Cyberbullying of a child — how to report it

Cyberbullying of a child engages four parallel regimes — the child-specific offence under Section 67B of the Information Technology Act, 2000, the substantive offences under Sections 11 to 15 of the Protection of Children from Sexual Offences Act, 2012, the mandatory-reporting duty under Section 19 POCSO backed by the Section 21 failure-to-report offence, and the Bharatiya Nyaya Sanhita, 2023 general overlay. This piece sets out how the four interlock, where they pull in different directions, and the working complaint route in 2026.

There is no offence in the Indian statute book called "cyberbullying." The conduct that the term captures — sustained online harassment of a child, the circulation of degrading or sexualised imagery, the impersonation-and-shaming pattern that runs through school WhatsApp groups and Instagram reels — is criminalised through four parallel architectures that the complainant must learn to invoke in the same breath. The first is the Information Technology Act, 2000, with the child-specific offence at Section 67B sitting alongside Sections 66E, 67 and 67A. The second is the Protection of Children from Sexual Offences Act, 2012, with the substantive offences at Sections 11, 12 and 13 to 15 and — critically — the mandatory-reporting duty at Section 19 backed by the Section 21 failure-to-report offence. The third is the Bharatiya Nyaya Sanhita, 2023, supplying the general criminal-intimidation and obscenity overlay. The fourth is the Juvenile Justice (Care and Protection of Children) Act, 2015, whose Section 75 cruelty offence catches non-sexual but harmful bullying. The reading after Just Rights for Children Alliance v S Harish, (2024) SCC OnLine SC 2611 has materially expanded the reach of the child-specific offences and tightened the mandatory-reporting obligation on adults — including parents, teachers and intermediaries — who become aware of the conduct.

Section 67B IT Act — the child-specific offence and its five limbs

Section 67B of the IT Act, 2000, inserted by the 2008 amendment, is the single most consequential provision in the cyberbullying-of-a-child architecture. It punishes the publishing or transmission of "material depicting children in sexually explicit act, etc." in electronic form with imprisonment up to five years and a fine up to ten lakh rupees on first conviction, and up to seven years and ten lakh rupees on second conviction. The drafting is unusually broad and runs across five distinct limbs. Clause (a) catches the publishing or transmission of material that depicts children engaged in sexually explicit conduct. Clause (b) catches the creation, collection, seeking, browsing, downloading, advertising, promoting, exchanging or distributing of such material. Clause (c) catches the cultivation, enticing or inducing of children into online relationships with one or more children for and on a sexually explicit act, in a manner that may offend a reasonable adult. Clause (d) catches the facilitation of abuse of children online. Clause (e) catches the recording in any electronic form of the abuse of the child sexually.

The breadth of clause (b) is what makes Section 67B materially different from Section 67 and Section 67A. The clause does not require publication or transmission to a third party; mere browsing or downloading is criminalised. The Supreme Court in Just Rights for Children Alliance v S Harish, (2024) SCC OnLine SC 2611 — overturning the Madras High Court order that had quashed the FIR on the ground that storage and viewing without transmission did not constitute an offence — confirmed that the storage and viewing of child sexual abuse material is squarely within Section 67B(b). The Court also read into the POCSO framework a substantive offence at Section 15 covering the same conduct, and held that the use of the older, sanitising phrase "child pornography" should be replaced in judicial and statutory discourse with "child sexual abuse material" (CSAM). The doctrinal effect is that the Indian framework, post-S Harish, is among the strictest globally — possession alone is an offence, and there is no de minimis exception.

Section 66E of the IT Act adds the violation-of-privacy offence — punishing the capturing, publishing or transmitting of an image of the private area of any person, including a child, without consent and under circumstances violating privacy. Section 67 catches the publication or transmission of generally obscene material in electronic form. Section 67A catches sexually explicit material that is not child-specific. The four sections operate in cumulative layers — the prosecution invokes whichever combination the facts will sustain. Section 75 of the IT Act supplies the extraterritorial reach: the IT Act offences apply to any person, irrespective of nationality, if the act or conduct constituting the offence involves a computer, computer system or computer network located in India. The provision is the doctrinal anchor for prosecutions where the perpetrator is outside India but the victim, the platform server, or the routing infrastructure is in India.

POCSO Act — substantive offences and the mandatory-reporting duty

The Protection of Children from Sexual Offences Act, 2012 supplies the child-protective architecture that runs in parallel with the IT Act. Section 11 defines sexual harassment of a child to include — at clause (iv) — repeatedly or constantly following, watching or contacting a child either directly or through electronic, digital or any other means, and — at clause (v) — threatening to use, in any form of media, a real or fabricated depiction through electronic, film or digital or any other mode of any part of the body of the child or the involvement of the child in a sexual act. Section 12 prescribes the punishment — imprisonment up to three years and a fine. The provisions are the doctrinal home of the bulk of school-cyberbullying conduct that is sexualised in nature: persistent DM-ing of a child, the morphing-and-circulation of school-uniform photographs, the threatening WhatsApp messages that traffic in sexual humiliation.

