSO.

250. Section 19 read with 20 & 21 of the POCSO is one such step towards recognizing this collective responsibility of the

M.A. Nos. 2553-2554 of 2026 Page 39 of 136 society in curtailing the issue of abuse and exploitation of children. Section 19 places an obligation on any person who has an apprehension that an offence under POCSO is likely to be committed or has knowledge that such an offence has been committed, to report and provide information about the same to the Special Juvenile Police Unit or the local police. Section 19 further delineates the process and procedure in which such information or report has to be recorded by the authorities, and the course of action to be adopted. Section 20 extends such obligation to any and all personnel of media, hotels, hospitals, clubs or studios etc., to mandatorily report and provide information about any material or object which is sexually exploitative of a child (including pornographic, sexuallyrelated or making obscene representation of a child or children) through the use of any medium to the authorities mentioned above. Any failure to do so, either in terms of Section 19 or 21 of POCSO shall be liable to be punished with imprisonment upto 6-months or fine or both. Further, any failure on the part of any employer or supervisor in reporting the commission of any offence or its apprehension in respect of a subordinate under his control, will also be liable to be punished with imprisonment which may extend to 1-year and also fine.

251. Thus, it is evident that, to achieve the avowed purpose, a legal obligation has been imposed under the POCSO Act on any person to report an offence to the relevant authorities specified therein if they have knowledge that an offence under the Act has been committed. This obligation also extends to individuals who have reason to believe that an offence under the Act is likely to be committed. In addition to imposing this legal duty under Section 19, the legislature being in seisin of the paramount importance in collectively addressing the problems of child abuse and exploitation, deemed it expedient to make the failure to discharge this obligation punishable under Section 21 of the Act. Such provisions have been inserted with a view to ensure strict compliance of the provisions under the POCSO and thereby to ensure that the tender age of children is not being abused and their childhood and youth is protected against exploitation.

M.A. Nos. 2553-2554 of 2026 Page 40 of 136 222. We summarize our final conclusion as under: -

(II) Sub-section (1) of Section 15 penalizes the failure to delete, destroy or report any child pornographic material that has been found to be stored or in possession of any person with an intention to share or transmit the same. The mens-rea or the intention required under this provision is to be gathered from the actus reus itself i.e., it must be determined from the manner in which such material is stored or possessed and the circumstances in which the same was not deleted, destroyed or reported. To constitute an offence under this provision the circumstances must sufficiently indicate the intention on the part of the accused to share or transmit such material.”

(Emphasis supplied)

101. In Just Rights (supra) our attention was also drawn towards a serious lapse on the part of some social media intermediaries in not reporting such harmful material in the manner prescribed by the law. The same reads as under: - “25. She would further submit that Section 19 of the POCSO imposes mandatory reporting of an offence under the Act if there was an apprehension that such offence is likely to be committed or knowledge that such an offence has been committed. It was pointed out that the failure to discharge this obligation by itself is punishable under Section 21 of the POCSO. She pointed out that the social media platforms claim to report such instances to the National Center for Missing and Exploited Children (NCMEC), a US-based NGO, which then reports them to the National Crime Records Bureau (NCRB). However, Section 19 mandates reporting such cases to the Special Juvenile Police Unit (SJPU) or the Special Police.

M.A. Nos. 2553-2554 of 2026 Page 41 of 136 Therefore, reporting to an NGO cannot absolve the social media platforms of its liability under Section 21 of the POCSO.

256. It has been brought to the notice of this Court that social media intermediaries do not report such cases of child abuse and exploitation to the local authorities specified under POCSO and rather only comply with the requirements stipulated in the MOU. [...]

(Emphasis supplied)

102. In this regard, we had this to say: - “256. [...] In view of the salutary object and the mandatory character of the provisions of Sections 19 and 20 of the POCSO read with Rule 11 of the POCSO Rules, we are of the considered view, that an intermediary cannot claim exemption from the liability under Section 79 of the IT Act for any thirdparty information, data, or communication link made available or hosted by it, unless due diligence is conducted by it and compliance is made of these provisions of the POCSO. We are also of the view that such due diligence includes not only removal of child pornographic content but also making an immediate report of such content to the concerned police units in the manner specified under the POCSO Act and the Rules thereunder. xxx

258. In view of the overriding effect of the POCSO Act and the rules thereunder, merely because an intermediary is in compliance of the requirements specified under Section 79 of the IT Act, will not absolve it of any liability under the POCSO, unless it duly complies with the requirements and procedure set out under it, particularly Section 20 of POCSO Act and Rule 11 of the POCSO Rules. It is a settled position of law, that when a statute describes or requires a thing to be done in a particular manner; it should be done in that manner or not at all. Thus, social media intermediaries in addition to reporting the commission or the likely apprehension of commission of any offence under POCSO to the National

M.A. Nos. 2553-2554 of 2026 Page 42 of 136 Centre for Missing & Exploited Children (NCMEC) is also obligated to report the same to authorities specified under Section 19 of POCSO i.e., the Special Juvenile Police Unit (SJPU) or the local police.”

(Emphasis supplied)

103. In view of the foregoing, we had, inter alia, put a suggestion for creating a more convenient mechanism for the general public to report any instance of CSEAM. The same reads as under: - “260. We propose to suggest the following to the Union of India in its Ministry of Women and Child Development:

(ix) We urge the Parliament to consider amending Section 15 sub section (1) of POCSO so as to make it more convenient for the general public to report by way of an online portal, any instance of storage or possession of CSEAM to the specified authorities for the purpose of the said provision.”

(Emphasis supplied)

i. Some Lacunas in the Existing Mechanism.

104. Under the IT Rules, more particularly, Rule 3(1)(d), an intermediary is required to remove or disable access to any unlawful content within three hours of receiving an order of a court or a reasoned intimation from the appropriate Government in that regard. 105. Rule 3(2)(b) of the IT Rules separately requires an intermediary to take all “reasonable and practicable measures” to remove any sexually

M.A. Nos. 2553-2554 of 2026 Page 43 of 136 exploitative or abusive content prima-facie depicting any individual, within two hours from the receipt of a complaint made by such individual or any person on his behalf. Rule 3(2)(c) of the IT Rules further requires the intermediaries to implement a mechanism for the receipt of such complaints.

106. However, we find that none of the above timelines has been specifically made for the removal of CSEAM. Rule 3(2)(b) only comes into the picture, when a complaint is made by, or on behalf of, the individual depicted in the content.

107. A child victim is seldom in a position to know of, let alone report, the circulation of such material. A report made by any other member of the public who comes across CSEAM does not, squarely fall within the ambit of Rule 3(2)(b).

108. Such complaints are relegated to the ordinary grievance redressal mechanism under Rule 3(2)(a). Complaints made under the said mechanism are required to be resolved within a period of seven days from the receipt of such complaint.

M.A. Nos. 2553-2554 of 2026 Page 44 of 136 109. Where, however, such complaint inter-alia pertains to any sexually exploitative or abusive content, the same, as per the Proviso to Rule 3(2)(a), must be resolved within thirty-six hours of receipt of such complaint.

