Removing the odds between safety and freedom

1. At a Glance

• Core idea: The Supreme Court says children's access to the Internet is a fundamental right. It rejects the idea that safety and freedom are at odds and holds that protecting children "does not necessarily mean restricting their freedom" [1][3].
• Constitutional anchor: The ruling treats Internet access as an essential part of freedom of speech and expression under Article 19(1)(a) [1].
• Policy direction: Age-appropriate safeguards and shared responsibility among the State, platforms and parents, not blanket bans. Age-based restrictions are still allowed [1][3].
• UPSC relevance: The topic links fundamental rights (GS-II), cyber security and CSEAM (GS-III), the DPDP Act/Rules on children's data and ethics of State paternalism versus autonomy (GS-IV).

2. Why in the News

• An Oct 2026 order of the Supreme Court in the NGO's plea, Just Rights for Children Alliance v. S. Harish, declared that children have a fundamental right to access the Internet and that there can be no blanket ban [3].
• In the same order, the Court directed the Centre to create a national database to detect sexually explicit content showing minors and get it removed. It also clarified that the right does not rule out age-based restrictions [3].
• Before this, in Sep 2026, the Court gave the Centre a "final chance" to put on record the steps it had taken to implement the 2024 ruling on online child sexual abuse material. The bench was Justices J.B. Pardiwala and K. Vinod Chandran, and the matter was listed for 15 October [4].
• On 6 Nov 2026, C.B.P. Srivastava's op-ed in The Hindu (Chennai edition, p. 27) argued for "authority-liberty coordination", meaning reasonable restrictions under a constitutionalist approach [1].

3. Background & Evolution

• 23 Sep 2024: 2024 INSC 716. In Just Rights for Children Alliance v. S. Harish, the SC held that watching or storing child pornography can be an offence under the POCSO Act [2][5].
• Reports describe it as treating viewing, even without downloading, as "possession" [6].

• Another summary stresses mens rea and intent under Section 15 [5]. The reports differ on how far possession liability goes, so check the judgment text.

• 2024 ruling, terminology: The Court asked Parliament to replace "child pornography" with "Child Sexual Exploitative and Abuse Material" (CSEAM) and told courts to stop using the old term [5].

• 2024 ruling, platforms: Intermediaries were directed to report CSEAM offences to the authorities named under POCSO and its Rules [4].
• 2024 ruling, sex education: The Court said sex education is "not a western concept" and stressed its importance in India [6].
• 2023: Digital Personal Data Protection Act, 2023 (No. 22 of 2023) enacted. It requires verifiable parental consent to process children's data [7][8].
• Nov 2025: DPDP Rules, 2025 notified, with an 18-month phased compliance period [10].
• Sep–Oct 2026: The compliance hearing [4] led to the order recognising Internet access as a fundamental right [3].

4. Core Static Facts

Item	Fact
Case	Just Rights for Children Alliance v. S. Harish: the 2024 judgment plus the 2026 order [2][3]
Neutral citation (2024)	2024 INSC 716, dated 23 Sep 2024 [2]
Constitutional basis	Art. 19(1)(a), freedom of speech and expression [1]
Law on child sexual abuse material	POCSO Act; Section 15 deals with storing or possessing such material [5]
Preferred term	CSEAM instead of "child pornography" [5]
Data protection law	DPDP Act, 2023 (Act No. 22 of 2023) [8]
"Child" under the DPDP Act	Anyone under 18 years [7][8]
Children's data rule	Verifiable consent of a parent or lawful guardian is needed before processing [7]
Banned practices	Tracking, behavioural monitoring, targeted advertising aimed at children, and processing that harms their well-being [11]
Exemptions from parental consent	Essential services such as healthcare, education, real-time safety [9]
Ways to verify consent	Identity and age verification, virtual tokens [12]
DPDP Rules notified	Nov 2025 (PIB releases give 13 and 14 Nov) [9][10]
Compliance window	18 months, phased [10]
Nodal ministry	MeitY [8]

5. Multi-Dimensional Analysis

Legal / Constitutional

• The ruling moves Internet access from a facilitative tool to an enforceable fundamental right for children under Art. 19(1)(a) [1][3].
• Restrictions must be reasonable, which supports age-based controls but not blanket prohibitions [1][3].
• It sits alongside POCSO (criminal liability) and DPDP (data governance) to form a three-part framework [5][7].