Sections 13 to 15 POCSO are the heavy artillery. Section 13 defines the use of a child for pornographic purposes — using a child in any form of media, including programme or advertisement telecast by television channels or internet or any other electronic form, for the purposes of sexual gratification. Section 14 prescribes the punishment for the offence under Section 13, with enhanced punishment where the pornographic material involves penetrative or aggravated penetrative sexual assault. Section 15, as amended in 2019 and reinforced by the post-S Harish reading, prescribes the punishment for storage or possession of pornographic material involving a child — with three sub-clauses now criminalising (i) failure to destroy or report such material with intent to share or transmit, (ii) the use, display, propagation or distribution of such material, and (iii) the storage or possession of such material for commercial purposes. The combined reach of Section 15 POCSO and Section 67B(b) IT Act produces the strict-possession standard that S Harish confirmed.

Section 19 POCSO is the mandatory-reporting duty — and it is the single provision most often missed by the adults in a cyberbullying-of-a-child case. The section requires any person who has apprehension that an offence under the Act is likely to be committed or has knowledge that such an offence has been committed to provide such information to the Special Juvenile Police Unit or the local police. The duty is unqualified — it applies to parents, school administrators, intermediary platforms, treating doctors, teachers in whose group the bullying surfaces, and any adult bystander. Section 19(2) requires the police to ascribe an entry number to the information and read it over to the informant. Section 20 places a parallel duty on persons in charge of media, studios, photographic facilities, and hotels. Section 21 makes the failure to report itself an offence — punishable with imprisonment up to six months and a fine for an ordinary person, and up to one year for a person in charge of an institution. The Section 21 offence is the route through which a school that buries an incident, or a platform that fails to escalate, faces direct criminal exposure independent of the underlying conduct.

The procedural protections in POCSO are extensive. Section 24 governs the recording of the statement of the child — to be recorded at the residence of the child or a place of the child's choice, by a woman police officer not below the rank of sub-inspector, in plain clothes. Section 25 requires the statement to be recorded as spoken by the child. Section 26 mandates the presence of a parent or person trusted by the child during the recording. Section 28 designates Special Courts for trial of POCSO offences. Sections 33 to 38 govern the trial procedure — Section 33 prohibits aggressive questioning of the child, mandates in-camera trial, and requires the child not to be exposed to the accused; Section 35 requires the evidence to be recorded within thirty days and the trial completed within one year, so far as possible; Section 36 protects against the child being made to see the accused in any way. Section 45 empowers the Central Government to make rules — the POCSO Rules, 2020 are the operational instrument, with Rule 4 specifying school-level child protection committees and Rule 5 specifying the procedure for emergency medical care.

The BNS overlay and the JJ Act catch-all

The Bharatiya Nyaya Sanhita, 2023 supplies the general criminal-law overlay. Section 75 BNS [Section 354A IPC] is the sexual-harassment offence in its general form, with clause (iv) covering the use of words, gestures or acts of a sexual nature and clause (i) covering physical contact and advances involving unwelcome and explicit sexual overtures. Section 78 BNS [Section 354D IPC] is the stalking offence — and clause (b) explicitly covers the monitoring of any electronic communication or contact attempt through e-mail or any other form of electronic communication, despite a clear indication of disinterest by the person being followed. Section 79 BNS [Section 509 IPC] catches words, sounds, gestures or exhibition of any object intended to insult the modesty of a woman, including by means of any electronic communication. Section 296 BNS [Section 294 IPC] catches the doing of any obscene act in any public place, or the singing, reciting or uttering of any obscene song, ballad or words in or near any public place — in the cyberbullying context, the section is invoked where the bullying spills into open platforms with public-facing exposure. Section 351 BNS [Section 503 IPC] is criminal intimidation — threatening any person with injury to person, reputation or property, with intent to cause alarm, or to cause the person to do any act not legally bound to do. The section is the workhorse provision for the threatening-to-circulate-images pattern that runs through teenage cyberbullying.

The Juvenile Justice (Care and Protection of Children) Act, 2015 fills the gap that POCSO does not reach. Section 75 of the JJ Act punishes the assault, abandonment, abuse, exposure or wilful neglect of a child in any manner likely to cause unnecessary mental or physical suffering — with imprisonment up to three years and a fine of one lakh rupees, and enhanced punishment up to ten years where the child becomes physically incapacitated or develops a mental illness, or is rendered mentally unfit to perform regular tasks, or has the risk to life or limb. The provision is the principal home of non-sexual cyberbullying — the doxxing campaign, the orchestrated public humiliation, the sustained group-mockery that does not engage the POCSO machinery but plainly causes mental suffering. The constitutional anchoring of the JJ Act's protective duty is supplied by Bachpan Bachao Andolan v Union of India, (2011) 5 SCC 1 — the public-interest litigation that established the Article 21 framework for child protection across institutional and online contexts.