110. Although, the IT Rules have prescribed a reasonable timeline within which the intermediaries must remove or disable any material as CSEAM, yet, experience has shown that, compliance with the same has been far from satisfactory.

111. The principal reasons for this state of affairs are twofold. First, the cumbersome nature of the reporting mechanism, which makes it difficult for the general public to raise complaints. Secondly, the lessthan-ideal rate of resolution, as complaints pertaining to CSEAM are left to compete with complaints of every other nature for the attention of the Grievance Officers.

112. What is also of concern is that, insofar as intermediaries are concerned, no timeline has been prescribed within which they must report any CSEAM to the authorities specified under Rule 11 of the POCSO Rules.

M.A. Nos. 2553-2554 of 2026 Page 45 of 136

ii. Streamlining and Standardization of Reporting Mechanism.

113. We are mindful of the fact that significant efforts have been made by social media intermediaries in improving the manner in which users report any content, and the process by which the same is dealt with.

114. Yet certain aspects still remain which require attention, to ensure a responsive mechanism for raising and resolving reports made by users of such platforms.

115. Rule 3(2)(a) of the IT Rules inter-alia requires an intermediary to prominently display, on the home page or screen of its website or application, as the case may be, the requisite details of its grievance officer as well as the mechanism through which the users may raise their complaints.

116. It appears, however, that compliance with even this basic requirement has been uneven. There have been instances where, despite repeated

M.A. Nos. 2553-2554 of 2026 Page 46 of 136 reminders, the details of the grievance redressal mechanism and the grievance officer have not been published.

117. In other instances, the details so published have been found to be outdated or the instructions for raising a complaint not reflecting the mechanism actually in place.

118. That apart, we are also given to understand that certain intermediaries have created multiple convoluted channels through which a complaint may be raised. A user seeking to report any content, is often presented with a range of overlapping and often confusing categories, such as "violation of community guidelines", "exploitation", "endangerment of safety", “privacy concerns” or "illegal activity", each accompanied by a separate mechanism of its own.

119. This is compounded further by a complete lack of uniformity in the reporting mechanisms across intermediaries. Each intermediary has devised its own categories, its own terminology, and its own channels for reporting, with no common standard governing any of them. What one platform describes as “child safety” may be described by another

M.A. Nos. 2553-2554 of 2026 Page 47 of 136 as “sexual exploitation”, and by yet another as merely “inappropriate content”.

120. The seriousness with which any report is dealt with is left to turn on the semantics and jargon, rather than on the nature of the content itself.

121. This has only led to unnecessary complexity in the grievance redressal mechanism, which, instead of facilitating reporting, only serves to confuse users and deter them from effectively using it.

122. In the limited cases where a complaint is actually lodged through one or more of the above channels, the same more often than not is closed on the ground that it ought to have been made through another mechanism. The user is then expected to begin afresh, often without being told which channel would be the appropriate one. In matters involving CSEAM, where every hour of delay aids circulation, such an approach is wholly unacceptable.

M.A. Nos. 2553-2554 of 2026 Page 48 of 136 123. Another concern that has been brought to our notice is that certain reporting mechanisms often insist on personal details from the users. This creates unnecessary reluctance in the mind of those who merely wish to flag CSEAM, and as a result often choose not to report the same.

124. In our view, a distinct and clearly labelled category must be created through which CSEAM may be reported by the users. The nomenclature of such category must be simple and readily understandable by a person of ordinary prudence, irrespective of his age, literacy or familiarity with technology. The nomenclature must leave no room for doubt as to the nature of the content sought to be reported.

125. The mechanism through which such reports may be raised must also be accessible in no more than two steps from the content, profile, group or link in question. Such mechanism must also be uniform across all intermediaries and platforms.

M.A. Nos. 2553-2554 of 2026 Page 49 of 136 126. The reporting mechanism must not insist upon any unnecessary or personal details from the user. The anonymity of the person reporting must be maintained at all stages, and under no circumstances must the identity of such person be disclosed.

127. Every report must be acknowledged by the intermediary upon receipt and be accompanied by a reference number through which the status of the same, and the action taken thereon may be tracked.

iii. Efficacy of the Grievance Redressal Mechanism relating to CSEAM.

128. A reporting mechanism, however accessible, is not an end in itself. It’s worth lies not in the number of complaints it is able to receive, but in the number of complaints it is able to resolve properly.

129. A report which is lodged with ease, but is thereafter dealt with in a perfunctory manner, would leave the user no better off than if no report had been made at all.

130. The news report placed before us by the applicants reveals precisely this failure. It notes that, in some instances, despite reporting the

M.A. Nos. 2553-2554 of 2026 Page 50 of 136 CSEAM content, the review mechanisms, upon assessment, held the same as not falling foul of the intermediary’s “standards”, and thus, allowed it to continue in circulation. The relevant excerpts read as under: - “TTP said that it tried reporting ads via Meta's own reporting system and that of the 84 ads that ran in India, they were able to report 55. Meta only gives the option of reporting ads when they are live.”

“For 43 of these, TTP got a reply that said, "We've taken a look and found that this ad doesn't go against our Advertising Standards."

(Emphasis supplied)

131. If the “standards” applied by intermediaries in reviewing any reported CSEAM content are such that it permits the same to continue circulating, then this, in our view, is a matter of grave concern, and requires revisiting these “standards”.

a. Misconception on what constitutes “CSEAM” and Misreading of our decision in Just Rights (supra).

132. The news report placed before us reveals that, although most of the reported advertisements depicted photos and videos of children engaged in “graphic sexual acts”, yet, some of them, did not explicitly contain any such material.

M.A. Nos. 2553-2554 of 2026 Page 51 of 136

133. Instead, these advertisements, to avoid detection and consequent removal, promoted tools and applications capable of manipulating such photos and videos in order to create sexually exploitative and abusive material, without any such depiction in the advertisement itself.

134. It appears that it is these advertisements which, upon assessment by the intermediary, were held to not be violative of its “advertising standards”, possibly for the aforesaid reason, that they did not explicitly contain any sexually exploitive or abusive content.

135. If true, we, prima-facie, find the same to be an egregious error on the part of intermediaries in their understanding of what constitutes CSEAM.

136. In Just Rights (supra), we had this to say: - “227. The term "child sexual exploitation and abuse material" or “CSEAM” more accurately reflects the reality that these images and videos are not merely pornographic but are records of incidents, where a child has either been sexually exploited and abused or where any abuse of children has been portrayed through any self-generated visual depiction.”

M.A. Nos. 2553-2554 of 2026 Page 52 of 136 137. Although, in Just Rights (supra) we had held that CSEAM means and includes images and videos “where a child has either been sexually exploited and abused or where any abuse of children has been portrayed through any self-generated visual depiction”, yet the said observations must be understood in the proper context in which they were made.

138. The emphasis placed by us in Just Rights (supra) upon a visual depiction of sexual exploitation or abuse of a child, for any material to constitute CSEAM, was made only in respect of the penal provisions under the POCSO Act.

