🗞️ Why in News The Supreme Court, in an order dated 15 October 2026 and made public on 17 October, held that “the right to access and use the internet is a fundamental right of every individual under Article 21 read with Article 19(1)(a) of the Constitution”, and that children, “irrespective of their age enjoy the same rights”. The bench of Justices J.B. Pardiwala and K.V. Chandran called blanket bans on children’s internet use disproportionate and directed the Union to create a National Hash & URL List Database to detect and remove child sexual exploitation and abuse material (CSEAM).

The Order at a Glance

Item Detail
Court and citation Supreme Court of India, 2026 INSC 1149 (reportable)
Case Just Rights for Children Alliance and another v. S. Harish and others, M.A. Nos. 2553-2554 of 2026 in Criminal Appeal Nos. 2161-2162 of 2024
Bench Justices J.B. Pardiwala and K.V. Chandran
Dated 15 October 2026; made public on 17 October 2026
Length 136 pages, 320 paragraphs
For the Union Solicitor General Tushar Mehta
Builds on The Court’s judgment of 23 September 2024 in the same case (2024 INSC 716)
Next hearing Scheduled for 10 December 2026

Why the Court Returned to the Case

The background. In its 23 September 2024 judgment, the Court took note of “an alarming increase in child sexual exploitation and abuse material (“CSEAM”)” circulated on social media. It flagged how links to such material were shared through social media algorithms to get around Section 15 of the POCSO Act and Section 67B of the IT Act, and it made clear that platforms that failed to comply would lose the “Safe Harbour” protection of Section 79 of the IT Act.

For context, by its order of 14 August 2026, the Court had “expressed concerns over certain serious lapses” by social media intermediaries in complying with those directions. In the 15 October order it recorded: “Despite more than two years having gone by since our judgment, it appears that there has been no progress worth the name.”

Do not mix up two cases. This order was passed in the 2024 criminal appeals. A separate writ petition by the same alliance, W.P.(C) No. 1120 of 2026, on regulating social media accounts of children below 18, is pending before a bench led by the Chief Justice, which issued notice on 10 September 2026 and heard it on 28 September 2026 (background in our 29 September roundup).

The Holding: Internet Access Under Article 21 and Article 19(1)(a)

The core of the order is paragraph 292:

“we have no hesitation in saying that the right to access and use the internet is a fundamental right of every individual under Article 21 read with Article 19(1)(a) of the Constitution. Our children, irrespective of their age enjoy the same rights, and to deny the same altogether would be as absurd as saying children below a certain age do not have a conscience worth protecting or a freedom of speech worth expressing. The safety of our children and their freedom are not at odds with each other. Our children are entitled to both.”

Provision Text
Article 21 “No person shall be deprived of his life or personal liberty except according to procedure established by law.”
Article 19(1)(a) “All citizens shall have the right ... to freedom of speech and expression”

The cases the order builds on

Case What the order takes from it
Secretary, Ministry of I&B v. Cricket Association of Bengal (1995) 2 SCC 161 Article 19(1)(a) includes the right to receive information
Anuradha Bhasin v. Union of India (2020) 3 SCC 637 Freedom of speech and of trade “through the medium of the internet is constitutionally protected” under Articles 19(1)(a) and 19(1)(g); but the Court then “refrained from expressing any view on whether the right to access the internet is, by itself, a fundamental right and left the question of law open”
Pragya Prasun v. Union of India (2025 INSC 599) The right to digital access is an intrinsic part of Article 21 (a case on digital KYC for persons with disabilities)

On the question Anuradha Bhasin left open, the order says “this issue is no longer res-integra”, that is, no longer an open question.

A 2019 Kerala High Court ruling in Faheema Shirin had held that “the right to have access to Internet becomes the part of right to education as well as right to privacy”. The 15 October order does not cite it, so treat it as background, not as part of this order’s reasoning.

Age Limits and Bans: What the Court Said

The child is not the problem. The wrongdoer, the Court said, “is the person who creates, circulates, sells or seeks out such material, and the intermediary which fails to detect and remove the same. To keep the child away from the internet on account of such failures would be to mistake the victim for the problem.”

Blanket bans fail the proportionality test. “[A]ny blanket restriction on the access of internet by children is nothing more than unproven measures of proven disproportionality. No jurisdiction has, so far, been able to demonstrate that children are any safer on account of such measures.”

Age checks carry a privacy cost. Age-based restrictions, the Court said, “inevitably, always require identifying and ascertaining the age of each and every user, continuous collection and monitoring of sensitive data and an overall disproportionate risk of misuse and surveillance, the kind which finds no place within the right to privacy of our people.”

