Non-consensual intimate images — emergency takedown
Non-consensual distribution of intimate images — what the older idiom called revenge porn, what the contemporary literature calls image-based sexual abuse — engages four parallel statutory architectures: the criminal offences under the Information Technology Act, 2000 (Sections 66E, 67, 67A and 67B) and the Bharatiya Nyaya Sanhita, 2023 (Sections 77, 79, 294 and 296); intermediary takedown under Rule 3(2)(b) of the IT Rules, 2021 with its twenty-four-hour clock; Section 69A government-blocking; and the civil injunction. This piece sets out how the four interact in 2026.
Non-consensual distribution of intimate images is not, in Indian statute, a single offence with a single remedy. The architecture is layered, and a complainant who works only one layer routinely loses the others. The first layer is the privacy-violation offence under Section 66E of the Information Technology Act, 2000, inserted by the 2008 amendment to deal precisely with the misuse of mobile-phone cameras and similar devices for what the section calls capture, publication or transmission of an image of a private area of a person without consent. The second layer is the obscenity-and-sexually-explicit-content regime under Sections 67, 67A and 67B of the IT Act, with Section 67B reserved for material depicting children. The third is the general-criminal-law overlay supplied by the Bharatiya Nyaya Sanhita, 2023 — Sections 77, 79, 294 and 296 — and, where the victim is a child, the dedicated regime of the Protection of Children from Sexual Offences Act, 2012. The fourth is the intermediary-takedown route under Rule 3(2)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, with its twenty-four-hour removal clock for non-consensual intimate and impersonating content. Behind all four sits the constitutional anchor in Justice K S Puttaswamy v Union of India, (2017) 10 SCC 1, and the intermediary-liability framework laid down by Shreya Singhal v Union of India, (2015) 5 SCC 1. This piece sets out how the layers interact and what an effective takedown looks like in 2026.
Section 66E IT Act — the privacy-violation offence and its narrow textual scope
Section 66E of the IT Act, 2000 — inserted by the 2008 amendment — punishes any person who intentionally or knowingly captures, publishes or transmits the image of a private area of any person without his or her consent, under circumstances violating the privacy of that person, with imprisonment up to three years or fine up to two lakh rupees or both. The provision was drafted in the wake of the DPS-MMS prosecution and the Trisha bathroom-camera incident; its drafting reflects those origins. The Explanations to Section 66E are decisive. "Capture" means to videotape, photograph, film or record by any means. "Publish" means reproduction in printed or electronic form, made available to the public. "Transmit" means to electronically send a visual image with the intent that it be viewed by a person or persons. "Private area" is defined narrowly — the naked or undergarment-clad genitals, pubic area, buttocks or female breast. "Circumstances violating the privacy of a person" is defined by reference to the victim's reasonable expectation that her private area would not be visible to the public, regardless of whether she is in a public or private place.
The narrowness of the Section 66E "private area" definition is the section's central limitation. A photograph that shows the victim in an intimate but not anatomically nude posture — kissing, embracing, partially clothed in a manner not satisfying the "naked or undergarment-clad genitals, pubic area, buttocks or female breast" test — falls outside Section 66E even where the publication is plainly non-consensual and humiliating. The legislative response has been to read Section 66E together with the broader obscenity provisions in Sections 67 and 67A and with the BNS overlay; the prosecutor's instinct in a serious case is to charge the cluster, not the single section.
Section 67 of the IT Act criminalises the publication or transmission in electronic form of material that is lascivious, appeals to prurient interest, or tends to deprave and corrupt persons likely to read, see or hear it — punishable with imprisonment up to three years and fine up to five lakh rupees on first conviction. Section 67A is the sexually-explicit-content provision, with imprisonment up to five years and fine up to ten lakh rupees on first conviction. Section 67B is the child-sexual-abuse-material provision, with a stricter punishment scheme. Where the non-consensual intimate image is sexually explicit in the Section 67A sense — and most images that engage the practical concerns of an image-based-abuse complaint will be — Section 67A is the heavier of the two charges and is almost always added to a Section 66E case.
Section 67C of the IT Act, often overlooked, is the preservation-of-records provision. It requires intermediaries to preserve and retain such information as may be specified for such duration and in such manner as the Central Government may prescribe; contravention is itself an offence under Section 67C(2). The complainant's instruction to the platform under Section 67C, made early in the takedown process, is the evidentiary anchor for the criminal prosecution that follows months later.