139. This is because the POCSO Act, being a penal statute that applies to intermediaries and individuals alike, must be construed strictly. Any criminal liability under the said Act cannot be fastened in the absence of an actus reus; hence, the above emphasis on visual depiction.

140. However, the IT Act and the rules framed thereunder, stand on a different footing. Although the IT Act does prescribe certain offences, yet, it is not a penal statute in its entirety. A substantial part of it,

M.A. Nos. 2553-2554 of 2026 Page 53 of 136 together with the IT Rules, is regulatory in nature, and governs the conduct of intermediaries.

141. The obligations of intermediaries thereunder are, consequently, much broader in their sweep. An intermediary is expected not merely to remove material which explicitly depicts the sexual exploitation or abuse of a child, but to prevent any such harm from being uploaded, hosted, promoted or circulated on its platform in the first place.

142. Mindful of the above distinction, this Court, in Just Rights (supra), categorically explained the contrast between what is sought to be penalized under Section 15 of the POCSO Act and Section 67B of the IT Act, which the intermediaries appear to have lost sight of.

143. In Just Rights (supra) we had held that Section 67B of the IT Act is a comprehensive provision designed to address and penalize the various electronic forms of exploitation and abuse of children online.

144. We explained that the said provision not only punishes the electronic dissemination of child pornographic material, but also the creation,

M.A. Nos. 2553-2554 of 2026 Page 54 of 136 possession, propagation and consumption of such material as-well as the different types of direct and indirect acts of online sexual denigration and exploitation of the vulnerable age of children.

145. The relevant observations read as under: - “151. From the aforesaid, it is clear that Section 67B of the IT Act is a comprehensive provision designed to address and penalize the various electronic forms of exploitation and abuse of children online. It not only punishes the electronic dissemination of child pornographic material, but also the creation, possession, propagation and consumption of such material as-well as the different types of direct and indirect acts of online sexual denigration and exploitation of the vulnerable age of children.”

146. We explained how the scope of Section 67B sub-section (b) of the IT Act is far wider in its sweep. We said that “material” for the purpose of this provision, includes not only content depicting children in sexually explicit acts but also those involving children in any “obscene or indecent contexts”.

147. We further explained how Section 67B sub-section (b) inter-alia penalizes even the advertising, promotion, exchange or distribution of any material that depicts children in any obscene or indecent or sexually explicit manner.

M.A. Nos. 2553-2554 of 2026 Page 55 of 136 148. We held that even the act of facilitating or propagating the circulation or dissemination of such material through advertisements or promotions from any computer resource on the internet, would fall within the purview of the said provision.

149. The relevant observations read as under: - “(ii) Section 67B sub-section (b): a. It penalizes the creation of any text or image-based content in any electronic form, that depict children in any obscene or indecent or sexually explicit manner. It further penalizes the collection, solicitation, browsing i.e., online viewing, or downloading of such material. Thus, even the mere viewing of any child pornographic material that is stored in a mobile phone would tantamount to ‘browsing’ of such material in electronic form. Lastly, it also penalizes the advertising, promotion, exchange or distribution of any such material. Here again, what is punishable is only the actual commission of any of the above-mentioned acts.

b. The scope of Section 67B sub-section (b), is more expansive than the preceding sub-section because, (i) first, the term ‘material’ here includes any electronic content depicting children in sexually explicit acts as well as in obscene or indecent contexts, and (ii) secondly, the actus reus encompasses not just the act of disseminating but also the acts of creating, propagating, or engaging with or using such material.

c. In other words, Section 67B sub-section (b) penalizes the actual commission of any of the following: i. the act of producing or creating any text or digital image based electronic material (incl. videos) that depict children in any obscene, indecent or sexually explicit manner;

M.A. Nos. 2553-2554 of 2026 Page 56 of 136 ii. the act of engaging or using such material by way of collecting, browsing, accessing, downloading, saving, seeking, actively searching such material from any computer resource, and; iii. the act of facilitating or propagating the circulation or dissemination of such material by advertising, promoting, exchanging or sharing, distributing or offering for sale such material from any computer resource on the internet.

(Emphasis supplied)

150. We also explained how Section 67B sub-section (d) of the IT Act penalizes any form or manner of facilitation of abuse of children online. We said that the said provision penalizes all forms of degradation, exploitation, or abuse of children on any online platform.

151. We held that any act, either direct or indirect, that has the propensity or likelihood to aid, enable or support the online abuse of children in any obscene, indecent, or lewd fashion would be punishable under the said provision.

152. The relevant observations read as under: - “(iv) Section 67B sub-section (d): a. Section 67B sub-section (d) penalizes any form or manner of facilitation of abuse of children, online i.e., it penalizes any form of degradation, exploitation, or abuse of children on any online platform. The actus reus punishable under the said provision is the doing, aiding or abetting of any act,

M.A. Nos. 2553-2554 of 2026 Page 57 of 136 either directly or indirectly that would facilitate or enable the abuse of children online in any indecent, lascivious or prurient manner.

b. It is pertinent to note, that under Section 67B sub-section (d) there is no requirement that the act in question must have been done only with an intention to facilitate the abuse of children online. What is rather required to constitute an offence under the said provision is that the act must be such which likely would facilitate the abuse of children online.

c. In other words, what is penalized is any act that has the propensity or likelihood to aid, enable or support the online abuse of children in any obscene, indecent, or lewd fashion.

(Emphasis supplied)

153. We further cautioned that Section(s) 67, 67A and 67B of the IT Act are a complete code, and must be construed in a purposive manner that suppresses the mischief and advances the remedy, so as to ensure that the legislative intent of penalizing the various forms of cyber-offences relating to children is not defeated by a narrow construction of these provisions. The same reads as under: - “153. Thus, Section(s) 67, 67A and 67B of the IT Act being a complete code, ought to be interpreted in a purposive manner that suppresses the mischief and advances the remedy and ensures that the legislative intent of penalizing the various forms of cyber-offences relating to children and the use of obscene / pornographic material through electronic means is not defeated by a narrow construction of these provisions.”

154. It is thus abundantly clear that CSEAM is not confined to only a “visual depiction” within the meaning of the POCSO Act.

M.A. Nos. 2553-2554 of 2026 Page 58 of 136

155. For the purposes of the IT Act and the Rules thereunder, CSEAM encompasses every form of electronic material that is harmful to children, including any material having the propensity or likelihood to facilitate, propagate or enable their exploitation and abuse.

156. This would include any electronic material which facilitates, aids, promotes or enables the creation, circulation or consumption of any material which is sexually exploitative, abusive or is otherwise harmful to a child, even if the same contains no explicit visual depiction.

157. The obligations of the intermediaries for the detection and removal of CSEAM must, therefore, also be construed accordingly.

158. The IT Rules themselves make this abundantly clear. Rule 3(1)(b) requires an intermediary to make reasonable efforts to ensure that its users do not host, display, upload, publish, transmit or share any information that is, inter-alia, harmful to a child.

M.A. Nos. 2553-2554 of 2026 Page 59 of 136 159. Rule 4(4), in turn, requires significant intermediaries to identify any material that depicts sexually exploitation or abuse of a child, "whether explicit or implicit", for appropriate action.