Social

• For children, the Internet is a "gateway to knowledge, creativity and self-expression", and access is key to an inclusive, informed society [1].
• Blanket bans would hurt children who depend on online education (see the DPDP exemption for education) [9].
• The Court's call for sex education tackles vulnerability at its roots [6].

Scientific / Technological

• The national CSEAM detection database directed by the Court is a hash-and-match style takedown tool [3].
• Age verification and virtual tokens under the DPDP Rules raise tech-design and privacy trade-offs [12].

Ethical / Governance

• Safety by design versus paternalism: the Court calls the safety-versus-freedom conflict a "false notion" [1].
• Shared responsibility: intermediaries must report CSEAM [4] and data fiduciaries must not profile children [11].
• Accountability: the Court repeatedly sought compliance reports from the Centre [4].

Administrative

• Poor implementation of the 2024 directions led the Court to give the Centre a "final chance" [4].
• The Court asked whether incidents were reaching Special Juvenile Police Units or local police [4].
• The 18-month DPDP compliance window means children's data safeguards come in gradually [10].

6. Recent Developments (last 12–18 months)

• Nov 2025: DPDP Rules, 2025 notified, with verifiable parental consent mechanisms [9][10][12].
• Jan 2026: PIB published a backgrounder for International Data Privacy Day [13].
• Sep 2026: SC gave the Centre a final chance to report steps against online child abuse material, with the matter listed for 15 Oct [4].
• Oct 2026: SC declared children's Internet access a fundamental right, ruled out blanket bans and ordered a national CSEAM database [3].
• 6 Nov 2026: The Hindu op-ed "Removing the odds between safety and freedom" [1].

7. Prelims Hooks

• Just Rights for Children Alliance v. S. Harish: the SC case behind both the 2024 POCSO ruling and the 2026 Internet-access order [2][3].
• Neutral citation of the 2024 judgment: 2024 INSC 716, decided 23 Sep 2024 [2].
• The SC linked Internet access to Article 19(1)(a), not Article 21 alone [1].
• The SC recommended replacing "child pornography" with CSEAM [5].
• Storing or possessing child sexual abuse material is covered under Section 15 of the POCSO Act [5].
• Intermediaries must report CSEAM to authorities named under POCSO and its Rules [4].
• The SC ordered the Centre to build a national database to detect and remove sexually explicit content showing minors [3].
• The DPDP Act, 2023 is Act No. 22 of 2023 [8].
• A "child" under the DPDP Act is anyone under 18 [7].
• The DPDP Act bans tracking, behavioural monitoring and targeted ads aimed at children [11].
• The DPDP Rules, 2025 allow 18 months of phased compliance [10].
• Healthcare, education and real-time safety are exempt from the parental-consent requirement [9].
• Verifiable consent tools include virtual tokens and age or identity verification [12].
• 2026 bench for the compliance hearings: Justices J.B. Pardiwala and K. Vinod Chandran [4].

8. A Right to Be Online Does Not Give a Child a Phone

• The ruling stops the State from blocking. It does not promise access.
• The Court placed children's Internet access under Article 19(1)(a) (freedom of speech and expression) [1][3].
• Article 19 rights mostly protect you from the State. They stop the government from cutting you off without a good reason.

• So the ruling makes a blanket ban hard to defend [3]. But it does not, by itself, make anyone give a child a device, a data plan or a school computer.

• Children who are already offline gain little from it

• Under this ruling, a child with no connection is not "restricted". That child is simply left out.

• The note's own social argument is that access builds an "inclusive, informed society" [1]. A freedom-only right reaches mainly the children who are already connected.

• Why this matters in an answer

• Examiners reward the difference between a negative right (the State must not interfere) and a positive right (the State must provide).
• This order is clearly the first kind. Whether courts will later read a duty to provide into Article 21 or Article 21A is still an open question.

9. Checking a Child's Age Means Collecting Everyone's Data

• To protect children, a platform must first find out who is a child
• The DPDP Act needs verifiable parental consent (a check that a real parent has agreed) before a child's data is used [7].
• A platform cannot ask for that consent until it knows the user is under 18. So it has to check the age of every user, adults included.

• The tools named for this are identity or age checks and virtual tokens [12]. Each one means handing over more personal data.

• The safety rule pulls against the privacy right

• Privacy is protected under Article 21. Collecting identity data from every user cuts against it.

