Skip to Content

Cybersecurity & Standards, Free Expression, Government Surveillance

Part 1: New Intermediary Rules in India Imperil Free Expression, Privacy and Security

This post is the first of a two-part series on the new intermediary rules in India which came into effect on May 25, 2021. This post introduces the rules and focuses on how aspects of the content moderation obligations for intermediaries and the oversight mechanism for digital media, social media and OTT platforms will undermine freedom of expression. The second post will examine the traceability requirement imposed by the rules, including its adverse effect on end-to-end encryption and users’ rights.


The conflict over online free expression in India continues to escalate. Just this week, Indian police visited Twitter’s offices as part of an investigation of Twitter’s decision to label a tweet by the ruling party’s spokesman as “manipulated media.” That police raid is only the latest in a series of actions demonstrating the Indian government’s propensity to try to suppress online speech critical of the government. Recently enacted regulations – the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, referred to for the rest of this writing as Intermediary Rules or Rules – provide a key legal underpinning for the government’s actions. A portion of those rules aimed specifically at large social media companies will provide the government with even greater authority to control online expression. The three-month period granted to intermediaries to comply with the Rules ended today. Absent a change in direction, the future of free speech in the world’s largest democracy is increasingly imperiled.


In February 2021, the Government of India notified a new set of Intermediary Rules that supersede the prior Information Technology (Intermediaries guidelines) Rules, 2011. Both versions of the Intermediary Rules flow primarily from Section 79 of the Information Technology Act of 2000. Section 79 is a “safe harbour” that exempts intermediaries from liability for the content their users convey on the intermediaries’ platforms as long as intermediaries comply with their obligations under the Act and associated Rules. The Rules contain certain provisions that increase intermediaries’ accountability and provide protections to users. Overall, however, the new Rules impose onerous compliance requirements that limit intermediaries’ ability to claim protection from liability under the safe harbour provision and have the effect of limiting users’ rights. Moreover, although the Act is limited on its face to intermediaries, the Rules impose new obligations on digital news publishers and over-the-top (OTT) platforms that increase the government’s ability to control news reporting.

The Rules were issued without the required public consultation. A 2018 draft of the Rules that was the subject of public consultation drew widespread criticism. The Rules released in February 2021 are considerably different, but they were not placed in the public domain prior to publication. The procedure was devoid of parliamentary scrutiny since it was carried out by the Executive. It also runs afoul of the Pre-Legislative Consultation Policy of the Government of India, which requires that proposed subordinate rules, such as the Intermediary Rules, be placed in the public domain for at least 30 days and that a summary of public comments be published.

The Rules, or parts of them, have already been challenged in various High Courts in India [see (a) here, (b) here, (c) here and (d) here]. Among other things, the petitions assert that the Rules violate the Indian Constitution; contravene the India Supreme Court’s judgement in the Shreya Singhal case, which laid down the procedure for content takedown orders; and unlawfully exceed the scope of the parent legislation, the Information Technology Act.

The Intermediary Rules enforce what the government has termed a “soft-touch oversight mechanism” for social media, digital media, and OTT platforms. However, the new structure for governance of online content in fact reflects an increase in government control and a tightening grip over the freedom of expression. The Rules will, as the Internet Freedom Foundation explains, “fundamentally change the way the internet will be experienced in India.”

Regulation of Social Media Intermediaries

The new Intermediary Rules place considerably more onerous obligations on intermediaries to avoid liability for their users’ content as compared to their predecessor. Intermediaries are obligated to take down material within 36 hours of receiving a court order or notification from an appropriate government agency that the material allegedly violates a law relating to a variety of broad categories such as “decency or morality” and “public order” (Rule 3(1)(d)). Further, intermediaries must take down content within 24 hours if it is the subject of a complaint by any individual regarding transmission of nudity, sexual conduct or impersonation (Rule 3(2)(b)).  Intermediaries are further obligated to provide information and other forms of assistance to government agencies within 72 hours (Rule 3(1)(j)).

Two key aspects of these requirements will work in tandem to result in the suppression of free expression. First, as a result of the truncated timelines, intermediaries will not have the time to assess the adequacy of a government notice or an individual’s complaint, or to provide a reasonable opportunity for the user to be heard and offer a counterview in favor of their right to free expression. Second, the ability of non-judicial government authorities to demand content takedowns with no judicial oversight opens the door for those authorities to seek the removal of speech for political or other inappropriate reasons – and the Indian government already has demonstrated it will walk through that door. When forced to choose between not taking down content to protect users’ rights and taking it down to shield themselves from liability and (as discussed below) their employees from potential criminal sanctions, intermediaries will inevitably over-comply.