The BNS overlay — Sections 77, 79, 294 and 296
The Bharatiya Nyaya Sanhita, 2023, in force since 1 July 2024, supplies the general-criminal-law overlay. Section 77 BNS [Section 354C IPC] is the voyeurism offence — it criminalises any man who watches or captures the image of a woman engaging in a private act in circumstances where she would usually have the expectation of not being observed, or disseminates such image. The "private act" is defined to include an act carried out in a place that, in the circumstances, would reasonably be expected to provide privacy, and where the victim's genitals, posterior or breasts are exposed or covered only in underwear, or where the victim is using a lavatory, or doing a sexual act not of a kind ordinarily done in public. Section 77 carries imprisonment for not less than one year, extending up to three years for a first conviction, and three to seven years for a second or subsequent conviction.
Section 79 BNS [Section 509 IPC] punishes any word, gesture or act intended to insult the modesty of a woman; the section catches the verbal- and gestural-abuse limbs that often accompany the image-based-abuse complaint. Section 294 BNS retains the general obscenity offence — punishing the sale, distribution, public exhibition or circulation of obscene material. Section 296 BNS [Section 292 IPC] is the obscene-acts-and-songs-in-public-place provision; it is rarely the primary charge in an image-based case but appears in the FIR cluster.
The BNS provisions are not displaced by the IT Act. Section 81 of the IT Act, 2000 — the overriding-effect clause — expressly preserves the operation of the general criminal law. The settled practice is to invoke both regimes in the FIR. Section 66E and Section 67A of the IT Act carry the cyber-specific punishments; Sections 77, 79 and 294 of the BNS carry the general-criminal-law punishments and engage the procedural protections — particularly the in-camera-trial directions under Aparna Bhat v State of Madhya Pradesh, (2021) 3 SCC 790, which is the doctrinal anchor for the no-bail-conditions-against-the-victim line and for the more general victim-protection framework that now governs sexual-offence trials.
Where the victim is a child — defined under the Protection of Children from Sexual Offences Act, 2012 as a person below eighteen — the POCSO regime supplants the general law. Section 13 of POCSO criminalises the use of a child for pornographic purposes; Section 14 punishes the use of a child for pornographic material with imprisonment that is graded upwards by the nature of the material; Section 15 punishes the storage of child pornographic material. POCSO offences are cognizable and non-bailable, the trial is by a Special Court, and the procedural protections of Sections 24–27 of POCSO (recording of statement at the child's residence, presence of a person in whom the child has trust, in-camera trial) apply. A non-consensual intimate image of a child must be charged under POCSO Sections 13–15 read with Section 67B of the IT Act; Section 66E and Section 67A are subsumed.
Section 79 IT Act and the Shreya Singhal read-down
The intermediary-liability framework — Section 79 of the IT Act — grants conditional immunity to social-media platforms, hosting services and ISPs for third-party content. Section 79(1) supplies the immunity; Section 79(2) lays down the conditions; Section 79(3) cuts down the immunity where the intermediary has conspired in the unlawful act or has failed to expeditiously remove unlawful material after acquiring actual knowledge. Shreya Singhal v Union of India, (2015) 5 SCC 1, read down Section 79(3)(b) to require that "actual knowledge" come from a court order or a government notification under Section 69A — not from a private user's complaint. The read-down is the constitutional pivot of the architecture: a private takedown notice does not, of itself, expose the platform to liability for non-removal under Section 79(3)(b). The platform's compliance is therefore policy-driven, anchored in the Rule 3 due-diligence obligations under the 2021 Rules, rather than statute-driven through Section 79(3)(b) directly.
The operational consequence is that the user-side takedown for a non-consensual intimate image runs through Rule 3 of the IT Rules 2021, not through a Section 79(3)(b) notice. The Section 79 architecture only engages once a court order or a Section 69A direction has issued — at which point platforms that fail to comply lose safe harbour and face the general criminal- and civil-law consequences. The post-Shreya Singhal framework has been refined in subsequent intermediary-liability rulings, including the Delhi High Court's celebrity-personality-rights line beginning with Anil Kapoor v Simply Life India, 2023 SCC OnLine Del 6914, which set the template for dynamic injunctions against unknown impersonators and content-redistributors.