160. None of these provisions confine the obligations of the intermediaries only to materials which explicitly depict the sexual exploitation or abuse of a child.

161. An advertisement or promotion cannot escape the rigours of the IT Act and the IT Rules merely because it does not itself contain any depiction of a child.

162. Where an advertisement promotes a tool or an application which is capable of manipulating photos and videos of children into sexually exploitative and abusive material, the same facilitates the very creation of CSEAM, and thus, would squarely fall within the ambit of Section 67B sub-section (d) of the IT Act, as held in Just Rights (supra). Such content would equally attract the rigours of Rule 3(1)(b) of the IT Rules for being “harmful to child”.

163. Thus, advertisements and promotions which, though contain no such depiction themselves, and instead direct users through links or

M.A. Nos. 2553-2554 of 2026 Page 60 of 136 redirections to websites and platforms where CSEAM is hosted or offered, are still, in substance an advertisement of CSEAM itself.

164. We may once again remind one and all that the absence of any explicit depiction in such advertisements is not a mere happenstance. It is, more often than not, a deliberate design to escape detection. In Just Rights (supra), we had taken note of precisely this modus operandi, whereby indirect links to such material were circulated and shared in order to avoid detection and removal. At the cost of repetition, we once again reproduce the relevant observations made by us: - “109. During the course of hearing, our attention was also drawn to a recent news article that reported how on social media, links to view child pornography were being circulated and sold for anywhere between Rs. 40 to Rs. 5,000. The news report indicates, how social media platforms are rife with child sexual abuse, and gave certain insight about the modus operandi of the distribution of such material on these platforms. It explained how the sellers and distributors of child pornographic material rather than sharing any downloads to such material, would ingeniously only share links to such material instead in lieu of money, so as to circumvent the penal provisions of the POCSO and IT Act, which criminalized only the storage of such material. By indefinitely forwarding links, they completely bypass the requirement of first storing such material onto any device, and similarly those who view such material also only use the links, without ever downloading such material onto their device.

222. We summarize our final conclusion as under: -

M.A. Nos. 2553-2554 of 2026 Page 61 of 136 (IX) Section 67B of the IT Act is a comprehensive provision designed to address and penalize the various electronic forms of exploitation and abuse of children online. It not only punishes the electronic dissemination of child pornographic material, but also the creation, possession, propagation and consumption of such material as-well as the different types of direct and indirect acts of online sexual denigration and exploitation of the vulnerable age of children. Section(s) 67, 67A and 67B respectively of the IT Act being a complete code, ought to be interpreted in a purposive manner that suppresses the mischief and advances the remedy and ensures that the legislative intent of penalizing the various forms of cyber-offences relating to children and the use of obscene / pornographic material through electronic means is not defeated by a narrow construction of these provisions.”

(Emphasis supplied)

165. Thus, the assessment of any content for determining if the same is CSEAM cannot be confined to only a surface level review. Intermediaries must look at the content as a whole, including the text, captions, keywords, links and the function of the tool or application being promoted, in order to determine whether the same facilitates or has the propensity to result in the exploitation or abuse of children.

M.A. Nos. 2553-2554 of 2026 Page 62 of 136 166. Where an advertisement, by its content, context or the manner in which it is held out, promotes or provides the use of any tool or application capable of sexually exploiting or abusing children, the same cannot be permitted to remain on any platform under the guise of conformity with "advertising standards".

167. It follows that the community guidelines and "advertising standards" of every intermediary must be brought in line to suppress such mischief, and the persons entrusted with the review of reported content must be trained accordingly. Content of this nature must also be capable of being reported under the distinct category for CSEAM as discussed in the earlier parts of this judgment.

168. We would, therefore, like the Union of India to indicate the measures it proposes to undertake to ensure that the standards applied by intermediaries in reviewing content and advertisements accurately covers all form of CSEAM, direct or indirect, as discussed above. We would also like the Union of India to issue comprehensive guidelines or advisories to all intermediaries in this regard.

M.A. Nos. 2553-2554 of 2026 Page 63 of 136 b. Dedicated Grievance Officers for managing CSEAM and reports related thereto.

169. It also appears that despite proper grievance redressal mechanisms being put in place by the IT Act and the rules framed thereunder, the efficacy of the same is, to a considerable extent, constrained due to the nature of responsibilities entrusted to a grievance officer, which often exceed what they can reasonably discharge within the timelines prescribed.

170. Rule 3(2)(a) of the IT Rules requires every “intermediary” to appoint a “Grievance Officer”. While Rule 4(1) requires every “significant social media intermediary” to appoint three distinct officers; a “Chief Compliance Officer” responsible for compliance with the IT Act and the rules thereunder, a “Nodal Contact Person” for coordinating with law enforcement agencies at all times, and the aforementioned grievance officer, designated as the “Resident Grievance Officer”.

171. As per Rule 3(2)(a), every complaint or grievance regarding any content, duty or computer resource of the intermediary is, to be received and resolved by the Grievance Officer, or the Resident Grievance Officer, as the case may be.

M.A. Nos. 2553-2554 of 2026 Page 64 of 136

172. The IT Rules, more particularly Rule 3(2) prescribes different timelines for the resolution of a complaint, depending upon the severity of the grievance. A complaint of a general nature is to be resolved within seven days. Whereas, a complaint seeking removal of any content prohibited under Rule 3(1)(b), which includes CSEAM, is to be resolved within thirty-six hours, and in case of a complaint of such content by the individual depicted therein, within two hours7.

173. We have no reason to doubt that intermediaries and their grievance officers would be prioritising complaints in accordance with the urgency prescribed by the IT Rules. Nevertheless, we are of the view that such prioritisation may not be as effective as it appears.

174. We say so because the catalogue of urgent complaints under the IT Rules is a wide one. Complaints of CSEAM are one amongst several grievances which call for the same urgency. Rule 3(1)(b) lists several categories of prohibited material, apart from CSEAM, that must, under Rule 3(2)(a), be resolved within thirty-six hours from their receipt.

7 Rule 3 sub-rule (2) sub-clause (b) of the IT Rules.

M.A. Nos. 2553-2554 of 2026 Page 65 of 136 175. The aforesaid categories are not the only grievances which call for urgent action. Orders under Rule 3(1)(d) and complaints under Rule 3(2)(b) carry much shorter timelines of three and two hours respectively.

176. Yet, complaints carrying a timeline of two hours and those carrying a timeline of seven days are both left to the same grievance officers. An officer faced with several complaints, each demanding action within a matter of hours, must still attend to them one after another, and complaints of CSEAM would inevitably, at some occasion, have to await their turn.

177. Therefore, even amongst the complaints so prioritised, those of CSEAM would continue to compete with others of comparable urgency.

178. One must also be mindful of the fact that prioritisation does not by itself, create capacity to handle complaints, particularly, when one takes into account the volume of complaints that an “intermediary”, and more so a “significant social media intermediary”, would receive on a daily basis.

