How Instagram ads row underlines India’s problem with reporting child abuse material

The NHRC’s order raised two questions: on whether statutory reporting obligations under the Protection of Children from Sexual Offences (POCSO) Act, 2012, were complied with, and whether platforms whose AI systems actively shape content can continue to claim the legal protections available to intermediaries.

What NHRC asked

On compliance with statutory obligations, the NHRC has asked Meta whether alleged offences were reported, and if not, for it to identify those responsible for ensuring compliance.

Under the POCSO Act, Section 19 mandates that any person “who has apprehension that an offence under this Act is likely to be committed or has knowledge that such an offence has been committed” shall report it to the Special Juvenile Police or the local police unit. This obligation, the Commission states, “cannot be substituted by internal correspondence, grievance redressal or regulatory engagement”.

On a supplementary representation filed before the Commission, which argues that Meta’s AI-assisted tools now does more than host third-party content, that is, the company’s systems can generate captions, recommend posting schedules, optimise engagement, and assist monetisation.

The NHRC noted that this raises a “significant regulatory question” concerning platforms whose AI-enabled systems participate in “generating, editing, transforming, recommending, assisting and disseminating content”.

It has asked MIB to examine whether such functions remain consistent with intermediary status, or whether they resemble the role of a publisher of online curated content under the IT Rules, 2021, framing the issue as whether the law adequately distinguishes “mere hosting/transmission of third-party content” from “substantive platform involvement in its generation, modification, curation, recommendation, publication, amplification or monetisation”.

Where this fits into India’s larger problem

The Meta case turns on a single complaint. But it lands inside a system that already struggles to convert reports into prosecutions. India received around 1.9 million CyberTipline reports in 2025. Yet only a fraction of these translate into police action.

CyberTipline reports are alerts that are generated when tech platforms detect suspected child sexual abuse and exploitation material (CSEAM). Once a report is linked to India, it is routed to Indian authorities for verification and investigation. These reports include images and videos depicting child sexual abuse, attempts to distribute such material, online grooming, sextortion, trafficking related content, or accounts suspected of sharing or storing CSAM.

A CyberTipline report begins outside India. Tech platforms detect suspected CSEAM and report it to the National Centre for Missing and Exploited Children in the US, which operates the CyberTipline. When the activity appears linked to India, the report is then forwarded to the Indian authorities.

According to Naresh Diwan of the Delhi Police Cyber Cell, the reports are processed by the NCRB and the Indian Cybercrime Coordination Centre (I4C). Both of these function under the Union Ministry of Home Affairs. Once data is received, the reports are routed through a central system and assigned to the relevant state and district authorities. 

In Delhi, this state-level agency is the Intelligence Fusion and Strategic Operations (IFSO) unit. Diwan said that IFSO receives the report from the NCRB and I4C, verifies the district it points to, and forwards it to the relevant police station along with a tipline number. Investigators then seek two categories of information from the platform — who sent the material, and who received it.

NCRB’s 2024 Crime in India report offers a measure of how much survives that funnel. Of 1,238 cybercrime cases registered against children under the IT Act that year, 1,099 — nearly nine in 10 — involved publishing or transmitting sexually explicit material depicting children.

Before an FIR is registered, authorities conduct a preliminary verification exercise. 

Investigators use information contained in the CyberTipline report — including the account details, IP logs, linked email addresses, phone numbers, account creation records, and digital hash values — to identify the jurisdiction from which the content was uploaded or shared.

A hash value functions as a digital fingerprint of a file. Investigators compare this hash of material recovered during the inquiry with the hash contained in the CyberTipline report to verify that both refer to the same content.

But not every report progresses beyond this stage. Experts say that these reports vary significantly in quality and completeness, as some contain enough information to support immediate action, while others require additional verification before investigators can determine whether an offence has occurred.

Registration of FIR

When investigators recognise the jurisdiction and access the flagged material, they assess whether it prima facie depicts child sexual abuse material. “If viewing the video or photograph makes it appear, prima facie, that this is an obscene material pertaining to a minor, we register an FIR on that basis,” Diwan said. 

The digital nature of the reporting chain means that registration is generally tied to the material and technical evidence available in the report. Once the jurisdiction is identified and the material verified, the case is forwarded to the local police station or cyber police unit for registration and investigation.

One of the more recurring difficulties is verifying the age of the victim. Diwan says that there are cases where images and videos do not clearly establish whether the person depicted is a child. Poor image quality, blurred visuals, or uncertainty about age can prevent authorities from proceeding. “So usually when the background is blurred, and the images are not clear, we do not register a case either,” he said.

Once an FIR is registered, investigators begin the process of identifying the individual behind the account. Police obtain subscriber information from platforms, trace IP addresses, identify internet service providers, and seize devices for forensic examination. 

They also look into fresh account information from platforms to cross-check the details contained in the CyberTipline report. Digital evidence retrieved from phones, computers, and storage devices is examined as well. The chain of custody is documented through certificates issued under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which state that the chain of custody was not broken.

Because tracing an account is easier, investigators rely on multiple data points, including telecom records, platform information, and financial transactions that link the offence to a specific individual.

Speaking to The Indian Express, Bhuwan Ribhu, advocate and founder of the civil society network Just Rights for Children, described an investigation in which a Telegram-based CSEAM network was traced through a UPI payment trail. Investigators matched telecom and financial records and found that the SIM card was registered in Madhya Pradesh while the account was being operated from Uttar Pradesh. “This mismatch is what led the investigators to the actual person,” Ribhu said.

Cases in courts

Cases involving online child sexual abuse material are generally tried before special courts designated under the POCSO Act. Under Section 28(3), the Act grants POCSO Special Courts jurisdiction to try offences under Section 67B of the IT Act involving the publication or transmission of sexually explicit material depicting children.

However, convictions depend heavily on the digital evidence. Experts say that defence arguments frequently focus on attribution, whether the accused was actually the person using the device, SIM card, or internet connection linked to the offence. Where investigators are unable to identify the person responsible despite exhausting available leads, police may file a closure report.

What the reports don’t reveal

Perhaps the limitation of a CyberTipline report is that it often identifies where abusive material was found, not where it originated. To establish the origin of the material usually requires a separate investigation involving devices, communication records, financial trails, and witness statements. 

Ribhu says that these delays are built into the system even before a report reaches the local police. Even when the child, offender, and platform are all located in India, the report often travels through multiple entities before reaching a police station, he said. “Every one of those extra steps is a delay a child cannot afford,” he said, referring to the multiple agencies through which reports pass before reaching state authorities. 

The challenge, he added, is growing more complex as offenders increasingly use encrypted platforms and AI-generated content. “Equipping agencies isn’t a one-time fix, because the crime itself keeps changing shape,” Ribhu said, as offenders’ usage of the new technology makes it harder to detect them and the content through traditional methods such as hash matching of known content. “Law enforcement has to move at the same pace as the crime evolves, not catch up to where it was two years ago,” Ribhu said.