Rule 3(2)(b) of the IT Rules 2021 — the twenty-four-hour clock for non-consensual intimate content
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 — notified in February 2021 under Section 87(2) of the IT Act read with Section 79(2)(c) — are the operational architecture for content takedown. They specify the due-diligence obligations that an intermediary must observe to retain its safe harbour. Rule 3(1)(b) requires the platform's terms of service to prohibit specified categories of unlawful content, including content that is paedophilic, invasive of privacy, or insulting to the modesty of a woman. Rule 3(2)(a) requires every intermediary to publish on its website the name and contact details of a Grievance Officer resident in India, who must acknowledge a complaint within twenty-four hours and dispose of it within fifteen days.
Rule 3(2)(b) is the provision that does the heavy lifting in non-consensual-intimate-image cases. It requires the intermediary, on receipt of a complaint by or on behalf of an individual, to remove or disable access within twenty-four hours to any content that exposes the private area of the individual, shows the individual in full or partial nudity, shows or depicts the individual in any sexual act or conduct, or is in the nature of impersonation in electronic form, including artificially morphed images. The clock runs from the time of receipt of the complaint; the twenty-four-hour obligation is strict; non-compliance is, in formal terms, a loss of Section 79 safe harbour for the offending content. The Rule 3(2)(b) language tracks the Section 66E "private area" definition but extends past it — "full or partial nudity" and "any sexual act or conduct" are broader categories than Section 66E captures, and the morphed-image limb covers the deepfake and AI-generated-imagery problem head-on.
The 2022 amendment to the Rules introduced Rule 3A — the Grievance Appellate Committee mechanism. A user whose Rule 3(2)(b) complaint has been wrongly disposed of by the Grievance Officer, or has not been disposed of within fifteen days, may appeal to the GAC within thirty days. The GAC is required to dispose of the appeal within thirty days. The three Committees constituted in January 2023 under the Ministry of Electronics and Information Technology operate the appellate jurisdiction in practice; the constitutionality of the GAC architecture is contested but the GAC continues to function pending the Supreme Court's consideration of the broader intermediary-liability questions raised by the Bombay High Court ruling in Kunal Kamra v Union of India, 2024 SCC OnLine Bom 360 on the Fact-Check-Unit limb of the 2023 amendments.
Section 69A blocking — the State route, and when to take it
Section 69A of the IT Act and the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009 confer on the Central Government the power to direct any agency or intermediary to block public access to any information, in the interests of sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States, public order, or for preventing incitement to the commission of any cognizable offence. The provision was upheld in Shreya Singhal on the reasoning that it is narrowly drawn, procedurally safeguarded, and confined to the Article 19(2) heads. The 2009 Blocking Rules supply the procedure — a designated officer of MeitY, a review committee, written reasons, and confidentiality of the blocking direction.
A private individual cannot directly invoke Section 69A; the route is a representation to the designated officer of MeitY, with the decision being the State's. For a non-consensual-intimate-image case, Section 69A is the right tool where the content has gone viral and where ordinary Rule 3(2)(b) takedown has failed to keep pace with the redistribution — typically because the content has migrated across platforms, including platforms outside the Indian regulatory perimeter. Where the redistribution becomes a public-order concern in the Section 69A sense, or where the cognizable offences disclosed (Section 67A, Section 67B, POCSO) bring it within the "incitement to the commission of any cognizable offence" head, the State interest aligns with the victim's and Section 69A is the appropriate escalation.
The civil and writ overlay — Order 39 CPC injunction and the Article 226 route
The civil route runs in parallel to the criminal and the intermediary tracks. An interim injunction under Order 39 Rules 1 and 2 of the Code of Civil Procedure, 1908, restraining the named defendant — and, in appropriate cases, John Doe (Ashok Kumar) defendants representing unknown future redistributors — from continuing to publish, transmit or host the non-consensual intimate image, is the standard civil instrument. The Delhi High Court has, since the Sholay Media line in 2015 through the personality-rights cases culminating in Anil Kapoor v Simply Life India, 2023 SCC OnLine Del 6914, developed the dynamic-injunction framework that binds not only the identified defendant but a class of future infringers and authorises the rights-holder to add URLs to a takedown list without returning to court for each.