M.A. Nos. 2553-2554 of 2026 Page 66 of 136 179. The number of complaints received is also seldom the same. In certain instances, particularly when any CSEAM of “unknown origin” begins circulating for the first time, the complaints in respect of the same often surge.

180. Prioritisation within the rules, in such instances, is of little help, without proper capacity. It may reorder the sequence in which complaints are taken up, but it cannot ensure that each of them receives the same attention required.

181. We are conscious of the fact that certain intermediaries, more particularly significant social media intermediaries, would have several grievance officers working round the clock for resolving the complaints received.

182. However, we also cannot ignore the dismal manner in which complaints of CSEAM are presently being dealt with, as revealed by the news report before us. From what we can see, out of the fifty-five advertisements that were reported, forty-three of them were cursorily held to be compliant, while the remaining complaints elicited no

M.A. Nos. 2553-2554 of 2026 Page 67 of 136 response at all from the grievance officers. The relevant excerpts read as under: - “TTP said that it tried reporting ads via Meta's own reporting system and that of the 84 ads that ran in India, they were able to report 55. Meta only gives the option of reporting ads when they are live.

For 43 of these, TTP got a reply that said, ‘We've taken a look and found that this ad doesn't go against our Advertising Standards.’

For 11 ads, they were told that the content had already been removed. They haven't received a response yet for one ad.”

183. Rule 3(2)(a) of the IT Rules requires the grievance officer of any intermediary to acknowledge the receipt of every complaint made to it within twenty-four hours. A significant social media intermediary, under Rule 4(6), is further required to provide a reference number by which such complaints may be tracked, and, “to the extent reasonable”, furnish reasons for any action taken or not taken pursuant thereto.

184. The above stipulations were first introduced with the erstwhile IT Rules in 2021. It has been almost five years since these rules came into force. The intermediaries have had ample time to comply with the same. Yet, we find such compliance to be far from satisfactory.

M.A. Nos. 2553-2554 of 2026 Page 68 of 136 185. In view of the serious lapses on the part of the intermediaries in complying with even the basic requirements under the IT Rules, we cannot help but wonder if such grievance officers are stretched beyond their capacity, particularly when it comes to complaints of CSEAM.

186. Rule 4(1)(d) of the IT Rules envisages all significant social media intermediaries to publish a monthly review of its grievance redressal mechanism, more particularly its compliance with the requirements set out in the IT Rules. We want to know from the Union of India what this exercise has yielded. What has been the extent of compliance by such intermediaries in the past five years.? Why is it that, even to this date, intermediaries continue flouting the IT Rules?

187. In any view of the matter, we deem it appropriate that every intermediary must have a dedicated grievance officer or team of grievance officers, for receiving and resolving complaints related to CSEAM. These officer(s) would be expected to further ensure the dayto-day compliance with the other requirements discussed by us in the earlier parts of this judgment, including the use of Hash & URL Listing

M.A. Nos. 2553-2554 of 2026 Page 69 of 136 for the detection and removal of CSEAM, and the proper reporting of the same to the authorities.

188. This becomes all the more necessary, given that the present grievance officers appear to have been unable to correctly identify advertisements or material that indirectly promote CSEAM or other material harmful to children, as is evident from the news report. As such, the officer(s) responsible for handling complaints relating to CSEAM must be adequately trained in this regard.

189. Such officer or officers would also serve to ensure appropriate human oversight of the technical measures deployed for the detection and removal of CSEAM, as envisaged under Rule 4(4) of the IT Rules, and would further oversee the proper resolution of complaints related thereto.

190. Insofar as those complaints are concerned, where the nature of the grievance may not be apparent from the complaint itself, either due to the inadvertence of the user reporting it, or the convoluted nature of the existing mechanisms through which complaints are routed, we expect the intermediaries to put in place a proper mechanism for sifting through the complaints received by it.

M.A. Nos. 2553-2554 of 2026 Page 70 of 136

191. Such mechanism must be capable of identifying, at the very threshold, complaints which pertain to CSEAM, irrespective of the heading under which the same may have been made. Complaints so identified must then be routed forthwith to the officer(s) appointed to resolve the same.

c. The Proper Authority and Timelines for reporting of CSEAM by Intermediaries.

192. We also find that none of the provisions within the IT Rules stipulates any timeline within which an intermediary must inform the authorities of any content, information, computer resource or link removed or disabled by it, either on the basis of any complaint or upon its own due diligence.

193. Rule 3(1) sub-clause (c) and (ca) of the IT Rules, respectively, are the only provisions which speak of the obligation of an intermediary to, inter-alia, report the commission of any offence under any law. However, the said provisions prescribe no timeline within which an intermediary must report such offences, and merely stipulate that

M.A. Nos. 2553-2554 of 2026 Page 71 of 136 such report be made in “accordance with the provisions of the applicable law”.

194. Similarly, Section(s) 19, 20 and 21 of the POCSO Act read with Rule 11 of the POCSO Rules, which together form the umbrella provisions pertaining to the reporting of any offence that may have been committed under the POCSO Act, prescribe no timeline within which a person or an intermediary must make such report.

195. In the same vein, the IT Act is also silent insofar as the reporting of offences committed under the said Act is concerned, including those under Section 67B.

196. This, to us, is a glaring omission within the IT Rules, more so in light of our categoric observations in Just Rights (supra) emphasizing the significance of such a requirement. The absence of a specific timeline is a matter of grave concern, particularly when it comes to CSEAM, where every hour of delay causes irreparable harm to the victim.

197. We therefore, deem it appropriate that some time-limit must be prescribed within which an intermediary, must report the commission

M.A. Nos. 2553-2554 of 2026 Page 72 of 136 of any offence under any law to the appropriate authority, at least insofar as our children are concerned.

198. Thus, where an intermediary removes or disables any CSEAM in consequence of violation of Section 15 of the POCSO Act or Section 67B of the IT Act, the same must be reported to the proper authority in terms of Rule 11 of the POCSO Rules which would include the SJPU, the local police or the cyber-crime portal, as may be prescribed.

199. Keeping in mind our earlier discussions on the two separate processes, by which CSEAM is to be detected and removed, we propose the following: - • Proper Authorities to whom CSEAM must be Reported by Intermediaries. (i) Where an intermediary removes or disables any content, computer resource, information or link as CSEAM in consequence of violation of Section 15 of the POCSO Act or Section 67B of the IT Act the same must be reported in accordance with Rule 11 of the POCSO Rules. (ii) The Proper Authority for this purpose would be the Special Juvenile Police Unit, the local police and/or the cyber-crime portal, as specified under Rule 11 of the POCSO Rules.

M.A. Nos. 2553-2554 of 2026 Page 73 of 136 (iii) Where an intermediary removes or disables any CSEAM of “Unknown Origin” the same must also be reported to the authority entrusted with the maintenance of the Hash & URL List Database, if not already the same. (iv) Where, however, an intermediary removes or disables any CSEAM of “Known Origin”, upon a match being found against the Hash & URL List Database, the intermediary must furnish the details of all such removals by way of a consolidated report on a weekly basis, to the authority designated for maintaining the Hash & URL List database. The Union of India may, prescribe additional authorities to whom such reports must also be made.

