Between festivities, team activities and a few well-earned days off, there’s been plenty happening at Ikigai Law! And with Diwali just around the corner, we hope you have a wonderful time celebrating with family and friends.
For this month’s TechTicker, we’ve worked our way through over a 100-pages of the Supreme Court’s (SC) order on the issue of online child safety. The Court has laid out a detailed framework for how platforms should detect, remove and report child sexual exploitation and abuse material (CSEAM). We unpack what it means for platforms, why the Court is wary of blanket social media bans for children, and what to watch out for next.
In the rest of the edition, we focus on a new data framework for AI training, the news publishers’ legal challenge to the data protection law, and a High Court weighing in on whether users deserve to have a say when their content is blocked.
We’ve also got some reading recommendations, a fresh episode of the TechTicker Show on fact-checking and misinformation, and a glimpse of what we’ve been up to this past month.
I. Deep Dive
The Supreme Court steps in on child safety online
Child safety online has drawn sharper scrutiny over the past few months. Courts are hearing a growing number of PILs on children’s use of social media, many countries are announcing social media bans for children, and certain platforms have announced plans to report CSEAM directly to Indian authorities.
Amid all this, on 15 October 2026, the SC passed an order in Just Rights for Children Alliance v. S. Harish (Just Rights), in which it has effectively set out its framework for detecting, removing and reporting online CSEAM.
Revisiting Just Rights
A little back story is warranted. If you recall, in its 2024 judgment in Just Rights, the SC reiterated that platforms must report CSEAM to the local police or a Special Juvenile Police Unit (SJPU), as the Protection of Children from Sexual Offences Act (POCSO Act) requires (covered here). Reporting only to the US-based National Center for Missing & Exploited Children (NCMEC) was not enough, and a platform that failed to report could not claim safe harbour, the protection against liability for third-party content, under the Information Technology Act, 2000 (IT Act).
After a two-year hiatus, Just Rights returned to the SC with reports of alleged CSEAM promotions through paid ads and redirect links. The latest order sets out new directions for detecting, removing and reporting such material. Here’s what the order said.
- Looking at content as a whole
The Court clarified that platforms’ assessment of reported CSEAM cannot be limited to explicit images or videos. They must also consider captions, keywords, links and the function of any tool or app being promoted to determine whether the material facilitates, or is likely to result in, child exploitation or abuse.
- Coordinating detection across platforms
The Court wants detection across platforms to be better coordinated. It directed the Union government to frame guidelines for significant social media intermediaries (social media platforms with 50 lakh+ registered users in India) to use perceptual hash-matching and URL listing (as several other countries require) and to establish a national database of confirmed CSEAM hashes and URLs. The database will be shared with platforms and law enforcement, so content detected by one platform can be easily detected by all.
For context, a hash is essentially a digital fingerprint generated for an image or video. Once material is confirmed as CSEAM, platforms can check other content against its hash to identify copies. Perceptual hashing can also identify versions that have been resized or altered, while URL listing identifies links to locations hosting the material.
This flow chart below explains what the Court envisages.
Figure: How CSEAM will be detected, removed and reported
- Reporting and safeguards
The SC has also put a timeline on reporting. Platforms must now report newly found CSEAM within two hours, while removals based on a database match are reported weekly. Wherever content is taken down, a notice must replace it, saying whether it was the platform’s own call or a database match, so users know where to challenge it.
And since one wrong entry could take down lawful content on every platform, the SC wants to put safeguards in place, such as multiple levels of human review and independent audits. Users, too, should find it easier to flag such content, through a clearly labelled, anonymous reporting option no more than two steps away from the content.
- Beyond safe harbour
The Court questioned whether loss of safe harbour provides sufficient deterrence against non-compliance. It asked the Union to consider monetary fines reflecting the seriousness and recurrence of a breach and the intermediary’s size and turnover. It also said revenue derived from CSEAM or prohibited material behind paywalls or subscriptions should be forfeited and disgorged. The order does not introduce a new schedule of fines.
- Observations on social media bans
The Court also used the proceedings to comment on blanket social media restrictions for children. It questioned their effectiveness and proportionality and suggested parental oversight and a ‘child mode’ with safeguards such as private-by-default accounts. These observations were ancillary to the CSEAM proceedings, with the design of safeguards left to the discretion of the Union.
What happens next
These directions operate on two tracks. On some matters, the Court has set out specific requirements, including reporting to Indian authorities and the applicable timelines. Others require the Union to develop the implementation arrangements through guidelines, standard operating procedures and potential changes to the IT Act or IT Rules where necessary. The Union is expected to report its progress to the SC by 10 December.
