How to keep children safe online in India

POCSO covers sexual offences against children comprehensively, and it deals with the online dimension directly: using a child for pornographic purposes, and the storage or possession of child sexual abuse material, are offences in themselves. Possession is the part people misunderstand — nobody has to have created or forwarded anything for an offence to have been committed.

The Information Technology Act separately criminalises publishing or transmitting material depicting children in sexually explicit acts, and creates the framework under which platforms must act on such content. Between them the two Acts leave very little room for the argument that something was only received, or only viewed, or only forwarded once.

The reporting duty is the provision to know. Any person who has apprehension that an offence is likely to be committed, or knowledge that one has been committed, must report it to the special juvenile police unit or the local police. Failure to do so is punishable. Media, hotel and institutional staff have specific obligations where material or a child comes to their notice.

The Juvenile Justice framework runs alongside, dealing with a child in need of care and protection through the Child Welfare Committee rather than through the criminal process. A child who has been exploited online is within that definition, and the committee route exists to provide protection, counselling and rehabilitation rather than only prosecution.

The Digital Personal Data Protection Act 2023 added a data layer. Processing a child's personal data requires verifiable consent from a parent or guardian, and tracking behaviour or directing targeted advertising at children is restricted. This is what sits behind age-assurance changes on platforms.

None of this makes reporting easy in practice, but it does mean a parent who reports is not asking a favour of the system. They are triggering a set of statutory duties that already exist.

Believe the child and say so out loud. Whatever they did — sent an image, met someone, lied about their age — the person who committed the offence is the adult on the other end. A child who thinks they will be blamed stops talking, and everything else depends on them continuing to talk.

Do not delete anything. Screenshots of the conversation, the profile, the usernames, the payment demands, the phone numbers and any transaction references are what an investigation runs on. Capture the whole thread, not the incriminating part.

Do not pay. In a sextortion demand, payment is not the end of the transaction — it is the confirmation that the target will pay, and demands escalate. This is well established and is the single most important instruction to give a frightened teenager.

Block after capturing, not before. Blocking first can remove your access to the conversation on some platforms.

Report to the national cyber crime reporting portal. It has a dedicated category for crimes against women and children, and reports in that category can be made anonymously — which matters when a family is worried about identification. Keep the acknowledgement number.

If money has already been transferred, call the cyber fraud helpline immediately as well. The first hours are when a transaction can still be intercepted, and the window is genuinely short.

Call the child helpline for support, counselling and, where the child is at risk, intervention. It operates round the clock and is the route into the child protection system rather than only the police system.

Then go to the police in person and ask for the special juvenile police unit or the cyber cell. Take the screenshots on a device and, if you can, on a printed copy. An FIR should be registered; a refusal to register one is escalated to the superintendent of police and, if needed, to the magistrate.

Ask the platform to remove the content through its grievance mechanism, quoting the report reference. Intermediaries are required to have a grievance officer and to act on complaints about content depicting a child in a sexually explicit act within defined timelines.

Sextortion. Contact is made on a mainstream platform, moves quickly to a video call or private messaging, an intimate image is obtained or fabricated, and a payment demand follows with a deadline and a threat to send it to the victim's contact list. The compression of time is deliberate — it exists to prevent the target from telling an adult. Teach the counter-move as a rule rather than a warning: any stranger who creates urgency about images is running this, and the correct response is to stop replying and tell someone immediately.

Grooming. Slower, and easier to miss. It looks like unusual attention, secrecy, gifts or game currency, a sudden new online friend the child will not discuss, and a shift to a platform the parents cannot see. The gifts are the diagnostic detail; they create obligation, which is what the process runs on.

Impersonation and fake profiles, including profiles built from a child's own photographs taken from open accounts. This is why an open account with a school name and a face is a much larger exposure than it looks.

Financial fraud aimed at children through gaming — free currency, account upgrades and skins that require a parent's card details or an OTP. Children hand over OTPs because they have been told the transaction is free.

Cyberbullying and coordinated harassment within a peer group, which is more common than external threats and is where schools have a role. Schools are required to have safety mechanisms and are answerable to the child rights commissions.

Deepfaked images of real children made from ordinary photographs. This is now routine, and it means the reassurance that nothing intimate was ever shared is no longer sufficient. It also means fabricated material should be reported exactly as real material would be.

Self-generated material shared consensually between minors. This is legally fraught and emotionally difficult, and it is the situation where families most often try to handle things privately. Take advice rather than assuming.

Set the account to private and remove the school, the location and the full name from public view. The majority of contact-based harm begins with an offender being able to identify a child, and this is the single cheapest reduction in exposure available.

Use the platform's own supervision tools rather than third-party monitoring software. Supervised accounts, restricted messaging from non-contacts, and content controls are built in, do not require installing anything with wide device access, and are far less likely to be discovered and resented.

Agree that screenshots and reporting are always allowed. A child who believes that showing an adult a message will lead to losing the device will not show anyone anything.

Explain the OTP rule in the specific form children encounter it: nobody legitimate ever needs a code from your phone, including someone claiming to be from a game, a school, a delivery service or a bank.

Talk about the fact that images do not stay where they are sent. Not as a threat, and not as shame, but as a technical fact about how the internet works.

Know who to call before you need to. The child helpline number, the cyber crime portal and the local cyber cell are worth writing down somewhere the whole family can find them.

For schools and institutions, the obligations are real and enforceable. Where a school fails to act on a report, the escalation is the child rights commission for your state and the National Commission for Protection of Child Rights, both of which can take up individual complaints.

Finally, treat data minimisation as protection. The verifiable parental consent and tracking restrictions in the data protection framework exist because a profile built on a child is the raw material for most of what follows. Sharing less is a security measure, not a privacy preference.

A report on the cyber crime portal generates an acknowledgement and is routed to the police unit with jurisdiction. Track it with the acknowledgement number; a report that shows no movement can be followed up through the portal and through the local cyber cell.

An FIR under POCSO triggers a specific process: recording of the child's statement in a manner prescribed to avoid repeated questioning, in the presence of a person the child trusts, and by a woman officer wherever possible. The child should not be called repeatedly to the police station, and a request to have the statement recorded at home or a place of the child's choice is a legitimate one.

Special courts hear POCSO matters, and the child is entitled to support during the process, including a support person and legal assistance through the legal services authorities at no cost.

The identity of the child is protected. Reporting that reveals identity is itself an offence, and this extends to school communications, WhatsApp groups and social media posts made with sympathetic intent.

If the platform does not remove content, escalate through its grievance officer, then through the grievance appellate mechanism, and in parallel to the cyber cell with the report reference. Content depicting a child in a sexually explicit act has tighter timelines than ordinary complaints.

If the police do not act, escalate to the superintendent of police in writing, and to the state commission for protection of child rights and NCPCR, which can take up individual cases and monitor them.

Get the child counselling support, from the helpline network or otherwise, independently of what the investigation does. The legal outcome and the recovery are separate processes, and only one of them has a deadline.