• Timelines within which CSEAM must be reported by Intermediaries. (i) Where an intermediary removes or disables any CSEAM of “Unknown Origin”, on the basis of a complaint or grievance received by it, the same must be reported forthwith upon the resolution of such complaint, and in any case no later than two hours after such resolution.

M.A. Nos. 2553-2554 of 2026 Page 74 of 136 (ii) Where an intermediary removes or disables any CSEAM of “Unknown Origin”, on the basis of its own due diligence, the same must be reported within two hours from such removal. (iii) Where an intermediary removes or disables any CSEAM of “Unknown Origin”, on the basis of an order of a court of competent jurisdiction or reasoned intimation from the appropriate government, the same must be reported within two hours from such removal. (iv) We reiterate, where an intermediary removes or disables any CSEAM of “Known Origin”, upon a match being found against the Hash & URL List Database, whether pursuant to a complaint or not, the intermediary must furnish the details of all such removals, by way of a consolidated report on a weekly basis to the authority designated for maintaining the Hash & URL List database.

d. Need for a Prescribed Form for the Reporting of CSEAM by the intermediaries.

200. The reporting of CSEAM by intermediaries to the proper authorities in a timely manner, cannot, however, be the end of the matter. Any

M.A. Nos. 2553-2554 of 2026 Page 75 of 136 report of CSEAM would only be of value, if the information contained therein can be meaningfully used by all authorities and stakeholders. Thus, the manner in which such reports are made is equally significant for removing CSEAM in a prompt manner.

201. At present, neither the IT Act nor the IT Rules prescribe any format in which intermediaries must report either the commission of any offence under any law, or the removal of any content, information, computer resource or link, pursuant to the provisions contained in the IT Rules.

202. We are of the considered view that there must be a standard prescribed pro-forma format in which every intermediary must report the detection and removal of any content, information, computer resource or link as CSEAM, to the proper authorities.

203. The form or content of such report must necessarily include certain relevant particulars, some of which we may indicate, with the actual modalities left to be worked out by the Union of India. They are: - S. No. Particulars 1. Hash Identifier and/or URL of the material. 2. Date and Time of Detection and Removal. 3. Descriptive Elements of the Material:

M.A. Nos. 2553-2554 of 2026 Page 76 of 136 Keywords, Captions, Description associated with the material. 4. Type of Material: Whether the material is an Image, Video, GIF, Link, Tool, Application, Advertisement etc. (including its file type or extension, where applicable). 5. Mode of Circulation or Hosting: Whether the material was found in a public post; a user’s status, story or biography; a private group or channel; a direct message; or the intermediary’s gallery/cloud. 6. If depicting any Real Individual: Whether the material depicts a real individual or is synthetically generated, including whether: i. It is a morphed or synthetically manipulated depiction of a real individual, ii. It appears to depict a victim who is identifiable, or who has been previously identified. 7. Nature of Material: Whether the material is of: i. Unknown Origin (including the Hash / URL identifier generated by the intermediary) or, ii. Known Origin (including the Hash / URL Entry matched against such material). 8. Mechanism through which Detected (including the necessary details of the same): Whether the material was detected by way of: i. Complaint by a user or victim, ii. Order of a court or reasoned intimation from appropriate government, iii. Match against the National Hash & URL List Database or iv. Intermediary’s own due diligence and detection tools. 9. Assessment by the Intermediary (only in case of CSEAM of Unknown Origin): The reasons recorded during the assessment of such material, including the details and e-signatures of the human analysts involved.

204. The format of such report must be in a machine-readable form, capable of being automatically processed by the computer resources of all necessary stakeholders.

M.A. Nos. 2553-2554 of 2026 Page 77 of 136

205. A uniform machine-readable format would ensure that such reports can be meaningfully used for updating the Hash & URL List Database, and easily integrated with other repositories such as the National Crime Records Bureau (NCRB) and the National Database on Sexual Offenders (NDSO). 206. It would also facilitate better coordination with other stakeholders, such as Internet Service Providers (ISPs), and further aid investigating authorities such as the Special Juvenile Police Units and Cyber Cells in their endeavours to identify patterns in the distribution of CSEAM and the networks responsible for the same, to investigate and prosecute the perpetrators, and to track down and rescue the victims of such offences.

e. Safeguards for the Grievance Redressal Mechanism in respect of CSEAM.

207. To ensure that the grievance redressal mechanism and the officer(s) operating the same function responsibly and, in the manner, expected of them, we deem it appropriate to briefly discuss and reemphasize certain safeguards necessary for this purpose.

M.A. Nos. 2553-2554 of 2026 Page 78 of 136

208. Every intermediary, in accordance with Rule 3(2)(a) of the IT Rules, must prominently display, on the home page or screen of its website or application, as the case may be, the requisite details of the grievance officer(s) as well as the mechanism through which users may raise their complaints.

209. Every intermediary must also ensure that such information is regularly updated, so as to accurately reflect the details of its grievance redressal mechanism and the officer(s) entrusted with the same.

210. In this regard, we would like the Union of India to apprise us of the extent of compliance with this requirement by the various intermediaries, and of the action taken, if any, against intermediaries found to be in default.

211. The grievance redressal mechanism of every intermediary must provide a distinct and clearly labelled category for the reporting of CSEAM. The nomenclature of such category must be simple, readily understood by any person irrespective of age, literacy or familiarity with technology, and must leave no doubt as to the nature of the content being reported.

M.A. Nos. 2553-2554 of 2026 Page 79 of 136

212. Such mechanism must also be made accessible within two steps from the content, profile, group or link in question, and must be uniform across all intermediaries. The Union of India is thus requested to put in place certain guidelines for ensuring the same.

213. Any content reported as CSEAM or complaint thereof must be assessed thoroughly. Such assessment must be done keeping in mind the provisions of Section(s) 15 and 67B of the POCSO and IT Act, respectively. The assessment, must involve examining the content as a whole, including the text, captions, keywords, links and the function of the tool or application being promoted, in order to determine whether the same facilitates or has the propensity to result in the exploitation or abuse of children.

214. The grievance officer(s) persons entrusted with the review and resolution of such complaints must be adequately trained to identify CSEAM, including material which may not be explicit on its face but nevertheless carries either the likelihood of exploitation or abuse of children or is otherwise harmful to them.

M.A. Nos. 2553-2554 of 2026 Page 80 of 136 215. The intermediaries must ensure that such officer(s) receive necessary training from time to time, particularly in respect of any and all new modus operandi that may emanate in the circulation of CSEAM. The intermediaries must also allocate adequate resources to the grievance redressal mechanism and the officer(s) entrusted with it, for continued efficiency of the same.

216. No report or complaint of CSEAM ought to be disposed without the same having been reviewed by a trained grievance officer. Automated tools may be used to assist the preliminary screening of such reports. However, the ultimate decision, must be taken by a trained grievance officer, entrusted with such duty. Such assessment, must record the findings of the office in the course of his assessment, and bear his digital signature, to ensure accountability.

