THE LAWGICAL SOCIETY

RESEARCH PAPER: Takedown to Redress: Legal Remedies for Non-Consensual Intimate Images and Sexual Deepfakes in India, AUTHOR: Abarna Tiwari

Non-consensual intimate images (NCII) and sexual deepfakes cause harm that spreads fast, is easy to copy and can almost never be undone. This paper asks whether Indian law gives victims an effective way to get (i) intimate material removed quickly, (ii) protection against it being posted again, (iii) the perpetrator identified and (iv) real relief. It compares India with the United Kingdom and the European Union on these four remedies only. It uses doctrinal analysis of the Bharatiya Nyaya Sanhita 2023 (BNS), the Information Technology Act 2000 (IT Act), the Intermediary Guidelines Rules 2021 as amended in February 2026, and High Court case law.

RESEARCH PAPER

Abarna Tiwari

10/26/202619 min read

Abstract

The paper finds that India now has one of the shortest legal deadlines for removal in the world. But its law is weaker on stopping re-uploads, has no offence aimed at creating sexual deepfakes, depends on scattered and partly gender-specific criminal provisions, and leaves identification and compensation to slow processes. Speed has also moved ahead of safeguards against wrongful removal. The paper concludes that India has built an effective takedown system but not yet a redress system.

Keywords:

non-consensual intimate images; sexual deepfakes; image-based sexual abuse; intermediary liability; IT Rules 2026; right to privacy

1. Introduction

Image-based sexual abuse is a harm of circulation. The first act may take seconds: a former partner shares a private photograph, someone secretly records another person, or a program makes a fake nude from an ordinary photo. But the injury grows every time the material is copied, re-uploaded or forwarded. Victims describe losing control over how their body is shown in public, withdrawing from education and work, and sometimes harming themselves.[1] A system that offers only punishment after trial is working on the wrong timescale. Victims first need the material removed within hours, some assurance it will not return, a way to find the person responsible, and relief that recognises what happened.

This paper uses the phrase "from takedown to redress" for that sequence. Takedown means removing content. Redress is the wider set of outcomes through which the law restores the victim's dignity and autonomy: lasting prevention, accountability and compensation.

The topic is timely for three reasons. First, generative tools have made realistic sexual images of real people cheap to produce, so a victim need not have been photographed in an intimate setting to be shown in one.[2] Second, the Ministry of Electronics and Information Technology (MeitY) notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, in force from 20 February 2026.[3] They define "synthetically generated information", require labelling, and sharply shorten takedown deadlines. Third, the comparison countries are mid-reform: the United Kingdom has criminalised creating sexual deepfakes in the Crime and Policing Act 2026,[4] and the EU's Directive 2024/1385 must be transposed by 14 June 2027.[5]

Scope. NCII means real nude or sexually explicit images of an adult shared, or threatened to be shared, without consent, whether first made with consent or secretly. The paper avoids "revenge porn" because it misdescribes the motives and the harm.[6] Sexual deepfakes means material artificially made or altered to show an identifiable adult in a sexually explicit way without consent, which is or is likely to be taken as real. Child sexual abuse material (a separate regime under the POCSO Act 2012 and s. 67B IT Act) and non-sexual deepfakes are excluded.[7] The four remedies studied are: (R1) urgent removal; (R2) preventing re-circulation; (R3) identifying perpetrators; and (R4) substantive relief.

2. Research Questions, Objectives and Methodology

Problem. Indian law on this subject has grown step by step through general criminal provisions, intermediary rules and High Court directions, not through a dedicated statute. It is unclear whether fast removal has been achieved at the cost of fairness, or at the cost of harder remedies.

Central question. Do existing Indian laws give victims an effective route to urgent removal, prevention of further circulation, identification of perpetrators where legally possible, and meaningful relief?

RQ1. Which provisions apply, and where are the gaps?
RQ2. How do the post-February 2026 removal duties work, and what safeguards come with them?
RQ3. What tools exist to stop re-uploading and identify perpetrators, especially where platforms or offenders are outside India?
RQ4. How does India compare with the UK and EU, and what can it borrow?

The study is doctrinal and comparative. It analyses statutes and cases (for each case, the holding, the remedy granted and whether it could be enforced), and compares notice-and-removal regimes on who can report, the time limit, the evidence required, hash-based tools, counter-notice and penalties. A proposed interview study of 8 to 12 practitioners is planned but not reported here, so statements about practice come from judgments and secondary sources and are presented as propositions for testing. Limitations: several 2026 instruments are analysed through the amending notification and secondary commentary and should be checked against the Gazette text before citation, and the study does not measure removal outcomes in numbers.