But safeguards are allowed. The Court added that “this does not mean that there should be no age-based restrictions” and that “some form of safeguards are necessary”. It suggested what such a system could look like:

What the Court suggested (paras 300-301) Status
“a system that places greater emphasis on parental consent, guidance and oversight” on children’s access to social media, with a dedicated “child mode” A suggestion: “there could be a system”
Accounts private by default; restrictions on contacts and messages from unknown adults; moderation of advertising and content accessible to children “may be implemented for pre-teens, with a reasonable and proportionate means to verify parental consent”
Who decides how “We leave the actual modalities of the same to the wisdom of the Union of India.”

The Union also remains free to restrict children’s access to content or services “that are inherently harmful to them, such as adult content websites etc.” (para 302).

So parental consent is not a direction of the Court; it is an option left to the government. For the argument that a parental-consent rule would make the new right conditional, read our analysis of the Indian Express column on parental consent.

The Directions: A National Hash and URL List Database

Process

How the order wants CSEAM detected and removed

The National Hash & URL List Database, the two removal routes, grievances and penalties.

National Hash & URL List Database "shall create": for the sole purpose of the detection and removal of CSEAM; part of the Sahyog Portal or a standalone repository Screening at least three trained human analysts independently determine whether the material is CSEAM "Known Origin" matches an entry in the database: disable and remove immediately, without awaiting any further verification; weekly report of removals "Unknown Origin" no match; found through complaints or the platform’s own tools: report within two hours of removal, or of resolving a complaint two routes Grievances access within two steps; acknowledged within twenty-four hours; decided by a trained grievance officer Penalties and the law Union to consider exemplary monetary fines; paywall revenue from CSEAM to be forfeited and disgorged; rethink beyond Section 79 Next hearing: 10 December 2026 scheduled; the Union’s progress affidavit is due by then
The order’s removal system: a Union database screened by human analysts, immediate removal of known material, two-hour reporting of new material, a grievance route, and penalties still to be considered.

The binding part of the order is a set of directions for the Union and for intermediaries to carry out. Note the verbs: the database is a “shall create” direction, while fines are only to be considered.

Area What the order says
Tools affidavit The Union “shall provide information, by way of an affidavit, on the tools and technological measures that have been put in place by intermediaries for the detection and removal of CSEAM”
Guidelines Guidelines for significant social media intermediaries on hash-matching and URL listing
The database “The Union of India shall create a National Hash & URL List Database for the sole purpose of the detection and removal of CSEAM”, either as part of the Sahyog Portal of the Indian Cyber Crime Coordination Centre or “as a standalone repository”
Screening Final screening “by at least three trained human analysts, who would independently determine whether the material in question constitutes CSEAM”
“Known Origin” CSEAM Material that matches an entry in the database: the intermediary “shall immediately disable and remove the same, without awaiting any further verification at its end”; all such removals go in a consolidated weekly report to the authority that maintains the database
“Unknown Origin” CSEAM Material with no match in the database, found through complaints or the platform’s own tools: each removal to be reported within two hours of the removal or, for a removal made on a complaint, within two hours after the complaint is resolved; it must also be reported to the authority that maintains the database
Grievances Grievance access “within two steps”; a complaint acknowledged “within twenty-four hours”; decided by “a trained grievance officer”
Penalties The Union “shall further consider putting in place a framework for imposing exemplary monetary fines”; revenue earned from CSEAM through any paywall or subscription “should be forfeited and disgorged”
Law Guidelines, SOPs and “suitable amendments to the IT Act and the IT Rules, where necessary”
Implementation The Union, through the Ministry of Electronics and IT (MeitY) and the Ministry of Law and Justice; an affidavit on progress “by the next date of hearing”

Beyond Section 79. Under the present law, the Court noted, losing the Section 79 safe harbour is the only consequence for an intermediary that fails. One section of the order is headed “Need to rethink and move beyond Section 79 of the IT Act.”

Sixteen Measures for Schools, Teachers and Platforms

Paragraph 315 lists 16 measures. The ones most likely to be examined:

  • Body safety from the primary stage: “Children, from the primary stage, must be taught in an age-appropriate manner about their bodies, the difference between safe and unsafe touch, and the significance of consent.”
  • Curriculum: digital safety and age-appropriate sex education to form part of the core curriculum developed by the NCERT and the SCERTs.
  • Helplines on the wall: Child Helpline 1098, Cyber Crime Helpline 1930 and the National Cyber Crime Reporting Portal, “displayed in every classroom, hostel, library and computer laboratory”.
  • Teacher training: including “the obligation to report under Section(s) 19 and 21 of the POCSO Act”.
  • Platform prompts: intermediaries to “display cautionary prompts where any child attempts to connect, message or interact with any unknown adult”.

