Law · India
India: Information Technology Act 2000 and the IT Rules 2021
India's Information Technology Act 2000 is the criminal and platform-liability backbone for online images. Section 66E punishes capturing or publishing images of a person's private areas without consent, and the Intermediary Guidelines and Digital Media Ethics Code Rules 2021 oblige platforms to remove intimate or impersonating images within 24 hours of a complaint. Amendments notified in February 2026 added duties for synthetically generated content.
Updated November 6, 2026 · 4 min read · reviewed November 6, 2026
-
2000-10-17
IT Act in force
India's first law on electronic records, signatures and computer offences.
-
2009-10-27
2008 amendment commences
Adds Section 66E (violation of privacy), 67A and 67B (sexually explicit and child material), 69A (blocking) and the safe-harbour redesign of Section 79.
-
2021-02-25
Intermediary Guidelines and Digital Media Ethics Code Rules
Grievance officers, 24-hour removal of intimate and impersonating images, traceability duties for large messaging services.
-
2023-04-06
2023 amendment
Online gaming rules and a government fact-check unit; the fact-check provision was struck down by the Bombay High Court in September 2024.
-
2026-02-10
2026 amendment notified
Labelling and declaration duties for synthetically generated information; shorter action timelines. Effective 20 February 2026.
What does the IT Act cover?
The Act is not a data-protection law; that is the Digital Personal Data Protection Act 2023. It is the statute that makes specific online conduct a crime and that decides when a platform is liable for what users post. Two parts matter for face search and image abuse. Section 66E makes it an offence to intentionally capture, publish or transmit an image of a person's private area without consent, in circumstances violating privacy. Sections 67, 67A and 67B punish publishing obscene or sexually explicit material, with the harshest terms for material involving children.
Section 79 gives intermediaries (social networks, hosting providers, search engines, messaging services) a safe harbour from liability for user content, on condition that they follow due-diligence rules made under the Act and act on court or government orders. The 2021 Rules are those due-diligence rules. Lose the Rules, lose the shield.
What do the IT Rules 2021 require of platforms?
| Duty | What it says | Why it matters for faces |
|---|---|---|
| Rule 3(2)(b), 24-hour removal | On a complaint from the person shown or someone on their behalf, remove content that exposes private areas, shows nudity or a sexual act, or impersonates the person, including morphed images, within 24 hours | The fastest removal route in Indian law for intimate and morphed images |
| Grievance officer | Every intermediary must publish a grievance officer's contact and acknowledge complaints within 24 hours, resolving most within 15 days | The address to send a removal request |
| Rule 4, significant social media intermediaries | Resident chief compliance officer, nodal contact, monthly compliance reports, automated detection of child sexual abuse and previously removed material | Large platforms must proactively block re-uploads |
| Rule 3(1)(b) | Users must be told not to post content that is obscene, invades privacy, is impersonating, or harms children | Terms of service must prohibit impersonation |
| 2026 amendment | Synthetically generated information must be labelled; users declare whether uploads are synthetic; urgent complaints move on shorter clocks | Deepfakes of a face now carry a labelling duty and a quicker takedown path |
Who enforces it?
Offences are investigated by state police, usually through dedicated cyber crime cells, and complaints can be filed through the National Cybercrime Reporting Portal run by the Indian Cyber Crime Coordination Centre (I4C) or the 1930 helpline. The Rules are administered by MeitY, which can direct blocking under Section 69A. There is no privacy regulator under the IT Act; the Data Protection Board created by the DPDP Act is separate.
What does it mean for face search?
The IT Act says nothing about biometric data or face indexes as such; that question belongs to the DPDP Act and its rules on sensitive data and consent. Where the IT framework bites is downstream: when a face search surfaces an intimate image, a morphed photo or an impersonating profile, Rule 3(2)(b) gives the person shown a statutory 24-hour removal right against the platform hosting it, and Section 66E gives a criminal route against whoever captured or published it. Engines such as PimEyes, FaceCheck.ID and FaceSearch are themselves intermediaries if they operate in India and would need a grievance officer and a complaint process to keep safe harbour.
| Situation | Position under the IT Act and Rules |
|---|---|
| You find an intimate or morphed image of yourself | Complain to the platform's grievance officer under Rule 3(2)(b); 24-hour removal duty. File at cybercrime.gov.in under Section 66E or 67A. |
| Someone runs a fake profile with your photos | Impersonation is listed in Rule 3(2)(b); report to the platform and the portal. |
| You search another person's face | No offence in itself. Capturing or publishing their private areas, or using results to harass, can engage Sections 66E, 67 and 354D of the Penal Code (stalking). |
What is pending or contested?
The Bombay High Court struck down the 2023 fact-check unit provision in September 2024 on free-speech grounds. The 2026 synthetic-media amendment is new and untested; commentators disagree on the exact shortened timelines, and platforms have questioned how user declarations will be enforced. A broader Digital India Act to replace the IT Act has been discussed since 2023 but had not been introduced as of 6 November 2026.
Questions
Is face search illegal in India under the IT Act?
No section of the IT Act prohibits searching for a face. The Act punishes capturing or publishing private images without consent and gives victims a removal route; consent for processing face data is a DPDP Act question.
How fast must a platform remove an intimate image?
Within 24 hours of a complaint from the person shown, under Rule 3(2)(b) of the 2021 Rules. The 2026 amendment shortened some urgent timelines; the Gazette text governs.
Where do I report?
The National Cybercrime Reporting Portal (cybercrime.gov.in) or the 1930 helpline for financial fraud, plus the platform's grievance officer.
Does the IT Act cover deepfakes?
Since February 2026 the Rules require labelling of synthetically generated information and faster handling of complaints about it. Sexual deepfakes were already covered by Sections 66E and 67A.
Sources
- 1.Information Technology Act 2000, Section 66E (India Code) (checked November 6, 2026)
- 2.MeitY, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 and FAQ (checked November 6, 2026)
- 3.Rajya Sabha answer on Rule 3(2)(b) 24-hour removal (December 2021) (checked November 6, 2026)
- 4.S.S. Rana, 2025 IT Rules amendment on synthetically generated information (checked November 6, 2026)
Entry reviewed November 6, 2026. Found an error? Tell us.
Related entries
- Law India's Digital Personal Data Protection Act, 2023 India's DPDP Act 2023 and Rules 2025: phased commencement to May 2027, consent and notice duties, the Data Protection Board, penalties up to 250 crore rupees.
- Organisation Indian Cyber Crime Coordination Centre (I4C) India's national cybercrime coordination body: the cybercrime.gov.in portal, the 1930 helpline, what to report there and how, and its scam advisories.
- Term NCII (non-consensual intimate images) NCII defined: non-consensual intimate images, real or synthetic, the laws covering them in the US, UK, EU, India and Australia, and the removal routes.
- Term Deepfake Deepfake defined: faces, voices and video synthesised or swapped by machine learning, how they are made and detected, and the laws that cover them.
- Directory Removing intimate images shared without consent, by country Intimate image removal routes in 11 countries: the law, where to report, the platform deadline and the helpline, from the US and UK to India and Brazil.
- Directory Where to report a fake or impersonating account Official impersonation report routes for 13 platforms, from Instagram and Facebook to Tinder and Telegram, with who can file and what each asks for.
Cite this entry
FaceSearch Wiki editors. "India: Information Technology Act 2000 and the IT Rules 2021". FaceSearch Wiki, updated November 6, 2026. https://facesearch.wiki/laws/india-it-act-and-rules/