Intermediary Liability and Safe Harbour in India

An intermediary acts as an agent or a platform to facilitate the transmission of data between users. Section 2(1)(w) of the Information Technology (IT) Act, 2000, defines an intermediary. This definition covers telecom service providers, network service providers, internet service providers, web-hosting services, search engines, online payment sites, e-commerce marketplaces, and social media platforms. Safe harbour is a legal principle that shields these intermediaries from liability. Under this doctrine, platforms are not held legally responsible for third-party information, data, or communication links hosted by them. Because intermediaries do not create or curate user content, the law protects them from being penalized for the actions of individual users. This protection allows open communication and prevents platforms from facing constant litigation.

The Legal Shield: Section 79 of the IT Act, 2000

Section 79 of the IT Act, 2000, provides the statutory basis for safe harbour in India. It exempts intermediaries from liability under certain conditions.

Conditional Immunity

Section 79(1) states that an intermediary is not liable for third-party information or data. However, Section 79(2) makes this protection conditional. The intermediary must satisfy the following:

• The intermediary’s role: Restricted to providing access to a communication system over which information is transmitted, stored, or hosted.
• No initiation: The intermediary does not initiate the transmission.
• No selection of receiver: The intermediary does not select the receiver of the transmission.
• No modification: The intermediary does not select or modify the information contained in the transmission.
• Due diligence: The intermediary observes due diligence prescribed by the central government.

Loss of Safe Harbour

Section 79(3) details when this protection is lost:

• Participation in unlawful act: The intermediary conspired, abetted, or aided in committing the unlawful act.
• Failure to act on notice: The intermediary, upon receiving actual knowledge or being notified by the government, fails to expeditiously remove or disable access to the unlawful content.

Judicial Interpretation: The Shreya Singhal Case (2015)

The interpretation of Section 79 changed after a major ruling by the Supreme Court.

Clarification of Actual Knowledge

In Shreya Singhal v. Union of India (2015), the Supreme Court evaluated Section 79(3)(b). The court ruled that “actual knowledge” cannot mean private complaints. Instead, it is established only when an intermediary receives:

• A direct court order.
• A notification from an appropriate government authority.

Rationale

The court pointed out that intermediaries cannot act as arbiters to decide if user content is legal. Forcing platforms to evaluate millions of private complaints would lead to private censorship and restrict the freedom of speech.

The IT Rules, 2021: Classified Obligations

To regularize due diligence, the government notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. These rules replaced the 2011 guidelines and introduced a classification system.

Categorization based on Users

The rules established a distinct class of social media intermediaries with over 5 million registered users in India, categorized as SSMIs.

Additional Compliance for SSMIs

• Indian Officers: SSMIs must appoint a Chief Compliance Officer, a Nodal Contact Person, and a Resident Grievance Officer. All three officers must reside in India.
• Traceability Requirement: Messaging platforms categorized as SSMIs must enable the identification of the first originator of information. This requirement applies only when ordered by a court or a competent authority under Section 69 of the IT Act.
• Proactive Monitoring: Platforms must deploy automated tools to actively identify and block content related to child sexual abuse and explicit material.
• Monthly Reporting: SSMIs must publish monthly compliance reports detailing the number of complaints received and the specific actions taken.

Grievance Redressal and GACs

The government introduced further rules in 2022 to give users more power.

Timeline for Redressal

Intermediaries must acknowledge user complaints within 24 hours and resolve them within 15 days. For content depicting nudity or sexual acts, the platform must remove it within 24 hours of receiving a complaint.

Grievance Appellate Committees (GAC)

The 2022 amendments set up three-member GACs appointed by the central government. If a user is unhappy with the decision of a platform’s grievance officer, the user can file an appeal with the GAC. The intermediary must comply with the final orders of the GAC.

Regulating Deepfakes and Synthetic Media

The rapid rise of artificial intelligence led to new legal updates. The IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, introduced strict rules for synthetically generated content.

Definition of Synthetically Generated Information (SGI)

SGI refers to any text, image, audio, or video that is artificially or algorithmically created, modified, or altered to appear reasonably authentic.

Due Diligence for SGI

Intermediaries must take active steps to prevent the creation and hosting of prohibited SGI, especially deepfakes used for fraud or impersonation.

Labeling Rules

SSMIs must implement tools that allow users to declare if they are uploading SGI. The platform must verify these declarations and display a clear label to notify viewers that the content is synthetically generated.

Compliance Timelines

Platforms must act within shorter windows to address complaints regarding deceptive synthetic media to stop its spread.

Safeguards Against Arbitrary Content Takedowns

The government also introduced checks to prevent the abuse of the content-removal process. The IT Amendment Rules, 2025, established clear guidelines for content blocking.

High-Level Authorization

Takedown directions under Section 79(3)(b) cannot be issued by junior officers. For civil departments, the officer must be of Joint Secretary rank or above. For police authorities, the order must be authorized by a Deputy Inspector General (DIG) rank officer.

Detailed Takedown Orders

Any blocking request must clearly state the specific legal provisions violated, the nature of the violation, and the exact URLs of the content.

Regular Audits

A Secretary-level officer conducts a monthly review of all takedown orders to ensure they are necessary and balanced.

The Digital India Act and the Future of Safe Harbour

The IT Act, 2000, was drafted during the early days of the internet. To address modern challenges, the government is preparing the Digital India Act (DIA) to replace the old law.

Ending Default Safe Harbour

The DIA plans to move away from granting safe harbour automatically.

Activity-Based Safe Harbour

Instead of blanket immunity, the DIA will link protection to the actual activities performed by the platform.

Distinct Classifications

The law will categorize digital entities into separate groups, including cloud providers, social media networks, search engines, e-commerce marketplaces, and generative AI models.

Compliance Linkage

Each class of intermediary will have to meet specific, tailored legal obligations. If a platform fails to maintain these specific standards, it will lose safe harbour and face direct prosecution for user-generated violations.

Classification of Intermediaries and Core Obligations

Recent Context

India’s Ministry of Electronics and Information Technology (MeitY) notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 on 10 February 2026. The amended framework came into force across India on 20 February 2026 and reduced the time limit for intermediaries to remove unlawful content to 3 hours after a valid court order or authorized government notice. The 2026 rules also introduced a formal definition of Synthetically Generated Information (SGI) and tightened compliance on AI-generated deepfakes, labeling, and metadata.