3. Literature Review

The early scholarship rejects the narrow "revenge porn" label. Citron and Franks argued for criminalisation based on privacy and sexual autonomy.[8] McGlynn and Rackley proposed "image-based sexual abuse", covering creating, taking and sharing images without consent, including altered images, on a continuum of sexual violence.[9] Citron developed "sexual privacy", which supports treating deepfakes as a privacy and dignity harm even where no real intimate image existed.[10] Chesney and Citron noted how hard it is to fit synthetic media into doctrines built around publishing true information,[11] and Franks and Waldman argued that sexual deepfakes lack the expressive value free-speech defences rely on.[12] The European Court of Human Rights has treated online sexual image abuse as a failure of the State's positive duties under Articles 3 and 8 where authorities do not investigate effectively.[13]

On platforms, Gillespie and Suzor show how platforms act almost like regulators through opaque policies.[14] In India the key authority is Shreya Singhal v. Union of India, which read down s. 79(3)(b) IT Act so that "actual knowledge" means a court order or government notification.[15] The 2021 Rules let a victim's complaint trigger removal, which sits uneasily with that reading.[16] Indian writing is thinner than elsewhere: constitutional work after Puttaswamy treats privacy and dignity as protected by Article 21,[17] civil-society groups such as the Internet Freedom Foundation have recorded the Delhi High Court's directions in Mrs X v. Union of India,[18] and the Justice Verma Committee Report is the source of the voyeurism offence now in s. 77 BNS.[19]

Three gaps follow. Little work treats Indian remedies as a sequence and asks where victims drop out. The 2026 amendments are too recent for sustained criticism on how faster deadlines relate to due process. And comparative work usually studies criminalisation only, not the whole remedial pathway. This paper addresses all three.

4. Analysis

4.1 Constitutional foundations

Justice K.S. Puttaswamy (Retd.) v. Union of India held that privacy is part of life and personal liberty under Article 21, including bodily integrity, control over personal information and dignity.[20] NCII and deepfakes affect all three. Article 21 supports State action, and Article 15(3) allows special provision for women.[21] On the other side, restrictions on speech must fall within Article 19(2) and be proportionate.[22] Sexual deepfakes of identifiable people have no real claim to protected expression, but the removal machinery (short deadlines, blocking powers, penalties) can also reach lawful content. Each remedy is therefore tested on two questions: does it work for the victim, and is it proportionate?

4.2 The substantive offences (RQ1)

India has no dedicated NCII statute. In Mrs X v. Union of India, the Delhi High Court recorded that NCII is not defined in the IT Act or the Rules, and that is still true.[23] Liability is put together from general provisions.

BNS 2023. Section 77 (voyeurism, replacing s. 354C IPC) punishes capturing the image of a woman in a private act, and spreading an image taken with consent but shared without it (one to three years on first conviction, three to seven on later ones).[24] Sections 75 and 79 cover sexual harassment and insulting a woman's modesty.[25] Sections 351 and 308 cover intimidation and extortion, including sextortion.[26] Sections 336 (forgery) and 356 (defamation) are the obvious routes for fabricated images, though neither was drafted for deepfakes.[27]
IT Act 2000. Section 66E punishes capturing, publishing or transmitting an image of a private area without consent, but its reliance on "capture" makes it doubtful for synthetic images.[28] Sections 67 and 67A punish publishing obscene or sexually explicit material. They focus on obscenity and not on the victim's lack of consent, so they treat the victim's injury as a side issue to public morality.[29] Sections 66C and 66D (identity theft; cheating by personation) are used where a deepfake pretends to be the victim.[30]

Three problems follow. First, nothing defines intimate images, separates consent to creation from consent to sharing, or deals with synthetic images. Second, s. 77 BNS is gender-specific on its face, leaving male, transgender and non-binary victims with the less fitting IT Act provisions. Third, there is a creation gap: no offence covers making a sexual deepfake, asking for one, possessing it, threatening to make or share it, or supplying the tools. The UK, by contrast, now punishes creating and requesting such images[31] and supplying tools designed to make fake nudes.[32]