II. II. Connecting the dots
A new Data Empowerment and Protection Architecture?
On 31 October, MeitY launched its Data Empowerment and Protection Architecture (DEPA) for AI Training Handbook, developed with support from iSPIRT. It proposes a framework for institutions such as banks and hospitals to make datasets available for AI training while protecting privacy, confidentiality and control over their use.
We’ve seen DEPA in the fintech space already. As we’ve written before, it underpins the account aggregator model, through which individuals can authorise financial information to be shared between institutions. Someone applying for a loan, for instance, can allow a prospective lender to access their bank records. Common technical standards and consent mechanisms facilitate that exchange.
In the case of AI, the handbook proposes combining contractual permissions with technical safeguards. Electronic contracts would specify permitted uses, while secure computing environments would allow models to learn from protected datasets without developers receiving the underlying raw data. Privacy-enhancing techniques would help limit what models reveal about individuals, and records of data sources, permissions and use would support audits. The handbook also describes a route for downloading data anonymised by its provider.
For now, this remains a proposed architecture, including pilots in finance and healthcare. Its success will depend on workable oversight, credible safeguards and incentives for institutions to participate.
III. From the courtroom to your inbox
- Can a privacy law shut the newsroom?: The Digital Personal Data Protection Act, 2023 (DPDP Act) is no stranger to the SC. In February 2026, RTI activist Venkatesh Nayak, The Reporters’ Collective and journalist Nitin Sethi, and the National Campaign for People’s Right to Information challenged several of its provisions. At the heart of their challenge was Section 44(3), which amends the Right to Information Act, 2005 (RTI Act). Section 8(1)(j) of the RTI Act let public authorities withhold personal information but allowed disclosure where a larger public interest justified it. Section 44(3) of the DPDP Act drops this safeguard and exempts personal information. The Court referred these petitions to a larger Bench but refused to stay the law at the time. The Court said the key question would be how to harmonise the two laws, and the Union sought time to justify the change.
Now, the news industry has chimed in. On 27 October 2026, the Court issued notice on a petition by the Digital News Publishers Association challenging parts of the DPDP Act and the DPDP Rules, 2025, including the RTI amendment. The publishers argue that the law was never meant to apply to journalism, and that making reporting depend on the consent of the person being reported on could amount to pre-censorship. The Court said the issue needs a balance between the rights of the press and those of citizens and that the publishers, as domain experts, were best placed to suggest safeguards against misuse. All such similar challenges have been clubbed with the lead case, i.e. Venkatesh Nayak v. Union of India. Tune in on 17 November to see what happens next.
- Blocked without a word? Not anymore: Haryana 24 News Network, a news company, found its verified Facebook page blocked in India from 21 August 2026, without any prior notice. The block followed an intimation that the Superintendent of Police (SP), Yamuna Nagar, sent to Meta the same day, alleging that the company’s director used the page to intimidate witnesses and victims. The company challenged the block before the Punjab and Haryana High Court.
Justice Tribhuvan Dahiya set aside the intimation on two counts. First, the IT Rules, 2021 let police notify an intermediary only through an officer not below the rank of Deputy Inspector General, specifically authorised by the state government. An SP cannot step in as a delegate. Second, the Rules give users no hearing before an intimation goes out. The Court read natural justice into the Rules and held that authorities must give the user a copy of the intimation when they send it to the platform. It directed the SP to have Meta restore the page within 24 hours. In a takedown system that usually runs between the State and the platform, the user finally gets a seat at the table.
IV. Global tech stories
A rough month for cybersecurity
October has been a busy month for cybersecurity researchers, and not necessarily for good reasons. Three developments caught our attention, involving the certificates that help keep websites secure, a programming language used across much of the web, and AI agents being deployed by hackers.
- First, India’s eMudhra, a company that issues digital certificates used to verify websites' identities, found itself at the centre of a major security scare. On 17 October, a researcher discovered that the private keys associated with eight of its intermediate certificate authorities were so weak that they could be recovered from publicly available information. In the wrong hands, these keys could allow someone to issue fraudulent certificates, impersonate legitimate websites and intercept supposedly secure communications. The flaw had gone undetected for around 18 months, despite two independent audits. Browser makers moved to block the affected certificates, and eMudhra announced that it would exit the global website security certificate business. The company maintains that its infrastructure was not breached and no customer data was compromised.