The Rules create even greater risks to free expression in the case of so-called “significant social media intermediaries” (SSMIs). SSMIs encompass intermediaries with more than 5 million registered users – not a high threshold in a country with over 1.3 billion people – and any other intermediary the government designates as presenting a material risk of harm to state security or the sovereignty or integrity of India. Under rules that went into effect today, SSMIs are subject to two key additional obligations, both of which will lead to greater suppression of content:

First, Rule 4(4) requires SSMIs to endeavor to deploy technology-based measures, including automated tools, to proactively identify and block sexual abuse material or information identical to previously removed information. But even the most advanced machine-learning techniques for analyzing user content are subject to significant limitations and cannot reliably identify particular types of content such as sexual abuse material. As a result, this kind of content filtering requirement essentially guarantees that lawful speech will be blocked. 

Additionally, machine learning tools are trained on datasets that reflect existing biases in society. As a result, they lead to discriminatory censorship. The provisos to Rule 4(4) provide for a periodic review that must take into consideration factors such as propensity of bias and discrimination, accuracy and fairness. However, there is no requirement that such reviews be made available for public scrutiny. Nor do the rules specify what intermediaries should do when such reviews reveal bias and inaccuracy, as they inevitably will. The mandate to proactively and automatically filter content is therefore unaccompanied by safeguards ensuring transparency and accountability and will lead to suppression of legitimate content.

Second, SSMIs must appoint a nodal contact person, a resident grievance officer and a chief compliance officer (CCO), each of whom must be resident in India. CCOs must be responsible for compliance with the Rules and are personally liable for non-compliance, including potential criminal sanctions with prison sentences of up to seven years. These two requirements appear tailor-made to give the government greater leverage over SSMIs by effectively taking a CCO hostage in order to force the removal of content the government does not like. 

The CCO would have to consider takedown orders by a court or government agency within 36 hours on broad grounds including defamation. The CCO would also have to take action to remove certain types of content within 24 hours of receiving a complaint from any individual. In a country like India where hundreds of defamation suits are filed every month in a single state, and intermediaries have millions of users with vastly varying sensibilities, the CCO would receive hundreds (possibly more) of complaints every day. It would be practically impossible for the CCO to assess the merits of each complaint. As a result, to avoid liability for the intermediary and potential jail-time for the CCO, more legitimate forms of free expression will be suppressed than ever before. 

The paucity of time, the absence of judicial oversight, and, (for SSMIs), the requirements to actively filter content and to have personnel resident in India who are subject to criminal liability will together result in suppression of free speech. Empirical research shows that even the old Rules had a chilling effect on free expression. The new Rules will exacerbate that effect, as intermediaries have little choice but to err on the side of taking down even legitimate content. 

Censorship of Digital News Publishers and OTT Platforms

The Rules go beyond regulating intermediaries and grant substantial powers to the government to regulate what news and entertainment may be available online. The Rules prescribe a code of ethics, procedures and safeguards for “publishers of news and current affairs content” and “publishers of online curated content.” The code of ethics requires, among other things, that publishers exercise “due caution and discretion” in deciding whether to publish content that may “affect the sovereignty and integrity of India” or depict the activities, beliefs or views of any racial or religious group.

Any member of the public may file a grievance alleging violation of the code of ethics. The Rules establish a new three-tier structure to address such grievances. Publishers must appoint a grievance officer to address the matter initially. The decisions of the grievance officer are subject to review by self-regulating industry bodies that are required to be registered with the government. An inter-departmental committee of the government sits atop this structure with extensive powers. Among other things, the government is authorized to publish a charter prescribing how the self-regulating bodies must operate and to issue orders to publishers for adherence to the code of ethics. It is empowered to hear appeals against decisions made by the publishers, and can direct a publisher to delete, modify or block the relevant content.

In effect, the Rules empower the government to censor news and entertainment content on the internet by making the central government the ultimate authority to determine what can and cannot stay online. The structure is devoid of necessary safeguards for publishers and lacks judicial involvement, or any other checks-and-balances mechanism, to limit the government’s discretionary powers that will directly curtail free speech, including news coverage of the government. This regime violates basic international human rights principles, under which any model “where government agencies, rather than judicial authorities, become the arbiters of lawful expression” must be rejected.

The inclusion of news media within the code of ethics is incongruous with the scope and ambit of the parent legislation of the Rules, the Information Technology Act (the IT Act). The IT Act does not contemplate the regulation of digital news media, and therefore Rules framed under the IT Act cannot validly be made applicable to publishers of news and current affairs content. The IT Act also does not clearly contemplate a redress mechanism with the government at the helm. As such, the Rules suffer from excessive delegation of power and are arguably ultra vires. The Executive has exercised its rule-making power in contravention of the condition that the rules must be consistent with the parent statute. The Intermediary Rules expand the scope of the IT Act and enact substantive legislative provisions in the garb of rules.


The new Intermediary Rules will considerably alter how users experience the internet in India. Users will have less freedom of expression and less access to news and entertainment that is unapproved by the government. As a result, the Rules will undermine Indian democracy. A governance framework for intermediaries and publishers with such far-reaching negative consequences ought to be reconsidered. At the very least, it must undergo parliamentary scrutiny and extensive consultation with experts and the public at large prior to enforcement.