4.3 Remedy 1: urgent removal (RQ2)

Intermediaries keep safe harbour under s. 79 IT Act only if they follow the due diligence rules.[33] Rule 3(2)(b) of the 2021 Rules requires them to act on a complaint from an individual, or someone acting for them, about content showing nudity or a sexual act, or impersonating the person, including through morphed images.[34] The time limit was 24 hours and, according to commentary on the 2026 notification, is now two hours.[35] Under Rule 3(1)(d), the time to comply with a court order or reasoned government intimation fell from 36 hours to three.[36] Section 69A blocking also exists but is slow, opaque and not designed for victims to start.[37] The amendment also requires labelling of lawful synthetic content and, under Rule 3(3), reasonable technical measures by tools that create synthetic content to prevent unlawful output, reportedly including NCII.[38]

Strengths. The two-hour deadline turns platform policy into a legal duty with a clear consequence, loss of safe harbour. It needs no court order, it expressly covers morphed images, and it is the fastest legal deadline of the three jurisdictions.

Weaknesses.

Legal basis. Shreya Singhal tied "actual knowledge" to court or government orders.[39] The complaint route can be defended only as a due-diligence condition of safe harbour, which is not settled, so the Rules remain open to a challenge that they go beyond the powers given by the Act.
Hard to assess in time. Commentators note that deciding illegality in two or three hours is difficult.[40] With a short deadline and a heavy penalty, the sensible platform response is to remove first and check later.
No counter-notice. The summaries reviewed show no right for the uploader to object, and no penalty for bad-faith complaints. That is acceptable for real NCII but risky for disputed content such as journalism or falsely reported consensual material.
Verification and reach. Victims may be asked to submit the very image they want removed. And the duty reaches only intermediaries that respond to Indian law, so sites that ignore it face only s. 69A blocking, which does not delete content and can be avoided with mirror sites and VPNs.
Court support in doubt. Mrs X required removal of all identified offending content, not only the URLs supplied, and de-indexing by search engines.[41] Search engines appealed,[42] and the appeal order is reported to have set aside the direction on mandatory hash-matching beyond their current capabilities. Its exact effect should be checked before citation.

On paper, removal is India's strongest remedy. Its weakness is not speed but the thin due-process protection around it and its dependence on platforms cooperating.

4.4 Remedy 2: preventing further circulation (RQ3)

Removing a single URL does little if copies spread across sites, messaging groups and search results. Prevention is the most important remedy and the least developed.

The existing Indian tools are limited. The Mrs X directions told intermediaries to stop reported content resurfacing, told search engines to use existing hash-matching, proposed a token system so victims need not keep reporting, and recommended a trusted, encrypted MeitY platform under Rule 3(2)(c) for victims to register content.[43] How far these bind beyond the parties, and their status after the appeal, are uncertain. Rule 4(4) of the 2021 Rules asks significant social media intermediaries to try to detect content identical to removed content, but its categories do not clearly cover adult NCII.[44] Rule 3(3) of the 2026 amendment is a new duty on the creation side, but it depends on technical feasibility and reaches only intermediaries within Indian law.[45]

There is no legal duty on platforms to use hash-matching for adult NCII, no national hash registry, no lasting "do not re-host" instruction, and no duty on messaging services. Private tools such as StopNCII.org, where taking-part platforms match hashes made on the victim's own device, work only with platforms that have joined and only if the victim has the image. Synthetic material makes matching harder because variants are cheap and change the hash. This gap between R1 and R2 is the biggest single gap between "takedown" and "redress".

4.5 Remedy 3: identifying perpetrators (RQ3)

Identification is possible only where the law allows, and that is narrower than victims often think. There are three main routes.

Criminal process. Once an FIR is registered, police can require subscriber data under s. 94 BNSS, seize devices, and rely on electronic records certified under s. 63 BSA 2023.[46] Intermediaries must give information to authorised agencies within 72 hours.[47] Rule 4(2) requires significant messaging services to enable tracing of the first originator for serious offences, but its operation against end-to-end encryption is contested in court.[48]
Civil disclosure orders. Indian courts have granted Norwich Pharmacal-style and "John Doe" orders requiring platforms and telecom providers to reveal subscriber details so that a plaintiff can sue.[49]
Mutual legal assistance. Where data or the offender is abroad, a treaty request or letter rogatory is formally required.[50] It is far too slow for an urgent harm, so direct requests to platform portals are used, which depend on voluntary compliance.