- Next came PHP, the programming language that powers a large share of the world's websites. Its developers released emergency fixes for two critical vulnerabilities that could allow attackers to remotely execute code on vulnerable servers without logging in. The flaws were serious enough for the UK’s National Cyber Security Centre to urge organisations to update their systems immediately. AI-assisted security research helped bring the vulnerabilities to light, showing how these tools can uncover weaknesses that conventional testing may have missed.
- But AI is also finding its way into a hacker’s attackers' toolkit. On 21 October, Microsoft reported that a China-state-aligned hacking group had used AI agents to automate attacks against hundreds of organisations, gaining privileged access to some cloud systems in under three hours. The group was also linked to a breach of ConnectWise, whose trusted access to customer systems was exploited to target over 2,250 Microsoft 365 environments. Parallely, Reuters reported that a hacker had used AI agents to break into websites belonging to more than 100 companies, including Deere and SharkNinja, at an estimated AI usage cost of just $5,000.
- These incidents are quite different, but they raise an interesting question about where cybersecurity is headed. AI is helping researchers find serious flaws faster, while also allowing attackers to test more targets and move through systems at speeds that leave defenders with little time to respond. And as the eMudhra and PHP incidents show, a weakness in infrastructure that thousands of other services depend on can have consequences far beyond the organisation where it originated.
V. Reading reccos
- In a conversation with Colin and Samir, Instagram head Adam Mosseri discusses Instagram’s latest experiments with long-form video, how its algorithms work, and what this means for creators trying to reach audiences.
- Pranay Kotasthane and Bharath Reddy of the Takshashila Institution explore how competing narratives around AI are shaping geopolitics and the policy tools governments use to gain an advantage.
- The Morning Context looks at the growing flood of AI-generated food images on delivery platforms, and what happens when the food on your screen looks nothing like what arrives at your doorstep.
VI. What’s keeping us busy
On our desks
We recently advised Navana.ai, an Indian startup building voice AI technology for Indian languages, on its INR 7 crore pre-Series A funding round led by Antler India.
As Navana moved from angel funding to its first institutional investment, we helped lay the groundwork for its next stage of growth. This meant negotiating financing terms and shareholder arrangements, including founder vesting, lock-in provisions, investor rights and board governance. The challenge was to give investors the protections they needed without limiting the founders' ability to run the business and raise future funding. Read more about our approach here.
Shoutouts
Aman Taneja, Rahil Chatterjee, Agrima Lailer and Nirmal Bhansali were at the Trust & Safety India Festival (TASI) 2026 this month, where we co-organised a panel with Google on “Reach, Revenue & Responsibility: What AI Changes for India’s Creators”. Aman moderated this panel, which brough together creators, industry representatives and policymakers to talk about how AI is changing creative work, opening new ways to earn, and raising questions around trust, authenticity and protecting creators' identities.
Our Partner, Nehaa Chaudhari, was in Copenhagen for the ITechLaw Association’s 2026 European Conference. As Vice-Chair of ITechLaw’s AI Committee, she helped lead the committee meeting and joined a panel on Copyright Aspects of AI Training. She is also the Co-Chair of the India Conference happening in Bengaluru between 28-29 January 2027. Find the conference details here.
Astha Srivastava hosted a Unified Fintech Forum webinar on IRDAI’s proposed changes to insurance distribution, discussing their implications for policyholders and distribution businesses.
Meghana Santosh participated in the Bengaluru edition of the Nasscom–MeitY workshop series on implementing India’s Digital Personal Data Protection framework.
Finally, the TechTicker Show is back on air with a new episode. In this episode, we sat down with Rajneil Kamath to talk factchecking and misinformation in the AI age. Watch it here.
The fun bits
There was plenty to celebrate this month. Astha Srivastava was promoted to Associate Partner, Akshat Tenneti and Sidharth Chamarty to A3 — you can read more about their promotions here. We also welcomed Arjun Singal, Jayasimha KR and Shivangi Tyagi to the team. Our Delhi and Bengaluru teams also swapped their desks for a visit to Amazon’s warehouses, getting a closer look at the logistics and technology behind all those doorstep deliveries. And then there was Diwali — festive outfits, good food, team celebrations and, inevitably, lots of sweets.
Signing off
Nehaa, Nirmal and Vanshika (with research assistance from our intern Khyati Thakral)
TechTicker is produced by Ikigai Law’s technology law & policy team.
For any queries, reach out to us at contact@ikigailaw.com