The intermediary overlay and the takedown obligation

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 layer onto the offences architecture a separate set of obligations on the platform. Rule 3(1)(b) requires the intermediary to publish terms of service prohibiting the hosting, display or upload of content that is harmful to a child or is paedophilic. Rule 3(2)(b) imposes a strict twenty-four-hour takedown obligation on the platform for content depicting a child in full or partial nudity or sexual act or conduct — and the obligation runs from the receipt of the complaint. Rule 4(4) — applicable to Significant Social Media Intermediaries — requires the platform to deploy technology-based measures, including automated tools, to proactively identify information depicting any act of child sexual abuse or sexual conduct involving children. The proactive-identification obligation is unique to child-protection content; the Rules do not impose a comparable duty in respect of other content categories. The Section 79 safe harbour after Shreya Singhal v Union of India, (2015) 5 SCC 1 — which read down Section 79(3)(b) to require a court order or government notification for the loss of safe harbour — operates more thinly here, because the Rule 4(4) obligation produces an independent regulatory liability irrespective of safe-harbour status.

The National Cybercrime Reporting Portal at cybercrime.gov.in operates a dedicated complaint category — "Report Child Pornography (CP) / Child Sexual Abuse Material (CSAM) / Sexually Explicit Content." The category allows anonymous reporting and routes the complaint to the National Cyber Crime Reporting Portal's CSAM Cyber-Tipline, mirrored through the NCRB's coordination with the National Center for Missing & Exploited Children (NCMEC) in the United States. The mirroring framework was operationalised through the 2019 NCRB MoU and supplies the cross-border evidentiary pipeline that the Section 75 IT Act extraterritorial reach assumes. CHILDLINE — now operating as the CHILDLINE 1098 service under the Mission Vatsalya framework of the Ministry of Women and Child Development — supplies the immediate child-protection escalation, but the legal reporting duty under Section 19 POCSO is not discharged by a call to CHILDLINE alone; the formal information to the Special Juvenile Police Unit remains mandatory.

The complaint route in practice — sequencing and pitfalls

A cyberbullying-of-a-child complaint engages four filings in parallel, not sequentially. The first is the platform takedown report under Rule 3(2)(b) of the IT Rules 2021, with the supplementary report under the platform's CSAM-specific channel where applicable. The takedown clock under Rule 3(2)(b) runs from the moment the complaint is received; the supplementary CSAM channel — Meta's Stop NCII / NCMEC partnership, Google's CSAM hash-matching, the X reporting flow — is the operational route through which the platform fulfils its Rule 4(4) proactive-identification obligation. The second is the National Cybercrime Reporting Portal complaint at cybercrime.gov.in under the CSAM category, which produces a complaint reference number that is the documentary anchor for downstream escalations.

The third is the formal Section 19 POCSO information to the Special Juvenile Police Unit or local police. The information should be in writing, identify the child without disclosing the child's name in any public-facing copy (Section 23 POCSO prohibits disclosure of the identity of the child in any form of media), describe the apprehension or knowledge of the offence with date, platform and screenshot reference, and request acknowledgement under Section 19(2). Where the school, parent, or treating professional is the informant, the Section 21 failure-to-report exposure makes the writing of this letter not optional. The fourth is the FIR under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 [Section 154 CrPC] invoking Section 67B IT Act, Sections 11, 12, 13, 14 or 15 POCSO as the facts will sustain, and the BNS Sections 75, 78, 79 and 351 as the general overlay. Lalita Kumari v Government of Uttar Pradesh, (2014) 2 SCC 1 holds that FIR registration is mandatory where the information discloses a cognizable offence; Section 67B IT Act, Sections 13 and 15 POCSO, and Sections 75 and 78 BNS are all cognizable.

Three pitfalls are visible in the reported cases. The first is the disclosure-of-identity violation under Section 23 POCSO — police, schools and intermediary public statements that name or describe the child in identifiable terms attract the Section 23 offence. The Supreme Court in Nipun Saxena v Union of India, (2019) 13 SCC 715 — the comprehensive ruling on the anonymity of rape and child-sexual-abuse victims — set out the framework that applies equally to cyberbullying victims under POCSO, including the prohibition on disclosure even after the death of the victim, and the requirement that media houses obtain prior approval before any disclosure that may indirectly identify the child. The second is the school's institutional liability — under the POCSO Rules, 2020, the school is required to maintain a child protection committee and to operationalise a Code of Conduct that includes a digital-safety protocol; failure to operationalise the Code, combined with the Section 21 failure-to-report exposure, has been the route through which CBSE-affiliated and private schools have faced direct prosecution. The third is the misidentification of the offence — invoking only the BNS sexual-harassment offence under Section 75 BNS while ignoring the Section 67B IT Act and POCSO offences produces a softer prosecution and a thinner trial framework, because the POCSO protections at Sections 33 to 38 do not attach unless POCSO is invoked.