Identification therefore works only when a complaint is registered and acted on, the platform has kept the data, and the offender is within reach. The main obstacles, in the order victims meet them, are police reluctance to register cyber-complaints, short log retention, data stored abroad, and encryption. These are propositions the interview study is meant to test.

4.6 Remedy 4: meaningful relief (RQ1, RQ3)

Criminal punishment. Sentences are moderate (up to three years under s. 66E IT Act, one to three under s. 77 BNS on a first conviction),[51] and some forms are bailable or compoundable, which weakens deterrence and may pressure victims to compromise. Because there is no creation offence, harm is punished only at publication.

Compensation. Compensation under the BNSS is at the court's discretion, and State schemes are mostly designed for physical offences.[52] Civil damages for privacy and defamation exist after Puttaswamy, but cost, delay and the burden of proof mean ordinary victims rarely pursue them.[53]

Data protection. The Digital Personal Data Protection Act 2023 gives a right to correction and erasure,[54] but the exemption for personal or domestic processing puts the individual perpetrator outside it, the Board cannot give emergency relief, and the Act is still being brought into force in stages. High Court recognition of a "right to be forgotten" is inconsistent and not settled by the Supreme Court.[55]

Procedure. The identity protection in s. 72 BNS does not, on its wording, extend to NCII offences, so victims lack the protection rape victims have.[56]

Meaningful relief therefore depends on judges being creative and victims being persistent. No single door gives a victim removal, preservation, an injunction and interim compensation together.

4.7 Comparison with the United Kingdom and the European Union (RQ4)

United Kingdom. Section 66B of the Sexual Offences Act 2003, inserted by the Online Safety Act 2023, criminalises sharing or threatening to share an intimate image without consent, with no motive required for the basic offence, and it covers images that appear to show a person, so deepfakes are included.[57] The Data (Use and Access) Act 2025 added offences of creating and requesting purported intimate images.[58] The Crime and Policing Act 2026 is reported to create a tools-supply offence, a 48-hour platform removal duty and deletion orders on conviction.[59]

European Union. Directive 2024/1385, Article 5, requires Member States to criminalise sharing intimate or manipulated material without consent, and Article 23 requires removal measures.[60] Article 5 has no "reasonable expectation of privacy" requirement.[61] The Digital Services Act requires notice-and-action systems, statements of reasons, internal complaints and out-of-court dispute settlement, and priority for trusted flaggers.[62] It sets no hour limit ("without undue delay") and bans general monitoring, which limits compulsory proactive filtering.[63] The CJEU's Glawischnig-Piesczek decision allows injunctions covering identical and, under conditions, equivalent content.[64]

India leads on the speed of its deadline and on expressly covering morphed content. It trails on creation offences, structured prevention, counter-notice and appeal safeguards, and procedural protection. The UK's strength is criminal coverage and regulator enforcement, and the EU's is safeguards and harmonisation, at the cost of speed. A sensible approach would combine India's speed with the EU's safeguards and the UK's creation offences.[65]

4.8 Tensions that cut across the analysis

Speed and due process. Short deadlines are justified because the harm cannot be undone, but they shift the cost of mistakes onto uploaders and lawful expression. The answer is not slower removal but safeguards alongside speed: provisional removal with quick review, counter-notice, penalties for knowingly false complaints, and transparency reports.

Real and synthetic images. A victim's remedy should not depend on whether the image is "real". The 2026 definition of synthetic information captures this for regulation, but the criminal law has not caught up.

5. Findings

Removal is India's strongest remedy. It has one of the shortest deadlines found in this study and expressly covers synthetic images, but has no counter-notice, no penalty for bad-faith complaints and no published review outcomes.
The legal basis of the complaint route is unsettled, given Shreya Singhal, which creates a hidden risk that the regime could be challenged as going beyond the Act.
Prevention is the weakest link. No statute requires hash-matching or duplicate removal for adult NCII, and the main directions in Mrs X are contested on appeal.
The criminal law is scattered, partly gender-specific and has a creation gap, with no definition of NCII or sexual deepfakes.
Identification is indirect and slow, depending on police registration, data retention and cross-border cooperation.
Relief is discretionary and spread across different laws, with no identity protection for victims and no single procedure.
Compared with the UK and EU, India leads on speed and trails on coverage and safeguards.
Practice is likely to differ from the text, which is a proposition for empirical testing.

