SC directs CSAM regulations for intermediaries; rejects social media ban for children

Access a copy of the court order here: [pdf]

Rejecting the idea of a social media ban for children and age-based restrictions, the recent SC order stated that children too have “access and use the internet is a fundamental right of every individual under Article 21 read with Article 19(1)(a)” and also affirmed that, irrespective of their age, to deny access to the internet by saying that they lack conscience is “absurd.” The bench of Justices J.B. Pardiwala and K.V. Chandran further said: 

“Age-based restrictions are themselves an overreach. Such processes, inevitably, always require identifying and ascertaining the age of each and every user, continuous collection and monitoring of sensitive data and an overall disproportionate risk of misuse and surveillance, the kind which finds no place within the right to privacy of our people.” — SC

However, the 137-page order by the bench of Justices J.B. Pardiwala and K.V. Chandran goes further, setting out a proposed regulatory framework for detecting, removing and reporting child sexual abuse and exploitation material (CSEAM), also known as Child Sexual Abuse Material (CSAM). It also lays out penalty-based approaches for regulating CSAM on social media platforms and other applicable intermediaries.

As the SC is seeking the central Government’s response, if this framework is accepted and implemented by the Indian Government and intermediaries, this framework and the process suggested by the SC could fundamentally change how intermediaries handle the CSAM/CSEAM content on their platforms. Here is a brief list of the proposed changes recommended by the SC. Each recommendation is explained below.

The SC directions, in short:

1.  Mandates a database of ‘perpetual hashing’ & URLs of reported and identified CSEAM content:
2. National database to facilitate the CSEAM detection and removal; potentially built on top of the Sahyog portal
3. The standard operating procedures (SOPs) outlined for building and running the national database: 
4. A dedicated grievance redressal and designated officials for CSEAM content, along with monthly documentation in compliance reports
5. The reporting format and the concerned authorities to report CSEAM
6. Suggests the Union consider financial penalties beyond intermediary liability
7. CSEAM behind paywalls requires stricter enforcement. 

However, the framework outlined in the order will not be implemented yet. The Government has been asked to file an affidavit before the next hearing on December 10 regarding the progress made and steps taken to comply, and the database and SOPs. 

For some context, in 2024, the Supreme Court of India said in an order that the intermediary loses safe harbor if it does not remove child sexual abuse content and report it to the relevant authorities as required under the POCSO Act and Rules. 

Even after two years, the Supreme Court said, “there has been no progress worth the name.” The recent news reports on paid promotions of CSEAM on social media, including ads for tools that manipulate photos and videos into abusive material, brought the issue back into focus. 

Addressing these, the bench said it was “deeply saddened,” that it “cannot afford to wait any longer,” and that it was “left with no choice but to take matters in our own hands.” 

The SC acknowledged that much of the CSEAM removed from social media platforms is identified through individual reports. It notes that “when one social media platform detects and removes CSEAM, that detection does not automatically result in the same content being flagged and removed from all other social media platforms.”

To address this issue, the SC recommended the following measures: 

1. Mandates a database of ‘perpetual hashing’ & URLs of reported and identified CSEAM content: 

Drawing from global practices, like the US, UK, South Korea and Australia,  the SC explained the hash value attributed to a particular media file. “Every component of a CSEAM content, be it the video frame or image or multiples of both, carries a unique digital data print identifier in alphanumeric form, which is known as the ‘Hash’ identifier of that material. The hash identifier of any particular content remains unique to it, irrespective of where it is uploaded or by whom,” it noted. 

 It further said that all identified CSEAM should be hashed and its identifiers added to the “consolidated database known as a ‘Hash List,’ which will then be “used to cross-check all other content, whether on the very same platform or on another.” 

Whenever there is an automated detection, the platform’s algorithms should automatically delete the concerned content. 

To prevent circumvention, the SC said that “Perceptual Hashing” can be used that uses “audio-visual characteristics of the content. Characteristics such as colour-coding, object composition, audio cues, etc.”, to generate the hash value for the particular media file.

