National Hash and URL Database: POCSO Act, IT Act and Supreme Court Order Explained
Introduction
Fresh applications in Just Rights for Children Alliance v. S. Harish, a case the Supreme Court had decided in September 2024 (2024 INSC 716), led to a detailed order on 15 October 2026, reported as 2026 INSC 1149.[1][2] Most public discussion has been about the technology. My purpose is narrower: to explain, in plain terms, how the National Hash and URL List Database that the order proposes would sit on top of duties already found in the Protection of Children from Sexual Offences Act, 2012 (POCSO Act) and the Information Technology Act, 2000 (IT Act), and what this may mean for an ordinary user and for a small platform. The case remains pending, with 10 December 2026 as the next date. So I confine my comments to what the order itself records.
What the Order Proposes
Understanding Hashes and URL Lists
A “hash” is a digital fingerprint of a file. The order explains that once material is confirmed as child sexual exploitation and abuse material (CSEAM), its fingerprint can be stored and used to spot copies on any platform. A URL list does the same for web addresses where such material sits, which matters because sellers often share links instead of files. The Court observed that Indian law does not presently require intermediaries to use these tools to the degree seen in some other countries.
The Proposed National Database and Safeguards
The Court therefore set out the idea of one national pool of hashes and URLs, open to platforms and the police. The database would hold identifiers only, never the material itself. An entry would go in only after software screening and separate review by no fewer than three trained people. It then directed the Union, through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, to frame guidelines, a Standard Operating Procedure and any needed amendments, and to file an affidavit on progress by the next date.
The Reporting Duty That Already Exists
POCSO Act: Sections 19, 20 and 21
None of this starts from a blank page. Chapter V of the POCSO Act already makes reporting a legal duty.[3] Under Section 19(1), any person, including a child, who apprehends that an offence under the Act is likely, or knows that one has been committed, must inform the local police or the Special Juvenile Police Unit (SJPU). Section 20 puts a specific duty on staff of media houses, hotels, lodges, hospitals, clubs, studios and photographic facilities who come across sexually exploitative material involving a child in any medium: they too must report it to the same authorities. Section 21 makes failure to report punishable with imprisonment up to six months, or fine, or both. A person in charge of a company or institution who fails to report about a subordinate faces up to one year and fine. Section 19(7) protects anyone who reports in good faith from civil or criminal liability.
POCSO Rules, 2020: Rule 11
The 2020 POCSO Rules supply the mechanics in Rule 11.[4] Anyone who receives such material, or learns that it is being stored or circulated, must report it to the SJPU or the local police, or on the national portal at cybercrime.gov.in. An intermediary must also hand over the material, including its likely source. In 2024, the Court had already held that a platform cannot treat a report to a foreign non-profit as enough; it must also report to the Indian authorities named in Section 19, and its safe harbour under Section 79 of the IT Act depends on that compliance.[2]
Where Section 15 and Section 67B Come In
Section 15 of the POCSO Act
Two penal provisions do most of the work. Section 15 of the POCSO Act punishes storing or possessing such material without deleting, destroying or reporting it, with graver punishment where the purpose is to transmit or to profit. The 2024 judgment read “possession” to include constructive possession, so a person who views such material online without reporting it may, subject to the other ingredients of that provision, fall within Section 15(1).
Section 67B of the IT Act
Section 67B of the IT Act is wider.[5] It covers publishing and transmitting, but also seeking, browsing, downloading, advertising, promoting, exchanging and distributing such material, and facilitating the abuse of children online. A first conviction can bring up to five years and a fine up to ten lakh rupees. The new order adds that an advertisement or link that leads users to such material is, in substance, an advertisement of the material itself.
Reporting Requirements and Database Matches
The order ties these provisions to the reporting chain. Where an intermediary removes content because it breaches Section 15 or Section 67B, it is to report under Rule 11. For material not already in the database, the order proposes a report within two hours. For removals made because of a database match, it proposes a consolidated weekly report to the body that runs the database, so that wrong entries can be caught. The Court noted that no time limit exists today, and it asked for a standard, machine-readable reporting format.