6. Recommendations

Define the field. Define "intimate image" and "sexually explicit synthetic image" in a way that does not depend on technology, and state that consent to creation is separate from consent to sharing.
Close the creation gap. Create offences of creating, requesting, threatening to create or share, and possessing to distribute a sexual deepfake of an identifiable adult without consent, with defences for genuine journalistic, artistic or law-enforcement use.
Make s. 77 BNS gender-neutral, and restrict the commercial supply of tools whose main purpose is making non-consensual sexual images.
Keep the two-hour deadline, but add safeguards: provisional removal with quick review, counter-notice (except where NCII is clear), a penalty for knowingly false complaints, and yearly transparency reports. Put the legal basis beyond doubt by amending s. 79 or adding an express statutory ground.
Protect privacy in complaints. Allow reporting by URL or privacy-protecting hash, and limit how long intermediaries keep the image.
Build a national, privacy-protecting hash registry, as Mrs X recommended, run by a trusted body with strict purpose limits, independent oversight and device-side hashing. Impose a proportionate duty to suppress duplicates of registered hashes that does not amount to general monitoring, and extend duties to generative-AI providers.
Create preservation on request. Require intermediaries to keep identified data for a fixed period (for example 180 days) on a victim's or police request, with disclosure only on lawful process, and allow Norwich Pharmacal-type orders by statute from a designated magistrate or tribunal.
Extend identity protection (s. 72 BNS) and in-camera procedure to NCII cases, and provide a one-stop summary civil procedure giving removal, preservation, an injunction and interim compensation.
Improve compensation and data. Include image-based abuse in victim compensation schemes, consider a levy on non-compliant platforms, and require the NCRB to publish disaggregated data on NCII and synthetic images.

7. Conclusion

The central question was whether Indian law gives victims an effective route to removal, prevention, identification and relief. The answer is partly, and unevenly. On removal, the 2026 amendments gave India a fast, victim-triggered regime whose weaknesses are procedural and not about time. On prevention and identification, the framework relies on judicial directions, voluntary platform tools and slow cross-border processes. On substantive law and relief, it relies on a patchwork with no definition, a gender-specific voyeurism offence and no offence for creating deepfakes. Compared with the UK and EU, India is ahead on speed but behind on coverage and safeguards.

India has built an effective takedown mechanism but not yet a redress system. The proposed reforms are not a call for harsher or faster rules, but for completing the pathway: defining the wrong, penalising its creation, making prevention lasting and identification reliable, and attaching to the speed of removal the safeguards that make it constitutionally sustainable. Future research should test these propositions through practitioner interviews and a systematic study of removal outcomes under the amended Rules.

References / Bibliography

Legislation (India):

1. Constitution of India, arts. 15(3), 19, 21;

2. Bharatiya Nyaya Sanhita 2023;

3. Bharatiya Nagarik Suraksha Sanhita 2023;

4. Bharatiya Sakshya Adhiniyam 2023;

5. Information Technology Act 2000;

6. IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, and the Amendment Rules 2026, G.S.R. 120(E)

7. Digital Personal Data Protection Act 2023;

8. Protection of Children from Sexual Offences Act 2012.

Cases (India):

1. Anil Kapoor v Simply Life India (Delhi HC, 20 September 2023

2. Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1;

3. Mrs X v Union of India 2023 SCC OnLine Del 2361 (Delhi HC, 26 April 2023),

4. Appeal Google LLC v Mrs X, LPA 372/2024;

5. Shreya Singhal v Union of India (2015) 5 SCC 1;

6. Subhranshu Rout @ Gugul v State of Odisha, BLAPL No. 4592 of 2020 (Orissa HC, 2020).

Comparative:

1. Sexual Offences Act 2003 (UK), ss. 66A-66E

2. Online Safety Act 2023; Data (Use and Access) Act 2025

3. Crime and Policing Act 2026; Directive (EU) 2024/1385

4. Regulation (EU) 2022/2065 (DSA)

5. Glawischnig-Piesczek v Facebook Ireland (C-18/18)

6. Norwich Pharmacal Co v Customs and Excise Commissioners [1974] AC 133

7. Volodina v Russia (No. 2), App. no. 40419/19, ECtHR, 2021.

Books and articles:

1. Chesney, R. and Citron, D.K. (2019) 'Deep Fakes', California Law Review, 107, p. 1753.

2. Citron, D.K. (2019) 'Sexual Privacy', Yale Law Journal, 128, p. 1870.

3. Citron, D.K. and Franks, M.A. (2014) 'Criminalizing Revenge Porn', Wake Forest Law Review, 49, p. 345.

4. Escobar Veas, J. (2026) 'The criminalisation of non-consensual sharing of intimate material under EU law', New Journal of European Criminal Law.