Static Background: The Laws in Play

Law What it provides
POCSO Act, Section 15(2) (as substituted in 2019) Storing or possessing pornographic material involving a child for transmitting or distributing it (except for reporting) is punishable with imprisonment up to three years, or fine, or both
POCSO Act, Sections 19 and 21 (as the Court describes them) Anyone who apprehends or knows of a POCSO offence must report it to the Special Juvenile Police Unit (SJPU) or the local police; failure is punishable with imprisonment up to 6 months or fine or both
IT Act 2000, Section 67B Named by the Court, with POCSO Section 15, among the penal provisions “designed for the protection of children within the cyberspace”: up to five years and fine up to Rs 10 lakh on first conviction; up to seven years and fine up to Rs 10 lakh on a second or later one. “Children” means persons who have not completed 18 years
IT Act 2000, Section 79 Safe harbour: “an intermediary shall not be liable for any third party information, data, or communication link made available or hosted by him”, subject to conditions
DPDP Act 2023, Section 9 Parental consent (“verifiable consent of the parent”) before processing any personal data of a child; no “tracking or behavioural monitoring of children or targeted advertising directed at children”. A child is anyone under 18. Exemptions are allowed under Section 9(4) and (5) and Rule 12 of the 2025 Rules; PIB’s note says consent is needed “unless the processing relates to essential services such as healthcare, education or real-time safety”. Penalty for breach: up to Rs 200 crore
DPDP Rules 2025, Rule 10 Notified in November 2025. A platform must check that the person consenting as a parent is an adult, by reference to “reliable details of identity and age” it already holds, or to such details provided voluntarily by the person or through a virtual token issued by an authorised entity. The Rules give eighteen months for phased compliance, so Rule 10 applies from 2027. MeitY consulted in January 2026 on cutting the period to 12 months, but no amendment had been notified as of October 2026

Note the difference in age: the DPDP Act requires parental consent for users under 18, subject to those exemptions, while the measures the Court suggested with parental-consent checks are for pre-teens. How the two fit is for the Union to settle.

Significance and Issues: The Mains Angle

  1. A settled right. The question Anuradha Bhasin left open in 2020 now has an answer, and the answer covers children.
  2. Rights-based child protection. The Court rejects the trade-off between safety and freedom: “Our children are entitled to both.” It places the burden on the offender and the platform, not the child.
  3. Privacy as a limit on safety tools. By naming the data cost of age verification, the order makes privacy part of the test for any child-safety rule.
  4. Platform accountability beyond safe harbour. Hash databases, timelines, human review and possible fines move the regime past the all-or-nothing Section 79 shield.
  5. Open issues. The modalities of any parental-consent system are left to the Union; hash databases need trained human analysts and safeguards against wrong takedowns; and two years of slow compliance after 2024 show that directions alone do not change platform behaviour.

Way Forward

  • Build the database with clear rules on who adds entries, how the three-analyst review works and how wrong entries are corrected.
  • Child-safe defaults (private accounts, limits on contact from unknown adults, moderated advertising) as platform obligations.
  • Age assurance with data minimisation, so that protecting children does not mean tracking every user.
  • Schools and teachers: digital safety in the core curriculum, helplines displayed, and teachers trained on POCSO reporting duties.
  • Watch next: the Union’s progress affidavit, due by the next hearing on 10 December 2026.

UPSC Relevance

  • GS Paper 2: Fundamental Rights (Articles 19 and 21); role of the judiciary; mechanisms for the protection of vulnerable sections (children); government policies and interventions.
  • GS Paper 3: challenges to internal security through communication networks; role of social networking sites; basics of cyber security.
  • Prelims: Article 21 and 19(1)(a), Anuradha Bhasin, Section 79 and Section 67B of the IT Act, POCSO Sections 15, 19 and 21, DPDP Act Section 9, helplines 1098 and 1930, the Sahyog Portal.
  • Mains practice question: “The Supreme Court has held that children enjoy the fundamental right to access and use the internet. Examine how the State can protect children online without denying that right.” (GS2, 250 words)

📌 Facts Corner, Knowledgepedia

Prelims, statement-ready facts:

  • Order dated 15 October 2026, made public 17 October; 2026 INSC 1149; Justices J.B. Pardiwala and K.V. Chandran.
  • Internet access and use: a fundamental right of every individual under Article 21 read with Article 19(1)(a), children included.
  • Earlier judgment in the same case: 23 September 2024, 2024 INSC 716 (Just Rights for Children Alliance v. S. Harish).
  • CSEAM: child sexual exploitation and abuse material.
  • National Hash & URL List Database: to be created by the Union, within the Sahyog Portal or as a standalone repository.
  • Screening by at least three trained human analysts.
  • “Unknown Origin” removals reported within two hours (of removal, or of resolving a complaint); “Known Origin” removals in a weekly report.
  • Displayed in every classroom: Child Helpline 1098, Cyber Crime Helpline 1930, National Cyber Crime Reporting Portal.
  • IT Act s.67B: up to 5 years and Rs 10 lakh fine on first conviction; up to 7 years on a second.
  • DPDP Act 2023 s.9: verifiable parental consent for a child’s data (under 18); no tracking or targeted ads at children.
  • Next hearing: 10 December 2026 (scheduled).