217. We may remind that, Rule 4(4) of the IT Rules, already requires appropriate human oversight of the automated tools deployed by significant social media intermediaries. The requirement for recording the findings and affixing signature to the same is only an extension of this statutory requirement.

M.A. Nos. 2553-2554 of 2026 Page 81 of 136 218. Every report or complaint relating to CSEAM, must be acknowledged within twenty-four hours from receipt, and must be accompanied by a reference number to track the status of the same. Any decision or action taken in respect of the same must be communicated to the complainant along with the reasons thereof.

219. We are conscious that Rule 4(6) as it presently stands, requires only significant social media intermediaries to provide the means for tracking complaints, and to furnish reasons for any action or decision by it “to the extent reasonable”. We however are of the view that this compromises the accountability required in the resolution of complaints as grave as those of CSEAM. We therefore urge the Union of India to extend the aforesaid requirements to every intermediary insofar as complaints of CSEAM are concerned by introducing suitable amendments within the IT Rules.

220. Every intermediary must publish a monthly compliance report detailing the number of complaints received by it, the action taken in respect of the same, the time within which such complaints were resolved, and the content, information or link or any part thereof removed or disabled pursuant to such complaint or by its own due

M.A. Nos. 2553-2554 of 2026 Page 82 of 136 diligence. Complaints pertaining to CSEAM must in particular be disclosed under a separate section within the report. Such reports must be periodically subjected to independent audit by an appropriate authority designated by the Ministry of Electronics and Information Technology, so as to oversee the continued compliance of the various requirements under the IT Rules. The Union of India is urged to make suitable changes within the IT Rules, more particularly Rule 4(1)(d), for setting out the above requirements.

221. It has been further brought to our notice that in many appeals preferred against the decisions of the grievance redressal mechanisms of intermediaries, the orders passed by the Grievance Appellate Committee are not complied with in a timely manner.

222. We would therefore like to know from the Union of India, the mechanism, if any, by which compliance with such orders is presently monitored, and the action taken against intermediaries found to be in default of the same.

M.A. Nos. 2553-2554 of 2026 Page 83 of 136 D. Penalties for persistent failures by Intermediaries in complying with the requirements of IT Rules.

i. Need to rethink and move beyond Section 79 of the IT Act.

223. If there is one theme that can be discerned from all our discussions above, it is the persistent failure of intermediaries, in one form or another, to comply with the various requirements envisaged under the IT Rules.

224. One reason that may explain why the intermediaries, despite being given numerous opportunities, continue to flout the IT Rules is the absence of any meaningful consequence for failing to comply with the IT Act and the rules thereunder.

225. Under the IT Act and rules framed thereunder, an intermediary which fails to observe or comply with any of its regulatory requirements, faces only one consequence; the loss of the “safe harbour” protection afforded to it under Section 79.

226. Once such protection is lost, the intermediary along with any person responsible for such failure, as the case may be, becomes liable for any content or information hosted on its platform, and may be prosecuted

M.A. Nos. 2553-2554 of 2026 Page 84 of 136 and punished for the same, under the relevant law for the time being in force. In the case of CSEAM, this would include offences under Section 15 and 67B of the POCSO and IT Act, respectively.

227. The consequence of an intermediary’s failure to comply with the requirements of the law in discharge of its duty is confined to it being held liable for and proceeded against, qua a particular content or information, which constitutes an offence under any law for the time being in force.

228. In other words, it fastens a post facto liability upon the defaulting intermediary, only after an offence is committed, by the upload, publication or hosting of any particular content or information on its platform.

229. Although such an approach may be suitable where the harm sought to be addressed is capable of being remedies after the fact, yet the same cannot be said for CSEAM.

230. The harm that is occasioned by such material is not confined to the moment of its creation. Every instance of its circulation, every view, and every download, revictimizes the child depicted therein.

M.A. Nos. 2553-2554 of 2026 Page 85 of 136

231. The continued circulation of CSEAM does irreparable harm to the society. It fuels the consumption and demand for such exploitative and abusive material; it normalises abuse of children and emboldens those who seek it out.

232. In such a scenario, the post facto prosecution and punishment, howsoever successful, of those responsible for allowing the upload, circulation and viewing of CSEAM, even if indirectly or inadvertently, can hardly undo the harm that has already been done.

233. Even otherwise, Section 79 of the IT Act does not address the systemic lapses and their continuance the on part of the intermediaries in discharge of their duties in accordance with the law. Despite the requirement to observe due diligence in their functioning, the said provision springs into action not upon a wilful failure to do the same, but only after the commission of any offence in consequence thereof.

234. In other words, it does not address the failure to comply, but only the aftermath that follows such failure. An intermediary may persistently fail to comply with the requirements of the IT Act and the rules

M.A. Nos. 2553-2554 of 2026 Page 86 of 136 thereunder, and yet face no consequence whatsoever, unless and until an offence comes to be committed through some particular content on its platform.

235. Several provisions of the IT Act and the IT Rules, particularly those relating to grievance redressal, detection of unlawful and harmful material and the timely reporting thereof, acknowledgement of complaints, etc., are provisions that are intended to serve as a safetynet for users. They are there to ensure that the experience of users, irrespective of the platform, remains fair, their dignity secure, privacy intact and safety uncompromised, in the course of their use of the internet. The failure in complying with such provisions may still adversely affect users and their right to use the internet, without constituting any offence in itself.

236. Section 79 of the IT Act, in such situations, proves to be an unusually inept provision. It is too drastic to be invoked for every instance of non-compliance, and too remote to deter the same. The result is that routine defaults go unchecked, while the consequence prescribed by law is seldom invoked.

M.A. Nos. 2553-2554 of 2026 Page 87 of 136 237. This also renders certain provisions of the IT Rules otiose and redundant. Provisions which are preventive in nature, such as Rule 3(1)(b), which requires intermediaries to make reasonable efforts to prevent users from publishing any unlawful, exploitative or abusive content, remain hollow and, at best, curative in effect.

238. Should the IT Act and the rules framed thereunder remain a toothless tiger in such situations? The answer to the same must be an emphatic “no”.

239. What is therefore, in our view, required is a distinct set of consequences that are attracted by the default itself. Consequences capable of being invoked without awaiting the commission of an offence, which keep the object of diligence and deterrence intact while remaining proportionate to the nature, gravity and frequency of the default.

ii. Exemplary Monetary Fines and Penalties.

240. Various jurisdictions across the globe follow suit with a similarly designed framework insofar as penalties and liabilities are concerned

M.A. Nos. 2553-2554 of 2026 Page 88 of 136 for any non-compliance with the regulatory requirements, particularly in respect of CSEAM.

241. In the United States, Section 2258A of Title 18 of the United States Code casts an obligation upon providers of electronic communication and remote computing services to report any apparent instance of CSEAM which comes to their actual knowledge, to the CyberTipline of the National Centre for Missing & Exploited Children.

242. While sub-section (e) of the said provision prescribes the consequence for a knowing and wilful failure to make such report, in the form of a substantial monetary penalty.

