Is India’s IT Act a Toothless Tiger? Tech Companies’ Liabilities in Focus Over CSEAM Lapses

In an order dated 15 October 2026, the Supreme Court of India flagged persistent failures by intermediaries to comply with their statutory obligations concerning Child Sexual Exploitation and Abuse Material (“CSEAM”). Observing that the absence of meaningful consequences for non-compliance has allowed intermediaries to continue flouting the requirements of India’s information technology framework, the Court asked the Union Government to consider exemplary monetary fines for such defaults.

Under the Information Technology Act, 2000 (“IT Act”) and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“IT Rules”), an intermediary which fails to comply with its regulatory requirements risks losing the safe harbour protection under Section 79 of the IT Act. As the Court observed, this consequence is essentially post-facto, as it exposes the intermediary to liability in respect of particular third-party content or information constituting an offence under the law, rather than addressing the underlying regulatory default itself.

Remarking that the IT Act and the rules framed thereunder should no longer remain a “toothless tiger”, the Court observed that what is required is a distinct set of consequences that can be attracted by the default itself, without having to await the commission of an offence.

The 2024 judgment: Reporting is part of intermediary due diligence

The proceedings arise from Just Rights for Children Alliance & Anr. v. S. Harish & Ors., Criminal Appeal Nos. 2161-2162 of 2024, decided by the Supreme Court on 23 September 2024. The Court had set aside a Madras High Court order quashing criminal proceedings in a case involving CSEAM found stored on an individual’s mobile phone, and restored the proceedings for consideration in accordance with law. The judgment also clarified the scope of offences under Section 15 (punishment for storage of pornographic material involving child) of the Protection of Children from Sexual Offences Act, 2012 (“POCSO Act”) and Section 67B (punishment for publishing or transmitting of material depicting children in sexually explicit act, etc., in electronic form) of the IT Act.

Importantly, the Court held that an intermediary’s due diligence obligations under Section 79 of the IT Act extend beyond removing CSEAM to reporting such content to the authorities specified under the POCSO Act. It added that reporting such material to the National Center for Missing & Exploited Children (“NCMEC”), a US-based NGO, does not dispense with the obligation to report it to the Special Juvenile Police Unit (“SJPU”) or local police, or the cyber-crime portal, as required under Sections 19 and 20 of the POCSO Act read with Rule 11 of the Protection of Children from Sexual Offences Rules, 2020 (“POCSO Rules”).

The Court accordingly held that an intermediary cannot claim safe harbour protection under Section 79 of the IT Act merely by removing the offending content without also complying with the applicable reporting requirements under the POCSO Act and the rules thereunder. Section 21 of the POCSO Act separately prescribes punishment for failure to report an offence as required under the Act.

Investigations expose gaps in Meta’s advertising and recommendation systems

The renewed scrutiny of intermediary compliance followed investigations earlier this year into the circulation and promotion of CSEAM through Meta’s platforms.

In July 2026, a BBC Eye investigation found that Instagram was displaying paid advertisements promoting CSEAM in India, with some advertisements directing users to Telegram channels where such material was being offered for sale. The investigation also demonstrated how Instagram’s recommendation systems could expose users to such advertisements after they interacted with profiles posting sexually suggestive content.

Following the investigation, the Government directed Meta to disable advertisements and content on Instagram promoting or facilitating access to CSEAM.

In August 2026, the Tech Transparency Project (“TTP”) shared its initial findings with Wired that Meta had run 53 advertisements containing child sexual abuse material; its investigation has since found more than 300 paid advertisements with such material that ran on Facebook and Instagram this year.

Fresh proceedings before the Supreme Court

Following these developments, the applicants approached the Supreme Court in Just Rights for Children Alliance & Anr. v. S. Harish & Ors., M.A. Nos. 2553-2554 of 2026 in Criminal Appeal Nos. 2161-2162 of 2024, raising serious concerns about intermediaries’ failures to comply with the due diligence obligations cast upon them under the IT Act and the mandatory reporting obligations under the POCSO Act and Rules.