Prelims, the traps:

  • Trap: the Court did not order parental consent. It said “there could be a system” and left the modalities to the Union of India.
  • Trap: Anuradha Bhasin (2020) left open whether internet access is itself a fundamental right; the 2026 order settles it.
  • Trap: Article 19(1)(a) is a right of “all citizens”; Article 21 protects every “person”.
  • Trap: this order is in the 2024 criminal appeals; the separate W.P.(C) 1120 of 2026 before the Chief Justice’s bench is pending.

Mains, arguments and keywords:

  • “Mistake the victim for the problem”: the wrong lies with the offender and the platform that fails to remove CSEAM, not the child.
  • Age checks need data on every user and risk surveillance; keywords: proportionality, privacy, child mode, platform accountability.
  • Way forward: build the database, child-safe defaults, age assurance with data minimisation, digital safety in the core curriculum.

Interview, be ready for:

  • “Should India ban social media for children?” Answer: the Court calls blanket bans “unproven measures of proven disproportionality”; prefer safe defaults and parental guidance.

Revision Flowchart

Revision flowchart

Children’s Right to Internet: Article 21 Right, Rules SC

Covers the terms, Prelims pointers and traps, Mains pointers, what to watch next and a practice question.

Supreme Court, 15 October 2026: internet access a fundamental right, children included Article 21 read with Article 19(1)(a); 2026 INSC 1149 Justices J.B. Pardiwala and K.V. Chandran (GS2, GS3) Know the terms CSEAM child sexual exploitation and abuse material "Known Origin" material that matches an entry in the database "Unknown Origin" no match; found through complaints or the platform’s own tools Prelims pointers Article 21 read with 19(1)(a) right to access and use the internet; children "irrespective of their age" Anuradha Bhasin (2020) left the question open; now "no longer res-integra" Helplines Child Helpline 1098; Cyber Crime Helpline 1930 Mains pointers Victim, not the problem the wrong lies with the offender and the platform that fails to remove CSEAM Privacy cost age checks need data on every user and risk surveillance Beyond Section 79 for an intermediary that fails, losing the safe harbour is the only consequence under the present law Watch next Hash database a "shall create" direction to the Union Parental consent a suggestion; modalities left to the Union of India 10 December 2026 next hearing (scheduled); progress affidavit due by then PRELIMS TRAPS left: the tempting wrong line · right: the fact ✗ The Court ordered parental consent for children on social media. ✓ It said "there could be a system" and left the modalities to the Union of India. ✗ Anuradha Bhasin (2020) made internet access a fundamental right. ✓ It left that question open; the 2026 order settles it. ✗ Article 19(1)(a) protects every person. ✓ Article 19(1)(a) is a right of "all citizens"; Article 21 protects every "person". QUICK RECALL cover the right column, then check Neutral citation of the order? 2026 INSC 1149 Earlier judgment in the case? 23 September 2024 (2024 INSC 716) Who screens material for the database? At least three trained human analysts Cyber Crime Helpline number? 1930 DPDP Act section on children’s data? Section 9 MAINS KEYWORDS Article 21 Proportionality Right to privacy Child mode Safe harbour Platform accountability MAINS PRACTICE GS2 · 250 words The Supreme Court has held that children enjoy the fundamental right to access and use the internet. Examine how the State can protect children online without denying that right.
Revision flowchart: terms, Prelims facts and traps, Mains pointers. Cover the answers and test yourself.

Sources: Supreme Court of India, M.A. Nos. 2553-2554 of 2026 in Criminal Appeal Nos. 2161-2162 of 2024, Just Rights for Children Alliance and another v. S. Harish and others, order dated 15 October 2026, 2026 INSC 1149 (order text); Bar & Bench, Ritu Yadav, 17 October 2026; The Hindu, 17 October 2026; Constitution of India; Information Technology Act, 2000; POCSO (Amendment) Act, 2019; Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY; PIB background note, 17 November 2025); Supreme Court record of proceedings in W.P.(C) No. 1120 of 2026, 10 September 2026; LiveLaw, 19 September 2019, on Faheema Shirin.

Source: Children's Right to Internet: Article 21 Right, Rules SC — Ujiyari.com | Free UPSC & State PCS Current Affairs