The strongest case for banning children from social media is simple. Platforms have had years to protect minors and have not done so. The Supreme Court itself recorded that its September 2024 directions in Just Rights for Children Alliance v. S. Harish saw "no progress worth the name" in more than two years (Siasat). If voluntary compliance fails, a blunt prohibition at least has the virtue of being enforceable. On 15 October 2026, a bench of Justices J B Pardiwala and K Vinod Chandran heard that argument and declined it.
What the Court actually decided
The 137-page judgment held that any blanket restriction on children's internet access is "nothing more than unproven measures of proven disproportionality," and observed that "no jurisdiction has, so far, been able to demonstrate that children are any safer on account of such measures" (Down To Earth). It added that restricting children's access "mistakes the victim for the problem." Reporting on the judgment says the Court grounded internet access in Article 21 read with Article 19(1)(a) of the Constitution, and held that children enjoy that right irrespective of age (Verdictum). It also warned that a ban could push children toward less regulated platforms without their parents' knowledge.
The Court did not conclude that nothing should be done. It redirected enforcement toward the material and the people behind it: those who create, circulate, sell or seek out child sexual exploitation and abuse material (CSEAM), and intermediaries that fail to detect and remove it.
The machinery the Court ordered
The Union government must frame guidelines or standard operating procedures for perceptual hash matching and URL listing by all significant social media intermediaries, and amend the IT Rules where necessary. It must also create a National Hash and URL List Database, used only for CSEAM, which could sit inside the Sahyog Portal or run as a separate repository. Per Verdictum's account of the judgment, the database would store identifiers rather than the material itself. Entries would need software screening and independent human assessment, with signed analyst reports, audit trails, independent audits and prompt removal of wrongly listed items. ThePrint reports that at least three trained analysts must verify each entry (ThePrint).
The operational duties are specific:
- Material matching a verified entry must be removed immediately, with a notice stating the basis in its place.
- For complaint-based material of unknown origin, intermediaries must verify and report it within two hours.
- Platforms must offer a distinct CSEAM reporting category reachable within two steps, acknowledge reports within 24 hours, and staff trained grievance officers.
- The government is asked to consider exemplary penalties scaled to gravity, duration, recurrence and company size, plus forfeiture of revenue earned from paywalled CSEAM.
The Court found the existing duty too narrow. Significant social media intermediaries today must make a best-effort attempt to use technology to detect child sexual abuse content, with human oversight, regular review, and regard for free speech and privacy, according to PRS India's summary of the 2021 IT Rules. Verdictum reports that the Court considered Rule 4(4) too narrow and called for periodically revised guidelines on proven tools.
Why this is the better design
Hash matching targets known illegal material. It does not scan the lawful speech of children or adults for a vague category of harm, and it does not require identity checks on every user. A ban would have required age verification at scale, which means collecting identity data from everyone to protect the few. Targeting abusers and distribution channels instead is both more proportionate and more likely to reduce actual harm.
The Court also declined a tempting shortcut on liability. Verdictum reports it found loss of safe harbour under Section 79 too drastic and too remote to deter routine non-compliance. That is a sound instinct. Safe harbour is the legal foundation that lets Indian and foreign platforms host user content at all. Penalties tied to a specific duty, such as the two-hour report or a failure to act on a verified hash, are easier to enforce and less likely to chill hosting.
Where the risk sits
A national blocklist is a powerful instrument, and its safeguards are the whole point. The Court's own design acknowledges this: multi-analyst verification, audit trails, wrongful-entry removal and a way to challenge takedowns. But the choices left to the executive matter more than the principles. Three stand out.
First, scope. A database "exclusively" for CSEAM must stay that way. Housing it inside the Sahyog Portal, which is better known as a takedown-notice channel, invites mission creep unless the architecture keeps it separate in practice. Second, URL lists are blunter than hashes. A URL can be reused for lawful content, so listings need expiry and review. Third, the penalty framework: "exemplary" fines scaled to company size can punish good-faith over-removal as readily as under-removal unless wrongful takedowns are also counted.
The Union must report on progress before the next hearing, listed for 10 December 2026. The first draft SOPs will show whether the executive treats the Court's safeguards as binding design constraints or as optional commentary. Policymakers in other jurisdictions weighing age bans should note which evidence the Court found missing, and what it found instead. The judgment shows that a child-safety regime can have teeth without excluding children from the internet.