Supreme Court CSEAM Hash Database Order (2026)

Quick answer: In Just Rights for Children Alliance v. S. Harish (2026 INSC 1149), the Supreme Court directed the Union to develop a national hash and URL list for detecting and removing child sexual exploitation and abuse material (CSEAM). Its 15 October 2026 order also addresses platform reporting, human review, and safeguards against wrongful removal. The framework requires government implementation; it should not be described as a database already operating nationwide.

The order matters for technology law because harmful material can move across platforms through altered copies and indirect links. A platform-by-platform response may leave the same material accessible elsewhere. The Court examined how shared detection tools could work alongside the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and duties under the Protection of Children from Sexual Offences Act, 2012 (POCSO).

Case: Just Rights for Children Alliance & Anr. v. S. Harish & Ors., M.A. Nos. 2553–2554 of 2026 in Criminal Appeal Nos. 2161–2162 of 2024, Supreme Court of India, 15 October 2026, 2026 INSC 1149. Bench: J.B. Pardiwala and K. Vinod Chandran JJ. Read the full order on the Supreme Court’s official website.

Why did the Supreme Court revisit online child safety?

The applications followed the Court’s 2024 judgment in the same litigation. The Court recorded concerns about continued circulation of CSEAM, including links directing users to material elsewhere, and about failures to report it to the authorities identified under POCSO. It noted that an intermediary’s report to a foreign organisation does not replace its obligation to report to the Special Juvenile Police Unit or local police under the domestic framework.

The 2026 order asks the Union to report what tools intermediaries have deployed and to work on a coordinated detection and reporting system. It is an order on implementation and safeguards in continuing proceedings, with a progress affidavit sought for the next hearing.

What are hash matching and URL listing?

A hash is a digital identifier derived from content. Perceptual hash matching aims to detect visually or audibly similar material even if someone resizes or reformats it. URL listing targets web addresses leading to harmful material, including cases where a post shares a link without hosting the underlying file. These tools address different routes by which the same material may spread.

In paragraph 316, the Court directed the Union to frame appropriate guidelines or standard operating procedures for significant social media intermediaries to use perceptual hash matching and URL listing. It also called for an assessment of whether the tools could be used across the broader intermediary sector and for changes to the IT Rules where necessary.

How would the national database work?

The Court directed the Union to create a National Hash and URL List Database solely for the detection and removal of CSEAM. It could form part of the Sahyog Portal or exist separately. The design in paragraph 316 includes safeguards:

Material would enter the database only after multiple levels of assessment. Software may help with initial screening, but at least three trained human analysts must independently make the final determination.
The database would hold the confirmed material’s hash identifier and/or URL, with entries made through encrypted channels.
A platform finding a match with a verified database entry would remove or disable access without repeating verification at its end. Newly discovered material of unknown origin requires the intermediary’s own verification and due diligence before being added to the shared list.
Removal notices and routes to challenge a decision differ depending on whether the removal followed the platform’s own detection or a match with the national list.

Key distinction: The order describes the system the Union must establish and oversee. It does not say the proposed database had already been launched on 15 October 2026.

What does the order say about reporting and grievance officers?

The Court’s summary specifies reporting to the Special Juvenile Police Unit, local police and/or the cybercrime portal, as applicable under Rule 11 of the POCSO Rules. It distinguishes newly detected material from matches against the proposed database: the former calls for prompt case reporting, while the latter is to be covered by a consolidated weekly report to the database authority. For several newly detected cases, the summary sets an outer limit of two hours after complaint resolution or removal, depending on how the content was identified.

It also calls for a clearly labelled CSEAM reporting option, trained grievance officers, human review of complaints, tracking information for complainants, and a separate account of these complaints in compliance reports. The Union is to formulate guidelines, procedures, and suitable legal amendments where necessary. Existing statutory duties and the proposed implementation details should be read separately.

Did the Court address children’s internet access?

Yes. In paragraph 292, the Court recognised access to and use of the internet as a fundamental right under Article 21 read with Article 19(1)(a), including for children. It rejected a blanket restriction on children’s internet access as a substitute for proportionate safety measures. The order pairs child safety with access, privacy, and procedures that help prevent erroneous takedowns.

What happens next?

Paragraphs 317–320 direct the Union, through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, to take appropriate action on the measures and safeguards, formulate guidelines and standard operating procedures, and consider suitable amendments to the IT Act and IT Rules where necessary. The Union must file a progress affidavit. The matter was listed for 10 December 2026; readers should check later court records before assuming implementation has been completed.

Key takeaways

The Supreme Court directed the creation of a national hash and URL list dedicated to detecting and removing CSEAM.
Final verification before entry into the proposed database requires trained human analysts; safeguards include encrypted entries and challenge procedures.
Platforms’ reporting under POCSO remains a distinct obligation; the order seeks more precise processes and timelines.
The Court affirmed children’s internet access while calling for proportionate online safety measures.
The implementation framework remains subject to the Union’s action and further court oversight.

Frequently asked questions

Has the national hash and URL database already been launched?

The 15 October order directs the Union to create it. The order does not establish that it was operational on that date.

Is a hash the same as a URL?

No. A hash helps identify content or a close match; a URL identifies an online address where material may be found.

Can an intermediary rely only on reporting to a foreign organisation?

No. The Court reiterated the need to report as required by POCSO to the specified Indian authorities.

Will automated tools make every final decision?

No. The proposed database requires final review by at least three trained analysts before an entry, and the order calls for trained grievance officers to decide platform complaints.