• A safeguard meant to reduce data collection about children ends up increasing data collection about everyone.

• One line at 18 does not fit "age-appropriate"

• The Court wants age-appropriate safeguards (rules that change as a child grows older) [3].
• The DPDP Act uses one cut-off: everyone under 18 is a "child" [7].

• So a 17-year-old preparing for a competitive exam needs the same parental consent as a 7-year-old. That is a single age rule, not a graded one.

• Parental consent assumes a parent who can give it

• The system works only if the parent can read the consent request, use the verification tool and understand what they are agreeing to.
• If the parent cannot do this, the child either stays off the service or gets past the check. Neither result protects the child.

10. Why Two Years of Court Orders Still Needed a 'Final Chance'

• The 2024 orders did not lead to visible action
• The Court's CSEAM directions came on 23 Sep 2024 [2].
• Two years later, in Sep 2026, the Court had to give the Centre a "final chance" just to put on record what it had done [4].

• The Court got no proper record of steps taken. It could not even check whether its orders were being followed.

• The reporting chain has a gap the Court itself pointed to

• Platforms must report CSEAM to the authorities named under POCSO and its Rules [4].
• The Court asked whether these cases were reaching Special Juvenile Police Units (police teams that handle cases involving children) or local police [4].

• If a report does not reach a police officer who can investigate, the platform's duty to report produces no arrest and no rescue.

• The new database order goes to the same slow system

• The Oct 2026 order asks the Centre to build a national database to detect and remove CSEAM [3].
• This is a bigger technical job than filing a compliance report. Yet the Centre was given a "final chance" on that simpler task [4].

• Unless someone tracks progress against a deadline, the database could go the same way as the 2024 directions.

• Data protection for children is not fully in force yet

• The DPDP Rules came in Nov 2025 with an 18-month phased rollout [10].
• That runs to around mid-2027. So the ban on tracking and targeted ads aimed at children [11] is not yet fully enforceable, even though the Court has already declared the right.

11. The Best Case for a Blanket Ban, and Why It Still Fails

• The strongest argument for a ban
• Online sexual abuse material cannot be taken back once it spreads. The harm is permanent, so prevention matters more than punishment.
• The State's own track record is weak. It needed a "final chance" on the 2024 directions [4].

• A simple ban is easier to enforce than a mix of consent checks, age bands and platform duties. Each of those depends on systems that are still being built [10].

• What this argument gets right

• Safeguards protect only when they actually work. Today the reporting chain is untested [4], and child-data rules are still being phased in [10].

• So "no blanket ban" is only an honest position if the safeguards arrive on time.

• Why the Court still said no

• A restriction on an Article 19(1)(a) right must be reasonable under Article 19(2). A ban that hits every child to stop harm to some fails that test. Age-based limits that target the risk can pass it [3].
• The State itself treats online education and healthcare as essential, and exempts them from parental consent [9]. A blanket ban would cut off the same services the State calls necessary.

• The abuse itself is a crime by adults. POCSO targets those who store or share such material [5]. Banning children from the Internet punishes the possible victim, not the offender.

• The honest conclusion

• The Court's idea that safety and freedom need not clash [1] holds only if the State delivers the safeguards. Without them, "freedom" means children are online with no protection.

12. Who Must Act Next, and What Each Should Do

• Parliament: change the law's wording, as the Court asked in 2024
• The 2024 judgment asked Parliament to replace "child pornography" with CSEAM [5].

• The term matters. "Pornography" suggests consent. CSEAM (Child Sexual Exploitative and Abuse Material) makes clear the child is a victim of a crime.

• The Centre: name one agency and a deadline for the CSEAM database

• The Court has ordered the database [3], but past directions stalled for two years [4].

• The Centre should name a nodal agency (one lead body that is responsible) and file regular progress reports. The Court can then check delivery instead of giving more "final chances".

• MeitY: add age bands under the DPDP framework

• MeitY is the nodal ministry for the DPDP Act [8].
• It could set different consent and design rules for younger children and older teenagers. That would match the Court's age-appropriate approach [3] better than one under-18 line [7].

• It should prefer age checks that confirm only "under or over 18", such as virtual tokens [12], over full identity uploads. That keeps the privacy cost low.

• Platforms and police: close the reporting loop

• Platforms should track each CSEAM report until a police unit receives it [4].

