Online defamation in India — what the law says
Online defamation in India sits on a layered architecture — the criminal-defamation route under Section 356 of the Bharatiya Nyaya Sanhita, 2023 [Sections 499 and 500 IPC], the civil tort of defamation built on R Rajagopal v State of Tamil Nadu, the residual IT-Act offences (Section 67 obscenity, Section 66E privacy) after the striking down of Section 66A in Shreya Singhal v Union of India, the Section 79 safe-harbour and the IT Rules 2021 takedown architecture, and the Section 69A blocking regime. This piece sets out how the regimes braid, and what survives Subramanian Swamy and Kunal Kamra.
The gravitational fact of Indian online-defamation law is what is not there. Section 66A of the Information Technology Act, 2000 — which made it a criminal offence to send by computer resource any information that was "grossly offensive" or of "menacing character", or that caused "annoyance" or "inconvenience" — was struck down in its entirety by the Supreme Court in Shreya Singhal v Union of India, (2015) 5 SCC 1, as violative of Article 19(1)(a) and not saved by Article 19(2). That demolition emptied out the single most-used IT-Act offence for online speech, leaving the field to be occupied by the general criminal-defamation provision now reincarnated as Section 356 of the Bharatiya Nyaya Sanhita, 2023 [Sections 499 and 500 of the Indian Penal Code, 1860], the civil tort line traced by R Rajagopal v State of Tamil Nadu, (1994) 6 SCC 632, and a thin residue of IT-Act offences — Section 67 (obscenity), Section 66E (privacy), Section 66C and 66D (identity theft and personation) — that catch specific sub-classes of defamatory online content. Around this is wrapped the intermediary-liability architecture of Section 79 of the IT Act read down in Shreya Singhal, the operational machinery of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Section 69A blocking power. The constitutionality of the criminal route itself was confirmed in Subramanian Swamy v Union of India, (2016) 7 SCC 221. This piece sets out how the architecture is to be worked in 2026.
The criminal route — Section 356 BNS [Sections 499 and 500 IPC]
Criminal defamation in India is now codified at Section 356 of the Bharatiya Nyaya Sanhita, 2023, which replaces Sections 499 and 500 of the Indian Penal Code, 1860 substantively in pari materia. The provision retains the common-law definition: whoever, by words spoken or intended to be read, by signs, or by visible representations, makes or publishes any imputation concerning any person intending to harm, or knowing or having reason to believe that such imputation will harm, the reputation of that person, is said to defame that person. The ten Exceptions to the IPC definition — truth for public good, fair comment on public conduct of public servants, comment on conduct in the discharge of public functions, reports of court proceedings, comment on merits of decided cases, comment on public performance, censure in good faith by a person in lawful authority, accusation in good faith to authorised persons, imputation made in good faith for protection of interest, and caution in good faith for the protection of others — are carried over without disturbance.
The essential ingredients, as the Andhra Pradesh High Court summarised them in BRK Murthy v State, 2013 Cr LJ 1602, are three: the words must be defamatory; they must refer to the aggrieved party; and they must be maliciously published. Section 356 BNS retains the IPC scheme on punishment — simple imprisonment up to two years, or fine, or both, with the additional sub-clauses on the printer, sale of substantially defamatory matter, and defamation by means of electronic communication that the BNS clarifies in the new drafting. The offence is non-cognizable and bailable, and the Magistrate may take cognizance only on a complaint by the aggrieved person under Section 222 of the Bharatiya Nagarik Suraksha Sanhita, 2023 [Section 199 CrPC]. There is no FIR route for criminal defamation; the matter starts before a Magistrate of the First Class on a Section 223 BNSS [Section 200 CrPC] complaint, followed by examination of the complainant on oath, recording of the substance of the examination, and the inquiry under Section 225 BNSS [Section 202 CrPC] before issuance of process.
The constitutionality of criminal defamation was settled in Subramanian Swamy v Union of India, (2016) 7 SCC 221, a Bench of Dipak Misra and Prafulla C Pant JJ. The Court upheld Sections 499 and 500 IPC and Section 199 CrPC against an Article 19(1)(a) and Article 21 challenge, holding that reputation is an integral part of the right to life under Article 21, that the criminal-defamation provisions are saved by the "defamation" head under Article 19(2), and that the restrictions are reasonable. The ruling has drawn academic criticism for tilting too far towards reputation and against speech, and the decriminalisation debate continues in policy circles. But as a matter of doctrine, criminal defamation including online criminal defamation is constitutionally entrenched, and Section 356 BNS continues the regime.