243. With the REPORT Act of 2024, both the aforesaid aspects underwent significant change. It expanded the categories of instances within Section 2258A that must now be reported to inter-alia also include child-trafficking and the enticement of minors, along with considerably enhancing the penalties under sub-section (e) for the failure in doing so.

244. The penalty prescribed is graded on two distinct metrics. First, by the size of the intermediary or “provider”. An intermediary with 100

M.A. Nos. 2553-2554 of 2026 Page 89 of 136 million or more monthly active users faces a higher fine for such failure. Second, by the recurrence of the default, with a higher fine being prescribed for a second or subsequent failure.

245. Accordingly, a provider for its first instance of failure, would be fined up to $600,000 or $850,000, depending upon its size, with subsequent failures extending it to $850,000 and $1 million respectively.

246. Similarly, the United Kingdom’s Online Safety Act, 2023 places a range of duties upon “providers” of user-to-user online services. These include duties to assess the risk of illegal content appearing on their services, to take proportionate measures to mitigate such risk, and to swiftly remove such content once they are alerted to it. CSEAM forms one of the most serious categories of illegal content under the said Act.

247. The Office of Communications or “Ofcom”, the regulator for the enforcement of these duties, is vested with a wide array of powers. These include issuing notices requiring providers to furnish any information necessary to assess the extent of their compliance, provisional notices of contravention or non-compliance, followed by penalties upon confirmation; along with enforcement notices

M.A. Nos. 2553-2554 of 2026 Page 90 of 136 requiring providers to take specific steps to comply, or use specific technology to detect illegal content.

248. The penalty for breach of any duty by an intermediary or “provider” is an exemplary fine of up to £18 million, or 10% of the worldwide revenue of such provider, whichever is greater. The fine may be imposed as a single amount, or at a daily rate, in case of a continuing breach, and must be appropriate and proportionate to the breach.

249. Within the European Union, Regulation (EU) 2022/2065, more popularly known as the Digital Services Act, governs the obligations of providers of intermediary services, particularly in respect of illegal content such as CSEAM.

250. This, inter-alia, includes putting in place an accessible mechanism to report illegal content, acting upon such reports promptly and notifying suspicions of criminal offences to law enforcement authorities.8 While “very large online platforms” and “very large online search engines” must also assess and mitigate systemic risks of

8 Arts. 16, 17 and 18 of the Digital Services Act; Regulation (EU) 2022/2065.

M.A. Nos. 2553-2554 of 2026 Page 91 of 136 dissemination of illegal content and harm to children on their services.9

251. Insofar as penalties are concerned, the EU does not directly draw a distinction based on the size of the provider. Such distinction matters only for the authority overseeing the compliance, with “very large online platforms” and “very large online search engines” being regulated by the European Commission, and the remaining platforms by the Digital Services Coordinator of each Member State.

252. Article(s) 52, 74 and 76 of the said Regulation, inter-alia, set out the penalty for any infringement of these obligations. The consequence for such failure is, again, a substantial fine, of up to 6% of the annual worldwide turnover of the provider in the preceding financial year.

253. In the event of continuing defaults, a periodic penalty of up to 5% of the average daily worldwide turnover of such provider may be imposed for every day in default. The actual sum imposed must be effective, proportionate and dissuasive, keeping in mind the nature, gravity, duration and recurrence of the infringement.

9 Arts. 34 and 35 of the Digital Services Act; Regulation (EU) 2022/2065.

M.A. Nos. 2553-2554 of 2026 Page 92 of 136 254. In Australia, the eSafety Commissioner, the centralised regulator under the Online Safety Act, 2021, is armed with sweeping powers to compel the removal of harmful content, formulate industry standards of safety and enforce the same.

255. The industry standards, as revised from time to time, inter-alia, require various service providers to assess the risk of harmful content such as CSEAM, deploy appropriate systems to detect and remove the same, and furnish their reports to the Commissioner.

256. Any failure to comply with the above may, in the first instance, be met with a formal warning from the Commissioner, with subsequent or persistent breaches entailing a court ordered civil penalty of up to AU$ 49.5 million per breach.

257. In South Korea, the Telecommunications Business Act imposes obligations upon “value-added telecommunications service providers” in respect of “illegal filmed materials”, an expression which includes CSEAM. Under Article 22-5 thereof, such providers must delete, or block access to, any such material upon becoming aware of it.

M.A. Nos. 2553-2554 of 2026 Page 93 of 136 258. It further requires providers above a certain threshold of size or reach to take technical and managerial measures to prevent the circulation of such material in the first place. These include filtering content against material already determined to be illegal, restricting related search results, and maintaining a mechanism for users to report such material.

259. An intentional failure to delete, or block access to, such material attracts a “penalty surcharge” or fine of up to 3% of the sales of the provider, under Article 22-6 thereof. While a failure to implement any of the above preventive measures attracts an administrative fine of up to ₩50 million, under Article 104(1).

260. What can be discerned from the above is that, in most jurisdictions, the failure to comply with any regulatory requirements, particularly those relating to matters as serious as CSEAM, is itself visited with a consequence, usually exemplary fines, irrespective of whether any offence has been committed through such failure.

261. The quantum of such fines is determined having regard to the gravity, duration and recurrence of the default. Such quantum is also decided

M.A. Nos. 2553-2554 of 2026 Page 94 of 136 upon the size or turnover of the intermediary, ensuring that the penalty remains an effective deterrent.

262. For the convenience of exposition, a tabular illustration of the same is given below: - Country Penalty Provided

United States

18 U.S.C. § 2258A(e) (as amended by the REPORT Act, 2024.) Failure to Report apparent CSEAM, Child-trafficking or Enticement of Minors.

First Instance of Default: ▪ Fines up to $600,000 for providers with less than 100 million active monthly users. ▪ Up to $850,000 for providers with more than 100 million active monthly users.

Second or Subsequent Defaults: ▪ Fines up to $850,000 for providers with less than 100 million active monthly users. ▪ Fines up to $1,000,000 for providers with more than 100 million active monthly users.

United Kingdom Online Safety Act, 2023, ss. 10 & 137; Sch. 13, paras 2(4) and 4(1). Failure to comply with the duties in relation to illegal content, including CSEA Content (risk assessment, prevention and swift removal).

Individual Instance of Breach of Duty: Fines up to £18 million, or 10% of the worldwide revenue of the provider, as a single amount.

Continuing Breach of Duty: Fines up to £18 million, or 10% of the worldwide revenue of the provider, at a daily rate for all days in default.

European Union Digital Services Act : Regulation (EU) 2022/2065, Arts. 52, 74 & 76. Failure to comply with obligations in relation to illegal content (resolution of complaints, reporting, assessment and mitigation of risks of dissemination).

Individual Instance of Breach of Obligation

M.A. Nos. 2553-2554 of 2026 Page 95 of 136 Fines up to 6% of the annual worldwide turnover of the provider in the preceding financial year.

Continuing Breach of Obligation Periodic fines up to 5% of the of the average daily worldwide turnover of the provider for every day in default.

Australia Online Safety Act, 2021, ss. 143-147 & 162. Fai

[Document truncated at extraction limit — first portion analysed only]