The writ route under Article 226 of the Constitution sits above the civil track. Where a State authority is implicated — a police officer's mishandling of the FIR, the platform's failure to act despite a court order, or the redistribution by a person whose location and identity the State alone can trace through the lawful-intercept architecture — a writ petition before the jurisdictional High Court is the appropriate remedy. The constitutional anchor is the informational-privacy framework of Justice K S Puttaswamy v Union of India, (2017) 10 SCC 1, which recognised privacy as a fundamental right under Article 21 and explicitly extended the protection to informational privacy and the privacy of bodily integrity. Several High Courts — Delhi, Bombay, Calcutta, Madras — have entertained writ petitions in image-based-sexual-abuse cases, issuing directions to platforms and to State authorities for time-bound takedown and FIR registration.
The leading trial-court ruling on the substantive criminal liability for non-consensual intimate image distribution is State of West Bengal v Animesh Boxi, decided by the Sessions Judge, Tamluk in 2018, which convicted the accused under Sections 354A, 354C, 354D and 509 IPC read with Sections 66E and 67A of the IT Act and is widely cited as the first comprehensive image-based-sexual-abuse conviction in India. The reasoning has been adopted in subsequent High Court bail and trial-stage rulings.
The emergency-takedown roadmap — what to do in the first seventy-two hours
The non-consensual intimate image takedown is, in operational terms, a parallel-filings exercise. Each filing has its own time-scale and its own evidentiary threshold.
Step 1 — Evidence preservation. Before notifying any platform, capture the offending content through dated screenshots with the URL bar visible, a screen recording of the offending profile and posts, and a notarised affidavit annexing the captures. Where the platform supports it, the Wayback Machine and similar third-party archive services can be used to record the content as it existed on the date of discovery. Issue a Section 67C IT Act preservation notice to the intermediary in writing, identifying the content by URL. The evidentiary stage is where image-based-abuse prosecutions are routinely lost — content deleted before contemporaneous captures cannot be reconstructed.
Step 2 — File the in-platform Rule 3(2)(b) complaint. All Significant Social Media Intermediaries — Meta (Facebook and Instagram), X, YouTube, LinkedIn, Snap, Threads — operate non-consensual-intimate-image reporting flows. The complaint must identify the offending content by URL, assert non-consensual intimate content under Rule 3(2)(b), and identify the victim. The platform's twenty-four-hour clock runs from receipt of the complaint. The victim need not have an authentic account on the platform to file a Rule 3(2)(b) complaint; the Rule expressly contemplates complaints made on behalf of an individual.
Step 3 — File the grievance with the Grievance Officer under Rule 3(2)(a). Independently of the Rule 3(2)(b) complaint, file a written grievance with the platform's Grievance Officer at the address published under Rule 3(2)(a)(i). The Officer must acknowledge within twenty-four hours and dispose of the grievance within fifteen days. The Grievance Officer route is the procedural predicate for the appeal to the GAC under Rule 3A.
Step 4 — File the FIR under Section 173 BNSS. The criminal complaint runs in parallel, not after. The FIR is registered with the local cybercrime cell or the police station with territorial jurisdiction; invoke Sections 66E, 67, 67A and 67C of the IT Act, and Sections 77, 79 and 294 of the BNS [Sections 354C, 509 and 292 IPC], adding Section 67B IT Act and POCSO Sections 13–15 where the victim is a child. The investigation must be conducted by an Inspector or above per Section 78 of the IT Act. If the SHO refuses to register the FIR, the remedies under Section 173(3) BNSS [Section 154(3) CrPC] (representation to the Superintendent of Police) and Section 175 BNSS [Section 156(3) CrPC] (direction by the Magistrate) are sequential. The victim is entitled to the procedural protections recognised in Aparna Bhat v State of Madhya Pradesh, (2021) 3 SCC 790, including in-camera recording of the statement, the absence of bail conditions directed against the victim, and the no-naming protection.
Step 5 — Mirror at the National Cybercrime Reporting Portal. File the complaint at cybercrime.gov.in. The portal mirrors the complaint to the State cybercrime cell and produces a reference number that supports subsequent platform escalation. The portal's dedicated "Report Women/Child Related Crime" channel is the appropriate sub-route for image-based-abuse complaints.