What This Means for the Ordinary User
Reporting and Not Forwarding Material
For an ordinary person, the message is simple: report such material and never pass it on. Forwarding it to “warn” friends can itself amount to exchanging or distributing under Section 67B. Section 15(2) makes an exception for storage meant for reporting or for use as evidence, and Section 19(7) protects a good-faith informant. The safe course is a prompt report to the police or on the cyber-crime portal.
Privacy and Database Safeguards
On privacy, the order offers some reassurance. The Court said that child safety measures must stay ‘directed at the harmful material’, not at children themselves, and it was wary of age checks that require collecting sensitive data from every user. It also called for access logs, independent audits, quick removal of wrong entries with restoration of content, and it confined the database to CSEAM alone. In other words, the order does not present the hash list as a tool for general monitoring.
What This Means for Small Platforms
Legal Duties for Intermediaries
Size offers no escape. Section 20 applies however few people an establishment employs, and Rule 11(2) applies to every “intermediary” as defined in Section 2(1)(w) of the IT Act, which includes web hosts, search engines, online marketplaces and cyber cafes. The order asks every intermediary to display grievance officer details, to provide a clearly labelled CSEAM complaint category reachable within two steps, to acknowledge each complaint within twenty-four hours with a reference number, and to publish monthly compliance reports. It urges the Union to extend complaint-tracking duties, which the IT Rules now place only on a defined class of large social media platforms, to every intermediary for CSEAM complaints. It also suggests fines scaled to size and turnover.
Practical Compliance Steps for Small Platforms
A small app, forum or hosting business would do well to map its process now: who receives complaints, how fast they are escalated, how material is preserved without being circulated, and how a report reaches the Rule 11 authorities.
| Compliance Area | What the Article Identifies |
|---|---|
| Complaint handling | Display grievance officer details and provide a clearly labelled CSEAM complaint category reachable within two steps. |
| Acknowledgement | Acknowledge each complaint within twenty-four hours with a reference number. |
| Reporting | Ensure reports reach the authorities specified under Rule 11. |
| Database matches | Follow the reporting process proposed for removals resulting from database matches. |
| Compliance reporting | Publish monthly compliance reports as described in the order. |
| Internal procedures | Identify who receives complaints, how they are escalated, and how material is preserved without circulation. |
My View
In my view, the order adds machinery, not a new offence. The offences and reporting duties remain as Parliament wrote them. What the order supplies is timing, a common format and shared tools. Much will depend on what the Union places before the Court on 10 December 2026. Until then, anyone advising users or small platforms should treat the existing POCSO and Section 67B duties as fully in force and watch for the guidelines that follow.
Endnotes
- Just Rights for Children Alliance & Anr. v. S. Harish & Ors., M.A. Nos. 2553-2554 of 2026 in Criminal Appeal Nos. 2161-2162 of 2024, order dated 15 October 2026, 2026 INSC 1149: https://api.sci.gov.in/supremecourt/2026/41028/41028_2026_5_24_75330_Judgement_15-Oct-2026.pdf.
- Just Rights for Children Alliance & Anr. v. S. Harish & Ors., Criminal Appeal Nos. 2161-2162 of 2024, judgment dated 23 September 2024, 2024 INSC 716: https://api.sci.gov.in/supremecourt/2024/8562/8562_2024_1_1501_56073_Judgement_23-Sep-2024.pdf.
- The Protection of Children from Sexual Offences Act, 2012, Sections 15, 19, 20 and 21 (India Code): https://www.indiacode.nic.in/bitstream/123456789/2079/1/AA2012-32.pdf.
- The Protection of Children from Sexual Offences Rules, 2020, Rule 11 (Gazette notification G.S.R. 165(E), Ministry of Women and Child Development): https://missionvatsalya.wcd.gov.in/public/pdf/children-related-law/POCSO%20Rules%202020.pdf.
- The Information Technology Act, 2000, Sections 2(1)(w), 67B and 79 (India Code): https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf.
About the Author
Rahul Kumar, Advocate
Rahul Kumar is an Advocate practising before various courts in India, particularly the Allahabad High Court and the District Courts. Views are personal.
LinkedIn: https://www.linkedin.com/in/raahulkummar
Disclaimer
This work is not for any solicitation or advertisement. It is shared only for information and education. Views are personal, and this is not legal advice.