5. Franks, M.A. and Waldman, A.E. (2019) 'Sex, Lies, and Videotape', Maryland Law Review, 78, p. 892. Gillespie, T. (2018) Custodians of the Internet. Yale University Press.

6. McGlynn, C. and Rackley, E. (2017) 'Image-Based Sexual Abuse', Oxford Journal of Legal Studies, 37(3), p. 534.

7. McGlynn, C., Rackley, E. and Houghton, R. (2017) 'Beyond "Revenge Porn"', Feminist Legal Studies, 25, p. 25. Suzor, N. (2019) Lawless. Cambridge University Press.

Reports and secondary sources:

1. Committee on Amendments to Criminal Law (Justice J.S. Verma Committee) (2013) Report

2. Internet Freedom Foundation (2023) on the Delhi HC directions in Mrs X iPleaders (2026) 'IT Rules 2026'

3. Kingsley Napley (2026) 'Deepfakes to Deletion Orders', 28 May 2026;

4. MediaNama (2026) reports on MeitY's synthetic media amendments

5. Mondaq (2026) 'MeitY Notifies the IT Amendment Rules 2026';

6. Vajiram & Ravi (2026) 'Regulating Synthetic Media'.

[1] Clare McGlynn, Erika Rackley & Ruth Houghton, Beyond “Revenge Porn”: The Continuum of Image-Based Sexual Abuse, 25 Feminist Legal Stud. 25 (2017).

[2] Robert Chesney & Danielle Keats Citron, Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security, 107 Calif. L. Rev. 1753 (2019).

[3] Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, G.S.R. 120(E) (India) (notified Feb. 10, 2026; effective Feb. 20, 2026) [hereinafter 2026 Amendment Rules].

[4] Crime and Policing Act 2026 (UK).

[5] Directive (EU) 2024/1385 of the European Parliament and of the Council of May 14, 2024 on Combating Violence Against Women and Domestic Violence, 2024 O.J. (L 2024/1385).

[6] Clare McGlynn & Erika Rackley, Image-Based Sexual Abuse, 37 Oxford J. Legal Stud. 534 (2017).

[7] Protection of Children from Sexual Offences Act, 2012, No. 32 of 2012 (India); Information Technology Act, 2000, No. 21 of 2000, § 67B (India).

[8] Danielle Keats Citron & Mary Anne Franks, Criminalizing Revenge Porn, 49 Wake Forest L. Rev. 345 (2014).

[9] McGlynn & Rackley, supra note 6.

[10] Danielle Keats Citron, Sexual Privacy, 128 Yale L.J. 1870 (2019).

[11] Chesney & Citron, supra note 2.

[12] Mary Anne Franks & Ari Ezra Waldman, Sex, Lies, and Videotape: Deep Fakes and Free Speech Delusions, 78 Md. L. Rev. 892 (2019).

[13] Volodina v. Russia (No. 2), App. No. 40419/19 (Eur. Ct. H.R. Sept. 14, 2021).

[14] Tarleton Gillespie, Custodians of the Internet: Platforms, Content Moderation, and the Hidden Decisions that shape social media (2018)

[15] Shreya Singhal v. Union of India, (2015) 5 S.C.C. 1 (India).

[16] Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, G.S.R. 139(E), r. 3(2)(b) (India) [hereinafter 2021 Rules].

[17] Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 S.C.C. 1 (India).

[18] Delhi HC Issues Directions to Search Engines and Other Authorities for Dealing with the Dissemination of Non-Consensual Intimate Images (NCII), Internet Freedom Found. (2023), https://www.internetfreedom.in/delhi-hc-issues-directions-to-search-engines-and-other-authorities-for-dealing-with-the-dissemination-of-non-consensual-intimate-images-ncii/; Mrs. X v. Union of India, 2023 SCC OnLine Del 2361 (Delhi High Ct. Apr. 26, 2023) (India).

[19] Comm. on Amends. to Crim. L., Report of the Committee on Amendments to Criminal Law (2013) (India) (chaired by J.S. Verma); Bharatiya Nyaya Sanhita, 2023, No. 45 of 2023, § 77 (India).

[20] Puttaswamy, (2017) 10 S.C.C. 1; see also India Const. art. 21.

[21] India Const. art. 15, cl. 3.

