📅 Evolution Timeline
February 25, 2021
IT Rules 2021 Notified
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — replaced 2011 rules
October 28, 2022
First Amendment — GAC Established
Grievance Appellate Committee introduced; appeal mechanism against Grievance Officer decisions
April 6, 2023
Second Amendment — Fact Checking
Government fact-checking unit provisions; "by itself" proactive monitoring for CSAM
October 22, 2025
2025 Amendment — Rule 3(1)(d)
Joint Secretary requirement; legal basis specification; deepfake draft rules released
November 15, 2025
2025 Amendment Effective
New content removal safeguards operational; synthetic content labeling requirements proposed
📜 IT Rules 2021 — Core Framework
Full Title
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — Jointly administered by MeitY and Ministry of Information & Broadcasting
Key Objectives
- Ensure online safety, security and accountability
- Establish due diligence framework for intermediaries
- Regulate digital news media and OTT platforms
- Create grievance redressal mechanism
- Address issues of fake news, misinformation, and harmful content
Structure of IT Rules 2021
| Part | Coverage | Key Rules |
|---|---|---|
| Part I | Preliminary — Definitions | Rule 1-2 |
| Part II | Due Diligence by Intermediaries | Rule 3-7 |
| Part III | Code of Ethics & Digital Media | Rule 8-18 |
⚙️ Due Diligence Obligations (Rule 3)
All intermediaries must observe due diligence to retain safe harbour protection under Section 79:
📋
Rule 3(1)(a) — Terms of Service
Publish rules, privacy policy, user agreement prominently
🚫
Rule 3(1)(b) — Prohibited Content
Inform users not to host/transmit content that: threatens sovereignty, is defamatory, obscene, CSAM, infringes IP, spreads misinformation, etc.
⏱️
Rule 3(1)(d) — Takedown Timeline
Remove unlawful content within 36 hours of court/government order
🔐
Rule 3(1)(j) — Data Retention
Retain information for 180 days after cancellation/withdrawal
👮
Rule 3(1)(k) — Law Enforcement
Assist authorized agencies, provide information within 72 hours
📝
Rule 3(2) — Grievance Officer
Appoint Grievance Officer; acknowledge complaints in 24 hours; resolve in 15 days
📱 Significant Social Media Intermediaries (SSMI)
Additional obligations apply to intermediaries with 50 lakh+ registered users in India:
Definition — SSMI (Rule 2(v))
"Significant social media intermediary" means a social media intermediary having number of registered users in India above such threshold as notified by the Central Government (currently 50 lakh users).
Additional SSMI Obligations (Rule 4)
| Rule | Obligation | Details |
|---|---|---|
| 4(1)(a) | Chief Compliance Officer | Senior employee, resident in India, responsible for compliance |
| 4(1)(b) | Nodal Contact Person | 24x7 coordination with law enforcement |
| 4(1)(c) | Resident Grievance Officer | India-resident officer for user grievances |
| 4(2) | First Originator Traceability | Enable identification of first originator for specified content |
| 4(4) | Proactive Monitoring | Deploy technology to identify CSAM, rape/gang-rape content |
| 4(7) | Monthly Compliance Report | Publish report on complaints received and action taken |
⚠️ Traceability Controversy
Rule 4(2) requiring "first originator" identification has been challenged as it may require breaking end-to-end encryption. WhatsApp challenged this provision arguing it undermines privacy. The matter is pending in various High Courts.
🔄 2022-2023 Amendments
October 2022 Amendment — Grievance Appellate Committee
- Rule 3A inserted — establishes GAC
- Users can appeal Grievance Officer decisions to GAC within 30 days
- GAC to decide within 30 days
- Three GACs constituted in January 2023
- Digital-only appeal process at gac.gov.in
April 2023 Amendment
- Rule 3(1)(b)(v): Added "by itself" — extends proactive monitoring to all intermediaries for CSAM
- Fact-checking: Government may notify fact-checking unit; intermediaries to mark/take down fake news about government
- Challenged in courts — Bombay HC stayed fact-checking provisions
📋 2025 Amendment — Rule 3(1)(d) Changes
The October 2025 amendment introduced critical safeguards for content removal:
✅ Key Changes Effective November 15, 2025
- Officer Rank: Intimation only from Joint Secretary or above (ministries) or DIG or above (police)
- Legal Basis Required: Must specify statutory provision and legal basis
- Content Specification: Must identify specific URL/identifier of content
- Nature of Unlawful Act: Must explain what makes content unlawful
- Transparency: Aims to prevent arbitrary takedowns
Draft Deepfake Rules (October 2025)
MeitY released draft amendments for synthetically generated content:
- Mandatory Labeling: AI-generated content must be labeled
- 10% Visibility: Synthetic content label must cover 10% of visual area or first 10% of audio
- Metadata Embedding: Platforms to embed metadata identifying synthetic content
- User Declaration: Users must declare if uploading synthetic content
- Good Samaritan: Safe harbour retained for good faith removal of synthetic content
📊 Compliance Statistics (2025)
| Platform | Monthly Complaints | Action Taken | Key Issues |
|---|---|---|---|
| Google (India) | ~650,000 items | 90%+ proactive | Copyright, CSAM |
| Meta (Facebook) | ~40,000 reports | Variable | Hate speech, nudity |
| Twitter/X | ~25,000 accounts | CSAM, harassment | Non-consensual content |
| ~2M+ accounts banned | Proactive | Spam, abuse |
*Based on monthly transparency reports published by platforms
⚖️ Key Case Laws on IT Rules
LiveLaw Media v. Union of India (2024)
Kerala HC stayed the operation of Rule 3(1)(b)(v) (fact-checking unit) observing potential for abuse of power and chilling effect on free speech.
X Corp. v. Union of India (2024)
Karnataka HC upheld Rule 3(1)(d) and the Sahyog portal, finding adequate safeguards exist. However, noted concerns about transparency in takedown process.
WhatsApp v. Union of India (Pending)
Challenge to Rule 4(2) traceability requirement. WhatsApp argues it would require breaking encryption, violating privacy rights under Article 21.