Examine how adequate India's legal framework (POCSO, the IT regime and the DPDP Act, 2023) is for tackling child sexual exploitative and abuse material online.

India tackles Child Sexual Exploitative and Abuse Material (CSEAM) online through three laws. POCSO criminalises the abuse, the IT regime makes platforms liable, and the DPDP Act, 2023 protects children's data. Together they cover a lot of ground, but gaps in how the laws are written and enforced keep the framework from being fully adequate.

Strengths of the framework

• POCSO, Section 15: In Just Rights for Children Alliance v. S. Harish (2024), the Supreme Court held that storing CSEAM, or failing to delete or report it, is an offence [1]. It overruled the Madras High Court's view that mere possession is not a crime [2].
• IT regime: Section 67B of the IT Act punishes browsing or transmitting such material. Under the IT Rules, 2021, platforms must remove sexual content within 24 hours of a complaint or lose Section 79 safe harbour [3].
• Traceability: Significant social media intermediaries must help identify the first originator. They must also try to use automated tools to detect abuse material [4].
• DPDP Act: It treats anyone under 18 as a child. It bans tracking, behavioural monitoring and targeted ads aimed at children [5], and requires verifiable parental consent before their data is processed [6].

Gaps and limitations

• Legal ambiguity: Section 15 liability turns on intent to share, which is hard to prove. The statute still says "child pornography", and the Court has asked Parliament to replace it with CSEAM [1][2].
• Soft platform duties: Proactive detection is only a "best-effort" obligation [4]. Encrypted and foreign-based platforms remain hard to police.
• Slow, privacy-heavy safeguards: The DPDP Rules were notified in Nov 2025 with an 18-month phased rollout [7]. Age verification and virtual tokens also create privacy trade-offs [8].
• Weak prevention: The Court had to recommend a sex-education committee and an online POCSO complaint portal [2]. This shows the law punishes after the event more than it prevents harm.
• Siloed design: The three laws come under different ministries. The DPDP Act also regulates data, not content, so takedown and data duties do not fit together.

Overall, the framework covers crime, platforms and data on paper, but its coverage in practice is uneven. Several steps would close the gaps: amending POCSO to adopt CSEAM, making hash-based detection mandatory, strengthening Special Juvenile Police Units and cyber cells, and rolling out sex education nationwide. These would protect children without blocking their legitimate access to the Internet, in line with SDG 16.2 (ending abuse and exploitation of children).