[22] Id. art. 19, cl. 2.

[23] Mrs. X, 2023 SCC OnLine Del 2361.

[24] Bharatiya Nyaya Sanhita § 77 (replacing Indian Penal Code, 1860, No. 45 of 1860, § 354C (India)).

[25] Bharatiya Nyaya Sanhita §§ 75, 79.

[26] Id. §§ 308, 351.

[27] Id. §§ 336, 356.

[28] Information Technology Act § 66E.

[29] Id. §§ 67, 67A.

[30] Id. §§ 66C, 66D.

[31] Sexual Offences Act 2003, c. 42, § 66E (UK) (as inserted by Data (Use and Access) Act 2025, c. 18 (UK)).

[32] Crime and Policing Act 2026, § 99 (UK).

[33] Information Technology Act § 79.

[34] 2021 Rules, supra note 16, r. 3(2)(b).

[35] IT Rules 2026, iPleaders (2026), https://blog.ipleaders.in/it-rules-2026/; MediaNama, Reports on MeitY’s Synthetic Media Amendments (2026).

[36] 2021 Rules, supra note 16, r. 3(1)(d); MeitY Notifies the IT Amendment Rules 2026, Mondaq (2026).

[37] Information Technology Act § 69A.

[38] 2026 Amendment Rules, supra note 3, r. 3(3).

[39] Shreya Singhal, (2015) 5 S.C.C. 1.

[40] Vajiram & Ravi, Regulating Synthetic Media (2026).

[41] Mrs. X, 2023 SCC OnLine Del 2361.

[42] Google LLC v. Mrs. X, L.P.A. No. 372/2024 (Delhi High Ct.) (India).

[43] Mrs. X, 2023 SCC OnLine Del 2361; 2021 Rules, supra note 16, r. 3(2)(c).

[44] 2021 Rules, supra note 16, r. 4(4).

[45] 2026 Amendment Rules, supra note 3, r. 3(3).

[46] Bharatiya Nagarik Suraksha Sanhita, 2023, No. 46 of 2023, § 94 (India); Bharatiya Sakshya Adhiniyam, 2023, No. 47 of 2023, § 63 (India).

[47] 2021 Rules, supra note 16, r. 3(1)(j).

[48] Id. r. 4(2).

[49] Norwich Pharmacal Co. v. Customs & Excise Comm’rs, [1974] A.C. 133 (H.L.) (appeal taken from Eng.).

[50] Bharatiya Nagarik Suraksha Sanhita ch. VIII.

[51] Information Technology Act § 66E; Bharatiya Nyaya Sanhita § 77.

[52] See generally Bharatiya Nagarik Suraksha Sanhita.

[53] See Puttaswamy, (2017) 10 S.C.C. 1; see also Anil Kapoor v. Simply Life India (Delhi High Ct. Sept. 20, 2023) (India).

[54] Digital Personal Data Protection Act, 2023, No. 22 of 2023, § 12 (India).

[55] See, e.g., Subhranshu Rout @ Gugul v. State of Odisha, BLAPL No. 4592 of 2020 (Orissa High Ct. 2020) (India).

[56] Bharatiya Nyaya Sanhita § 72.

[57] Sexual Offences Act 2003, c. 42, § 66B (UK) (as inserted by Online Safety Act 2023, c. 50 (UK)).

[58] Data (Use and Access) Act 2025, c. 18 (UK).

[59] Crime and Policing Act 2026, §§ 99, 100(2) (UK); Deepfakes to Deletion Orders: Tackling Technology Enabled Sexual Offending in the Crime and Policing Act 2026, Kingsley Napley (May 28, 2026).

[60] Directive (EU) 2024/1385, supra note 5, arts. 5, 23.

[61] J. Escobar Veas, The Criminalisation of Non-Consensual Sharing of Intimate Material Under EU Law, New J. Eur. Crim. L. (2026).

[62] Regulation (EU) 2022/2065 of the European Parliament and of the Council of Oct. 19, 2022 on a Single Market for Digital Services and Amending Directive 2000/31/EC (Digital Services Act), 2022 O.J. (L 277) 1, arts. 16–17, 20–22.

[63] Id. art. 8.

[64] Case C-18/18, Glawischnig-Piesczek v. Facebook Ireland Ltd., ECLI:EU:C:2019:821 (Oct. 3, 2019).

[65] Nicolas P. Suzor, Lawless: The Secret Rules that govern our Digital Lives (2019)