Step 6 — Escalate to the Grievance Appellate Committee under Rule 3A. If the Rule 3(2)(b) complaint or the Rule 3(2)(a) grievance is wrongly disposed of, or remains undisposed after fifteen days, appeal to the GAC within thirty days. The GAC's decision is binding on the intermediary, and non-compliance results in the loss of Section 79 safe harbour.
Step 7 — File the civil suit with an Order 39 injunction application. Where the redistribution is continuing and the platform takedown has lagged, a civil suit before the District Court or the High Court of jurisdiction, with an interim injunction application under Order 39 Rules 1 and 2 CPC against the named defendant and John Doe defendants representing unknown future redistributors, is the appropriate civil instrument. The Delhi High Court's dynamic-injunction line beginning with the Sholay Media cases and developed through Anil Kapoor v Simply Life India, 2023 SCC OnLine Del 6914, supplies the doctrinal framework.
Step 8 — Consider a Section 69A representation to MeitY. Where the content has gone viral, has migrated across platforms, or has come to engage public-order concerns or the incitement-to-cognizable-offence head, a representation to the designated officer of MeitY under the 2009 Blocking Rules is the right escalation. The Section 69A directive binds all intermediaries within Indian jurisdiction and operates against URL-level takedown.
Step 9 — The writ remedy under Article 226. Where State authorities have failed in their duty — non-registration of FIR, delayed investigation, failure to act on a court order — a writ petition before the jurisdictional High Court invoking the informational-privacy framework of Justice K S Puttaswamy v Union of India, (2017) 10 SCC 1, is the constitutional remedy. Several High Courts have, in image-based-abuse cases, ordered time-bound takedown directions to specified platforms.
Where the architecture frays — open doctrinal questions
Three doctrinal questions remain unresolved in 2026.
The first is the scope of "private area" under Section 66E read with the Rule 3(2)(b) categories of "full or partial nudity" and "any sexual act or conduct". The Section 66E definition is narrow; the Rule 3(2)(b) categories are broader. The asymmetry produces a category of content — partially-clothed intimate imagery, kissing photographs, embraces — that is removable under Rule 3(2)(b) but not, on the strict reading, prosecutable under Section 66E. The prosecution gap is partly filled by Section 67A of the IT Act and Sections 77 and 79 of the BNS, but the doctrinal coherence between the criminal and the takedown regimes is uneven.
The second is the deepfake question. The Rule 3(2)(b) language — "artificially morphed images" — covers the deepfake on a plain reading, and the Delhi High Court's celebrity-personality-rights line in Anil Kapoor v Simply Life India, 2023 SCC OnLine Del 6914, has supplied a civil-injunction framework that adapts to AI-generated imagery. But the criminal-law treatment of deepfake non-consensual imagery — whether Section 66E captures imagery that is computationally generated and was therefore never "captured" in the section's sense — is genuinely contested. The Government's draft amendments to the IT Rules in late 2024 sought to address the deepfake category specifically, but the criminal-law gap has not been closed by statute.
The third is the extra-territorial application. Where the offending content is hosted by a platform that has not appointed an Indian Grievance Officer, the Rule 3(2)(b) twenty-four-hour clock is unenforceable in practical terms. Section 79 safe-harbour loss is the formal sanction, but the victim's individual remedy depends on the platform's voluntary participation in the Indian framework. The Digital Personal Data Protection Act, 2023, when fully operationalised, will add a horizontal data-protection overlay that bears on cross-border processing of personal data, including non-consensual intimate imagery; the interaction with the IT Rules 2021 framework is still being worked out.
For the victim, the 2026 framework — incomplete as it is — is workable. Rule 3(2)(b) supplies a twenty-four-hour takedown clock that operates on the major platforms. Section 66E and the Section 67/67A/67B cluster supply the criminal route. The BNS overlay engages the general criminal law and the procedural protections under Aparna Bhat. The civil and writ tracks supply the equitable and constitutional remedies. A complainant who works the layers in parallel, with the evidence preserved at the outset and the filings synchronised within seventy-two hours, has a serious prospect of removing the offending content from the major platforms within days and of holding the perpetrator to account in the criminal courts over the longer arc.