Platform rules, intermediary duties, and synthetic media.
India's platform and internet law is a stack. It has a foundational statute from 2000, intermediary rules from 2021, and a modern telecom statute from 2023. The 2026 changes add rules for realistic AI-made audio, images and video. This hub maps them.
Short answer: which platform rules apply today?
Two instruments set most platform duties, and both are in force. The IT Act, 2000 is the base law. The IT Rules, 2021 set the detailed duties.
An intermediary is a platform that hosts or carries other people's content. Social media, messaging apps, marketplaces and hosting firms can all count. Under the IT Act, an intermediary is not automatically liable for what users post. It keeps this safe harbour only if it meets its due-diligence duties. These include a grievance officer, complaint deadlines and takedowns. Large messaging platforms may also have to trace a message's first originator under Rule 4(2).
The 2026 amendment (G.S.R. 120(E)) has been in force since 20 February 2026. It covers realistic AI-made audio, images and video. Platforms must block harmful kinds and label the rest. Large social media platforms must ask users to declare such content before posting. Takedown times are now 3 hours, 36 hours and 2 hours, depending on the case.
Other layers sit alongside. The CERT-In Directions, 2022 cover cyber-incident reporting. The Telecommunications Act, 2023 is partly in force. The Digital India Act is only a proposal; we have not found an official bill or draft.
Timeline
- 2000IT Act enacted
India's first digital law. It made online deals valid and gave platforms safe harbour.
- 2021Intermediary Rules notified
Platforms in India must now have a grievance officer, meet complaint deadlines and remove content.
- 2023Telecommunications Act passed
It covers telecom services, airwaves, spam and emergency powers. Whether it covers apps like WhatsApp is not settled.
- 2025–2026CurrentAI-media amendment to the IT Rules
Draft for comments on 22 October 2025; notified as G.S.R. 120(E) on 10 February 2026 and in force from 20 February 2026. Covers realistic AI-made audio and video, not plain text.
Draft Second Amendment Rules, 2026 — proposed, not law
In March 2026 MeitY published a draft Second Amendment to the IT Rules. It is a draft. It has no G.S.R. number and no start date, so it binds nobody today.
As drafted, it would:
- make platforms follow MeitY's written advice and orders (proposed Rule 3(4));
- apply the news rules to news posted by ordinary users too (proposed Rule 8(1));
- let the oversight committee hear matters the Ministry refers to it (proposed Rule 14);
- keep other data-retention laws in force alongside Rule 3(1)(g) and (h).
It adds no new rules on AI-made content. Those are in the February 2026 amendment, which is in force.
What to watch: whether it is notified, and what changes from the draft.
In this cluster
Each sub-article traces to a primary source. Where litigation or draft status is unresolved, it is marked Pending confirmation rather than asserted.
IT Act, 2000
India's main internet law. It makes online deals legally valid. It also gives platforms 'safe harbour'. That means a platform is not blamed for users' posts if it follows the rules.
ReadIntermediary Rules, 2021
Duties for social media, messaging and digital media platforms. These include a grievance officer, complaint deadlines and takedowns.
ReadFirst Originator Traceability
Rule 4(2) says large messaging platforms must be able to identify a message's first sender in specific situations. Courts are still weighing its legality.
ReadTelecommunications Act, 2023
The Telecommunications Act, 2023, partly in force from 26 June 2024 (Notification No. 2408(E)). It covers telecom services, airwaves, spam and emergency powers.
ReadIT Rules 2026: AI-made audio, images and video
In force 20 February 2026 (G.S.R. 120(E)). Platforms must block harmful AI-made audio and video that looks real, label the rest, and act on takedowns within 3 hours.
ReadCERT-In Directions, 2022
Cyber attack rules for firms in India. Report some attacks to CERT-In within 6 hours, and keep logs.
ReadOnline Gaming Act 2025 and Rules 2026
The Act bans online money games. The Rules (G.S.R. 303(E)) came into force on 1 May 2026 and set up the Online Gaming Authority of India.
ReadDigital India Act (Proposed)
The Digital India Act is a proposed law meant to replace the IT Act, 2000. We have not found an official bill or draft. Primary source not yet confirmed.
ReadAm I a Data Fiduciary?
Do you also handle user data? Check if DPDP duties apply to you too.
Run it nowHow does this apply to you?
Take the 2-minute self-check to find out whether you're a Data Fiduciary, Data Processor, or both — with your personalised action checklist.
Take the DPDP Applicability CheckYour answers stay in your browser. If you choose "Email me this report", we send your email address and result type to our report service.