In its order dated 15 October 2026, the Court expressed concern that, despite more than two years having elapsed since its earlier judgment, there had been little progress in addressing the circulation of CSEAM and ensuring compliance by intermediaries. It noted that the existing mechanisms relied heavily on individual reports and complaints, without adequate coordination between platforms for the detection and removal of identified material. To address this, the Court directed the creation of a National Hash & URL List Database, a common repository of verified hash identifiers and URLs that would enable intermediaries to detect and remove identified CSEAM simultaneously across platforms.

The Court also took note of the failure of intermediaries to adequately identify material that indirectly facilitates child exploitation. In particular, advertisements promoting applications or tools capable of manipulating images and videos of children to create sexually exploitative and abusive material had, in some instances, been allowed to remain on platforms because they did not themselves contain explicit depictions of abuse. The Court observed that intermediary obligations under the IT Act and the IT Rules extend beyond removing material that explicitly depicts child abuse and include preventing material that facilitates or promotes such exploitation from being uploaded, hosted or circulated.

Against this backdrop, the Court called for a more effective framework for detecting and removing CSEAM, strengthening grievance redressal and reporting mechanisms, and ensuring appropriate human oversight of automated systems. It also directed the Union Government, through the Ministry of Electronics and Information Technology and the Ministry of Law and Justice, to formulate appropriate guidelines, standard operating procedures and amendments to the IT Act and the IT Rules, wherever necessary.

Significantly, the Court asked the Union Government to consider a framework providing for exemplary monetary fines for regulatory defaults by intermediaries, with the quantum taking into account the gravity, duration and recurrence of the default, as well as the size and turnover of the intermediary. Such fines would apply in addition to the loss of safe harbour protection under Section 79.

Reporting obligations: The gap between law and practice

Despite the legal position clarified in 2024, the Court noted that social media intermediaries continued to report instances of child abuse and exploitation to NCMEC, which would then forward the information to the National Crime Records Bureau (“NCRB”) under the Ministry of Home Affairs. The NCRB, in turn, would forward the reports to the concerned State authorities through the National Cyber Crime Reporting Portal.

The Court observed that intermediaries were not reporting such cases directly to the authorities specified under the POCSO Act and were instead relying on the reporting arrangement under the memorandum of understanding between the NCRB and NCMEC. It reiterated that reporting through NCMEC alone does not satisfy the statutory obligation to report to the SJPU or local police, or the cyber-crime portal under the POCSO framework.

There have, however, been developments in this regard. In September 2026, Meta announced that it would report child safety cases directly to the National Cyber Crime Reporting Portal run by the Indian Cyber Crime Coordination Centre (“I4C”), in addition to its existing reporting arrangements involving NCMEC. Google subsequently announced that it would report content flagged as CSEAM directly to Indian authorities.

Beyond reporting: Who is accountable for what algorithms recommend?

The Supreme Court’s latest order underscores the need to first establish an effective system for detecting CSEAM, ensuring its timely removal, facilitating reporting and grievance redressal, and attaching meaningful consequences to failures by intermediaries to discharge these obligations.

Once the framework for detection, removal, reporting and grievance redressal is effectively implemented, and non-compliance is backed by meaningful consequences, a further question arises: how should intermediaries be held accountable for the content their own algorithms recommend, amplify or promote? In our previous update, we highlighted that Indian officials had indicated that Meta cannot claim “intermediary” status under the IT Act if its systems actively determine what content users receive, and that safe harbour protections may not apply where algorithms recommend or amplify illegal content rather than merely host it. The challenge, therefore, extends to ensuring accountability for the systems through which such violations are facilitated.

In this context, it is relevant to note that, in August 2026, a court in New Mexico found that Meta had substantially contributed to a public nuisance by exposing children to harm, ordering the company to pay US$567 million — in addition to US$375 million in civil penalties a jury had awarded in March for misleading users about platform safety. The court rejected Meta’s claim of immunity under Section 230 of the US Communications Decency Act (47 U.S.C. § 230) on the grounds that the case targeted Meta’s own product design and algorithmic choices, not third-party content it merely hosted.

The matter before the Supreme Court of India will be heard next on 10 December 2026, by which date the Union Government is required to file an affidavit setting out the progress made towards implementing the Court’s directions.

In the meantime, intermediaries should review their internal processes to ensure that CSEAM is not only removed but also reported directly to the SJPU or local police, or the cyber-crime portal, as required under the POCSO framework, rather than through NCMEC alone.