The SC noted that, except for the due diligence framework under the IT Rules, which mandates the undefined “reasonable efforts,” and takedown requirements under the February 2026 amendments, India doesn’t have statutory provisions dealing with the hash values and URL database: 

“From what we can discern, no such provision exists in India, requiring social media intermediaries to employ tools for Hash or URL Listing, at least to the same extent as found in other jurisdictions.” – SC 

2. National database to facilitate CSEAM detection and removal; potentially built on top of the Sahyog portal

To make the hash and URL database accessible and interoperable to other intermediaries, the SC suggested a real-time database modelled on the US-based National Center for Missing & Exploited Children (NCMEC)-like real-time database to facilitate the coordination among the intermediaries: 

“In other words, intermediaries would be in a position to crosscheck the content on their own platforms against the entire database, and not merely against what they themselves have encountered in the past. It is of note that such a database would not contain the harmful material itself, but only the hash identifiers and URLs by which it may be recognised.”

The SC acknowledged that “some progress has taken place in the right direction” through the Sahyog Portal to “streamline and automate the process of reporting and removal of unlawful content including CSEAM.” It further added that the Sahyog portal could be the “natural foundation upon which a Hash & URL List Database could be built.”

The SC’s reasoning is: 

“We say so because there is a discernible difference between a common portal that routes individual reports and takedown notices, and one which pools together the hash identifiers and URLs of all material confirmed to be CSEAM. The former acts only upon each instance of CSEAM as and when it is reported. Whereas the latter ensures that such material, once identified, is continuously detected and removed across all platforms, without waiting for it to be reported afresh.” – SC

For context, in May 2025, the Home Affairs Ministry’s Indian Cyber Crime Coordination Centre (I4C) has instructed social media platforms to integrate with the Sahyog Portal for reporting of child sexual abuse material (CSAM). Read more about it here. 

3. The standard operating procedures (SOPs) outlined for building and running the national database: 

The SC outlined the following SOP:

1. Collection of all users’ or platforms’ complaints and reports related to the CSAM/CSEAM content.
2. Verification of the content and no mechanical way of updating the database just because it is flagged as CSEAM content. However, the court hasn’t clarified the specific process/criteria to identify CSAM/CSEAM content. 
3. Human assessment of the content flagged by the concerned systems.
4. Hash identifier and URL should be entered into the databases. This has to be completed only after the human verification layer. 

“Unknown Origin” and “Known Origin”: When the concerned content is from the “known origin,” then the intermediary should “immediately disable and remove the same, without awaiting any further verification at its end.” However, if the content is from an unknown source, then the intermediary should add the hash values and URLs. 

• Unknown Origin: “all such material that has no corresponding match in the Hash & URL List Database but nevertheless was detected and subsequently removed on the basis of the intermediary’s own tools and mechanisms.”
• “Known Origin”: “all such material that is removed by an intermediary pursuant to a match being found against an already existing entry in the Hash & URL List Database.”

For reference, these are similar databases in the respective nations: NCMEC Industry Hash Sharing Platform (United States), IWF Image Hash List (United Kingdom), Govt-owned Child Abuse Image Database (United Kingdom), Project Arachnid (Canada), Instant Image Identifier and Hash Check Service (Korea), CNCPO “black list” (Italy), Digital Child Exploitation Filtering System (New Zealand). 

4. A separate grievance track and designated officials for CSEAM content along with monthly documentation in compliance reports: 

The SC order read that every intermediary should: 

• Offer a distinct, clearly labelled CSEAM category, named simply enough for anyone “irrespective of age, literacy or familiarity with technology,” reachable within two steps of the content for making grievance redressal accessible.
• Reporters’ anonymity must be maintained “at all stages,” and every report acknowledged within 24 hours with a reference number.
• Every intermediary must also have a dedicated grievance officer or team for CSEAM, trained to spot material that may not be explicit on its face. 
• No report can be closed without review by a trained officer, whose findings must be recorded and digitally signed. 
• Monthly compliance reports must carry a separate CSEAM section and be periodically audited by an authority designated by MeitY.

