A framework that pairs a hard line on abuse with a firm no to age-gating
In Just Rights for Children Alliance v. Union of India, a bench of Justices J.B. Pardiwala and K.V. Chandran issued a 137-page order proposing a framework for detecting, removing and reporting child sexual abuse material (CSEAM, or CSAM). According to MediaNama's report on the order, the framework is a proposal, not law. The Union government must file an affidavit before the next hearing on 10 December.
The order does two things that are usually bundled together and should not be. It takes the enforcement problem seriously, and it refuses the shortcut of keeping children off the internet.
The strongest case for the Court's approach
The case for a tough regime is strong. The Court's September 2024 judgment in Just Rights for Children Alliance v. S. Harish, recorded on the Supreme Court's own docket, restored criminal proceedings and asked the Union to act on child protection. Deccan Chronicle reports that the petitioner told the Court, nearly two years on, that the directions had not been effectively implemented. It also reports that the ministries missed a court deadline and were given "one last opportunity" to respond. MediaNama says the Court itself found "no progress worth the name." When voluntary effort has demonstrably failed, a regulator-style regime is a reasonable response. CSAM is also one of the few categories where nearly every legal system agrees the content is illegal, so the usual worries about over-removal weigh less.
Why fines are better than the safe-harbour cliff
Under Section 79 of the IT Act, an intermediary that fails its due-diligence duties loses its immunity. The Court called this remedy "unusually inept" for routine non-compliance. It is too drastic to apply to a platform that is merely slow, and too remote to deter anyone. Losing safe harbour exposes a platform to liability for everything its users post, and courts rarely impose that outcome.
The Court's alternative is direct financial penalties, with Section 79 kept as a last resort for serious and persistent failure. This is the more proportionate design. A graduated fine lets a regulator punish a specific lapse, such as a missed report, without threatening a service's existence. It also leaves lawful speech untouched, because the penalty attaches to a defined failure and not to the platform's wider activities.
The Court pointed to foreign models for scale. MediaNama's account lists the US REPORT Act, the UK Online Safety Act and the EU Digital Services Act. The DSA's Article 74 caps fines on very large platforms at 6% of worldwide annual turnover. Whatever number India picks, it should be written into statute and tied to the specific CSAM duties. It should not be an open-ended discretionary power.
A shared hash database is the right tool
The most useful idea in the order is a national database of hashes and URLs, possibly built on the Sahyog portal. It would hold fingerprints and links, not the material itself. Hash-matching lets every platform check uploads against known abusive images without any human viewing the content again. The order calls for perceptual hashing as well as exact matching, so that minor edits do not defeat the system.
The design includes human review before entries are added, which matters. A database that blocks automatically is only as trustworthy as its intake. The order also proposes a clearly labelled CSAM reporting category, anonymous reporting, acknowledgement of each report within 24 hours, a dedicated grievance officer, and monthly compliance reports audited by a MeitY-designated authority. These are workable operational requirements.
Where the framework needs safeguards
The weak point is the two-hour removal and reporting window. For content that matches the database, speed is sensible, since the material is already verified. But the order also applies the two-hour rule to removals under due-diligence obligations, court orders and government notices. A clock that short, combined with fines, pushes platforms to take down first and ask questions later. That is the over-removal risk that CSAM-specific rules were supposed to avoid.
The fix is to keep the fastest timeline for verified database matches. Anything flagged by a user or by a platform's own tools should go through human review, with an appeal route for a wrongly listed URL. A URL list is also a blocklist. Without published criteria, audit and delisting procedures, errors will be hard to correct. Sahyog has drawn criticism before as a channel for government takedown notices, so building CSAM infrastructure on it should come with clear separation from general content-removal orders.
The age-gating rejection is the most important part
The Court rejected a social media ban for children and age-based restrictions, and its reasoning is the strongest civil-liberties statement in the order. It held that access to and use of the internet is a fundamental right under Article 21 read with Article 19(1)(a), and that children are not excluded. It described age-based restrictions as "themselves an overreach", because they require identifying every user's age and "continuous collection and monitoring of sensitive data". It described the resulting risk of misuse and surveillance as disproportionate.
A commentary on the ruling adds that blanket restrictions could push children toward riskier platforms and discourage them from reporting abuse. The same source points to safeguards such as private-by-default accounts, limits on contact from unknown adults, and stronger moderation.
This matters beyond India. Several governments are weighing under-16 bans that depend on identity checks for everyone. The Court's point is that you cannot verify a child's age without building an identity layer for all users, and that layer is itself a harm. Targeting the offenders, the uploads and the platforms' detection duties protects children without it.
What to watch
The government's affidavit will show whether the framework becomes a rule. Three things will decide whether it is good policy: whether fines are set in statute with clear thresholds, whether the database has independent oversight and a correction process, and whether the two-hour clock is limited to verified matches. If those hold, India will have a CSAM regime that is stricter than today's and more proportionate than safe harbour as a threat.