Online defamation as defamation — the doctrinal absorption
The text of Section 356 BNS [Section 499 IPC] is medium-neutral. The "words" can be spoken, written, signed, or made by "visible representations", and the dissemination by which the imputation is "published" is not restricted by mode. An imputation made by tweet, by Instagram post, by WhatsApp broadcast, by YouTube comment, by Substack newsletter, or by review on a consumer-rating site falls equally within Section 356 BNS — provided the three ingredients are made out. The online medium changes none of the substantive law; it changes the practical evidentiary and jurisdictional questions.
The doctrinal absorption was confirmed in Sharat Babu Digumarti v Government (NCT of Delhi), (2017) 2 SCC 18, the Baazee.com / DPS MMS prosecution, where the Supreme Court (Dipak Misra and Prafulla C Pant JJ) held that where the conduct was specifically covered by the IT Act, recourse to the IPC for the same conduct was barred by the special-law-overrides-general rule and by Section 81 of the IT Act, which gives the IT Act overriding effect. The corollary is the converse — where the IT Act does not specifically cover the conduct (defamation as such has no IT-Act counterpart since Section 66A was struck down), the BNS [IPC] continues to apply in full force. Sharat Babu Digumarti therefore polices the boundary between the regimes rather than displacing one in favour of the other.
The Supreme Court's earlier articulation of the civil-tort branch in R Rajagopal v State of Tamil Nadu, (1994) 6 SCC 632 — the Auto Shankar case — remains the foundational authority on the relationship between Article 21 informational privacy and the law of defamation. The Court held that the right of privacy is implicit in Article 21 and includes the right to safeguard the privacy of one's own, of one's family, marriage, procreation, motherhood, child-bearing and education among other matters; and that a person who voluntarily thrusts herself into the public arena, or whose conduct becomes a matter of public record, cannot complain of comment on that conduct provided the comment is based on public records and is made in good faith. The post-R Rajagopal jurisprudence, refracted through the nine-judge informational-privacy holding in Justice K S Puttaswamy (Retd) v Union of India, (2017) 10 SCC 1, supplies the constitutional balance between reputation, privacy, and speech that the High Courts apply in online-defamation civil suits.
The IT-Act residuum — Section 67, Section 66E, Section 66C and Section 66D
After Shreya Singhal, the IT Act, 2000 retains no general "offensive content" offence. What survives is a series of specific provisions that catch sub-classes of defamatory online content where the content has an additional element beyond defamation simpliciter.
Section 67 of the IT Act, 2000 punishes the publication or transmission in electronic form of any material which is lascivious, appeals to the prurient interest, or has a tendency to deprave and corrupt persons likely to read, see or hear it. The provision is modelled on Section 292 of the Indian Penal Code, 1860, and uses the same Roth v United States-derived test for obscenity. A defamatory online post that is also obscene — a doctored sexually-explicit image of the victim, a fake explicit account ostensibly maintained by the victim — engages Section 67 in addition to Section 356 BNS. The first-conviction punishment is imprisonment up to three years and a fine of up to five lakh rupees; second or subsequent conviction, imprisonment up to five years and a fine of up to ten lakh rupees. Section 67A handles material containing sexually explicit acts; Section 67B handles child sexual abuse material and works alongside Sections 13 to 15 of the Protection of Children from Sexual Offences Act, 2012.
Section 66E of the IT Act, 2000 punishes the intentional or knowing capture, publication or transmission of the image of the private area of any person without consent, under circumstances violating the privacy of that person. Where the online defamation takes the form of non-consensual intimate imagery — the "revenge porn" pattern — Section 66E is the directly applicable offence. The definition of "private area" in the Explanation is narrow ("naked or undergarment clad genitals, pubic area, buttocks or female breast"), and the offence is punishable with imprisonment up to three years or a fine up to two lakh rupees. The provision tracks the post-K S Puttaswamy informational-privacy framework and is the closest statutory expression in Indian law of an image-based privacy tort.