• States should make sure Special Juvenile Police Units are the named receivers. That answers the exact question the Court raised [4].

• Schools and education departments: teach safety as well as rules

• The Court called sex education "not a western concept" and said it is important [6].
• A child who knows what abuse looks like and how to report it gets protection that no filter or ban can give.

13. Anchors for Answers

• Law/Case: Article 19(1)(a) and 19(2), the reasonableness test any limit on children's online access must pass [1][3]
• Law/Case: Just Rights for Children Alliance v. S. Harish, 2024 INSC 716 (CSEAM under POCSO Section 15) and the Oct 2026 order (Internet access is a fundamental right, no blanket ban) [2][3][5]
• Law/Case: Earlier Internet-access cases to contrast: Faheema Shirin v. State of Kerala (Kerala HC, 2019; access linked to education and privacy) and Anuradha Bhasin v. Union of India (SC, 2020; Internet shutdowns must be proportionate)
• Law/Case: DPDP Act, 2023: a child is anyone under 18, verifiable parental consent is required, and tracking and targeted ads aimed at children are banned [7][11]; Rules of Nov 2025 with 18-month phased compliance [10]

14. Mains Relevance

• GS-II: Fundamental rights; Judiciary; Mechanisms for the protection of vulnerable sections (children); Government policies and interventions.
• GS-III: Challenges to internal security through communication networks; Cyber security.
• GS-IV: Ethics in governance; Rights versus duty of care; Ethical issues in technology.
• Possible questions: 1. "Protecting children online need not mean restricting their freedom." Discuss in the light of the Supreme Court's recognition of Internet access as a fundamental right. (GS-II, 15 marks) 2. Examine how adequate India's legal framework (POCSO, the IT regime and the DPDP Act, 2023) is for tackling child sexual exploitative and abuse material online. (GS-III, 10 marks) 3. Blanket bans versus age-appropriate safeguards: assess the ethical trade-offs between State paternalism and child autonomy in digital governance. (GS-IV, 10 marks)

15. Related Topics to Study Next

• Article 19(2), reasonable restrictions: the test any limit on children's online access must pass.
• Internet shutdowns and the proportionality doctrine: earlier case law on Internet access as part of Article 19.
• POCSO Act, 2012 and its amendments: criminal side of CSEAM; Section 15 [5].
• DPDP Act, 2023 and Rules, 2025: children's data, the Data Protection Board, consent managers [8][10].
• IT Rules, 2021 and intermediary due diligence: platform duties to report and take down content [4].
• Right to Privacy (Art. 21): tension between age verification and privacy [12].
• UN Convention on the Rights of the Child (UNCRC): global basis for children's participation and protection rights.
• Social media age bans abroad: comparison point for the "no blanket ban" stance [3].

16. NCERT Concepts to Revise

• Right to access the internet (Polity): Directly covers the Internet-access right debate; contrast Faheema Shirin and Anuradha Bhasin with this new Supreme Court declaration.
• Freedom of speech and expression (Polity): The Court anchors children's Internet access in Article 19(1)(a), so you need this right's scope.
• Reasonable restrictions (Polity): Age-based limits are allowed but blanket bans are not, which is the reasonableness test for restricting a right.
• POCSO Act 2012 (Polity): The 2024 ruling in this case treated storing child abuse material as an offence under POCSO Section 15.
• Digital Personal Data Protection Act 2023 (Polity): Sets the under-18 definition of a child, parental consent and bans on tracking children online.
• Intermediary (Polity): Platforms must report child abuse material and follow takedown duties, which is central to shared responsibility.

17. Common Errors / Trap Areas

• Mixing up the two rulings in the same case: the 2024 judgment dealt with CSEAM and POCSO possession [2][5]. The 2026 order recognised Internet access as a fundamental right [3]. The Hindu cites the case as "(2026)" [1].
• "Fundamental right" does not mean "no restrictions": the Court explicitly allows age-based restrictions [3].
• Age threshold: the DPDP Act defines a child as under 18, not under 13 as in some foreign laws [7].
• Notification date of the DPDP Rules: PIB releases differ (13 vs 14 Nov 2025) [9][10]. Remember "Nov 2025, 18-month phase-in".
• Terminology: the Court's preferred term is CSEAM, not "child pornography". Courts were told to stop using the old term [5].
• Constitutional article: the article links Internet access to Art. 19(1)(a) [1]. Don't cite only Art. 21A (education).