5. The reporting format and the concerned authorities to report CSEAM. 

Under the SC-recommended framework, within two hours, the content has to be removed under the due diligence obligations or a court order or a government notice. These cases must also be reported to the Special Juvenile Police Unit (SJPU), local police and/or the cyber-crime portal under the POCSO Rules. 

Importantly, the Court said that they should follow a standard, machine-readable pro forma with nine indicative particulars, including the hash or URL, type of material, where it circulated, whether it depicts a real person or is synthetic, and how it was detected. This is to feed the database, the National Crime Records Bureau and the National Database on Sexual Offenders, and help police trace networks.

6. Suggests that the Union government consider financial penalties beyond intermediary liability

Today the only consequence of non-compliance is loss of safe harbour under Section 79, which attaches liability for specific content after an offence. That, the bench said, does not address “the failure to comply, but only the aftermath that follows such failure.” Section 79 “proves to be an unusually inept provision. It is too drastic to be invoked for every instance of non-compliance, and too remote to deter the same.”

The court wants “a distinct set of consequences that are attracted by the default itself,” since after-the-fact prosecution cannot undo harm when every circulation, view and download “revictimizes the child.”

It surveyed regimes in the US, UK, EU, Australia and South Korea, all of which fine non-compliance as such: 

• US’ REPORT Act (2024): If the platforms fail to report, the fine could range from 600,000 USD to 1,000,000  USD depending on the size/users of the platforms and whether it is a first-time offence or a repeated offence.  
• UK’s Online Safety Act: Failure to comply with the Act could invite a fine up to 18 million Euros or 10% of worldwide revenue, whichever is greater 
• European Union Digital Services Act: Failure to comply could invite fines up to 6% of annual worldwide turnover. 

7. CSEAM content behind paywalls needs stricter enforcement 

The Court noted that the pay-per-view and subscription content “enjoys a far lower threshold of scrutiny” from intermediaries, the court said, making paywalls a “potent means” of circulating CSEAM or links to it. At the same time, platforms often take a share of the fee. By the time such material is exposed, “the harm has already been done, and the profits already earned.” The bench called this modus operandi “profiteering until prohibited.”

Where CSEAM circulates through a paywall or subscription from which the intermediary earns revenue, that revenue “should be forfeited and disgorged,” the court argued, in addition to any exemplary fine. 

The court asked whether this could be incorporated into the penalty regime. All intermediaries were put “to strict notice” that paywalled content needs “rigorous scrutiny,” and that “no child is able to subscribe to, or otherwise access” sexually explicit or indecent content.

“However, we need not dwell on this much. We are of the view that, for the present, penalties in the form of exemplary fines would suffice to meet the exigencies at hand. In any event, for cases of serious persistent failures, Section 79 of the IT Act would always be available as a last resort in such occasions.” – SC

What’s next? The SC will hear the case again on December 10. Before this hearing, the Union government should submit an affidavit, answering the following questions:

• which detection tools intermediaries currently use, and whether they can be deployed across the industry;
• whether the database will sit within the Sahyog Portal, and by when the portal can take on that role;
• what five years of monthly reviews under Rule 4(1)(d) have shown;
• how orders of the Grievance Appellate Committee (GAC) are enforced;
• what the Union has done “in all these years” about the sex education and awareness suggestions the court made in 2024.

Follow this case using this case number: M.A. Nos. 2553-2554 of 2026

Also Read: 

• RTI: Sahyog Portal to Handle Data on Non-Consensual Intimate Images, But Privacy Measures Not Shared
• After BBC investigation, MeitY to summon Meta over Instagram ads promoting Child Sexual Abuse Material

The post SC directs CSAM regulations for intermediaries; rejects social media ban for children appeared first on MEDIANAMA.