The trial-court line and what it has settled

The trial-court jurisprudence on Section 67/67A/67B IT Act convictions is thin but growing. The 2018 conviction in State of West Bengal v Animesh Boxi — the first reported conviction in India under Section 67/67A IT Act read with the predecessor provisions in IPC — confirmed the procedural framework for digital-evidence admissibility under the predecessor regime to Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 [Section 65B Evidence Act], and the standing of screenshots, server logs and platform-cooperation certificates as primary evidence. Animesh Boxi remains the doctrinal anchor for the digital-evidence chain in cyberbullying-of-a-child cases tried under the IT Act framework. The post-S Harish reading at the Supreme Court level has accelerated the lower-court framework; the December 2024 advisories of the Ministry of Women and Child Development on POCSO-Section 19 implementation in schools and on Rule 4(4) implementation by intermediaries have operationalised the higher-court framework into administrative practice.

The cross-border problem remains the principal limit. Where the perpetrator is outside India, the Section 75 IT Act extraterritorial reach supplies the jurisdictional basis but not the executive arm. The NCMEC cyber-tipline mirror, the Mutual Legal Assistance Treaty framework through the Ministry of External Affairs, and the platform-level cooperation through Meta, X, Google and Apple under the IT Rules 2021 Rule 4 obligations are the operational routes — slow, dependent on platform discretion, and uneven across platforms. The Digital India Act drafts circulating since 2023 contemplate a stronger statutory direction on cross-border CSAM cooperation, but the framework is not in force in 2026.

Open questions and doctrinal tensions

Three questions remain unresolved. The first is the consent threshold in teenage-peer cyberbullying. The POCSO Act fixes the age of consent at eighteen for all sexual content involving a child; the consequence is that consensual exchange of intimate images between two seventeen-year-olds, followed by the unilateral circulation by one of them, exposes both to Section 67B and Section 15 POCSO liability. The Madras High Court in 2024, the Delhi High Court in 2023, and the Karnataka High Court in 2025 have all noted the over-criminalisation problem but have declined to read down the statutory threshold; the Law Commission of India's 2023 Report on Age of Consent recommended no change in the statutory framework but a more calibrated prosecutorial discretion. The framework remains as Parliament drafted it.

The second is the school's liability under Section 21 POCSO read with the JJ Act Section 75 cruelty offence. Where the school becomes aware of cyberbullying through a student counsellor, a parent complaint, or a WhatsApp screenshot — and chooses to address it internally rather than reporting to the Special Juvenile Police Unit — the Section 21 offence is squarely engaged. The High Court rulings on Section 21 POCSO have been inconsistent on whether the duty is triggered by mere apprehension or only by reasonable knowledge; the trend after S Harish is towards the lower threshold. The third is the constitutional reach of Rule 4(4) — the proactive-identification duty on intermediaries under the IT Rules 2021. The Bombay High Court in Kunal Kamra v Union of India, 2024 SCC OnLine Bom 360, striking down the Fact-Check Unit limb, has signalled that the Rules cannot impose monitoring obligations that exceed the IT Act's enabling framework — but the child-protection limb of Rule 4(4), narrowly drawn and constitutionally well-anchored under Article 21 and Article 39(f), is unlikely to be disturbed.

For the parent, school administrator, or counsel handling a cyberbullying-of-a-child matter in 2026, the framework is workable and increasingly precise. The Section 67B IT Act offence supplies the substantive criminal anchor. The POCSO substantive offences at Sections 11 to 15 and the procedural protections at Sections 24 to 38 supply the child-protective trial framework. The Section 19 mandatory-reporting duty, backed by the Section 21 failure-to-report offence, makes the formal complaint non-optional for any adult who becomes aware of the conduct. The Rule 3(2)(b) twenty-four-hour takedown clock supplies the rapid-removal channel. The BNS overlay and the JJ Act Section 75 catch-all close the residual gaps. A complainant who works the four regimes in parallel — preserving evidence at the outset, filing in writing under Section 19, mirroring at cybercrime.gov.in, and invoking the full set of statutory provisions in the FIR — has a serious prospect of removing the content within a day, securing the child within the POCSO procedural shell within a week, and holding the perpetrator to account in a Special Court over the longer arc.