Section 66C punishes the fraudulent or dishonest use of the electronic signature, password or any other unique identification feature of any other person; Section 66D punishes cheating by personation by using a computer resource or communication device. Where the online defamation is committed through an impersonating account — a fake handle posing as the victim and posting defamatory matter ostensibly from her — Sections 66C and 66D are engaged together with Section 356 BNS. The conjunctive use of Sections 66C/66D and Section 319 BNS [Sections 416 and 419 IPC] is now standard in cybercrime FIRs registered against impersonating-account defamation patterns.
What is conspicuously missing from this residuum is a general criminal provision for offensive online speech short of obscenity, child sexual abuse material, impersonation, or threat. Shreya Singhal removed it. The argument that the absence should be filled by a fresh, narrowly-drawn provision — surviving Article 19(2) scrutiny — has been made repeatedly in policy commentary and rejected each time in litigation, including the recent constitutional challenge to the Fact-Check Unit limb of the 2023 amendments to the IT Rules in Kunal Kamra v Union of India, 2024 SCC OnLine Bom 360, where the Bombay High Court (on the split verdict of Patel J and Neela Gokhale J, broken by Chandurkar J against the amendment) struck down the Fact-Check Unit as unconstitutional under Articles 14 and 19(1)(a). The constitutional ceiling articulated in Shreya Singhal remains a live constraint on any attempt to restore a 66A-shaped offence.
Section 79 and the IT Rules 2021 — the takedown architecture
Online defamation differs from offline defamation in one structural respect: the defamatory content sits on an intermediary platform, and removal of the content is often a more urgent remedy than damages or punishment. The Section 79 safe-harbour and the IT Rules 2021 supply the operational architecture.
Section 79(1) of the IT Act, 2000 grants intermediaries a conditional immunity from liability for third-party content. Section 79(2) lays down the conditions — function limited to providing access, no initiation of the transmission, no selection of receiver, no modification of information, and observance of due diligence under the Rules. Section 79(3) cuts down the immunity where the intermediary has conspired or abetted, or where, upon receiving actual knowledge or being notified by the appropriate government or its agency, it fails to expeditiously remove or disable access. Shreya Singhal read down "actual knowledge" in Section 79(3)(b) to require knowledge from a court order or a government notification — a private user's complaint does not, of itself, expose the intermediary to liability for non-removal.
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 specify the due-diligence obligations. Rule 3(1)(b) requires the intermediary's terms of service to prohibit defamatory content, content that is grossly harmful, libellous, invasive of privacy, paedophilic, racially or ethnically objectionable, or otherwise unlawful. Rule 3(2)(a) requires the appointment of a Grievance Officer (resident in India), with a twenty-four-hour acknowledgement and a fifteen-day disposal timeline. Rule 3(2)(c) sets the operational disposal standard. Rule 3A — added in 2022 — supplies the Grievance Appellate Committee route, where a user dissatisfied with the Grievance Officer's decision (or where the fifteen-day window expires without disposal) may appeal to the GAC within thirty days; the GAC must dispose of the appeal within thirty days.
The interaction with Shreya Singhal is the doctrinal seam in the architecture. The IT Rules 2021 effectively create a non-judicial actual-knowledge channel — a Grievance Officer's adverse decision on a complaint, or a GAC appellate order, can require the intermediary to remove content without a court order in hand. The civil-society challenge to the GAC and to the broader Rules — pending in different forms before the Bombay High Court, Madras High Court, Delhi High Court and Karnataka High Court — argues that the architecture impermissibly transfers a content-restriction function from the judiciary to the executive, in tension with Shreya Singhal's clear-line holding. The Kunal Kamra ruling on the Fact-Check Unit has not directly settled the GAC question but has set up the analytical framework. For the defamation complainant, however, the architecture is currently workable — the Rule 3(2)(a) grievance and the GAC appeal supply a non-litigation route to takedown that runs in days, not years.
Section 69A — the State route
Section 69A of the IT Act, 2000 and the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009 authorise the Central Government to direct any agency or intermediary to block public access to information generated, transmitted, received, stored or hosted on any computer resource, in the interest of the sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States, public order, or for preventing incitement to the commission of a cognizable offence. Shreya Singhal upheld Section 69A and the 2009 Rules as constitutional — the provision is narrowly drawn, procedurally safeguarded (designated officer, review committee, written-reasons requirement), and confined to the Article 19(2) heads.
For online defamation, Section 69A is rarely the right tool. The provision is government-driven, not user-driven; the heads under which it operates are public-order and State-interest heads, not private reputation. The route survives for the narrow case where the defamatory content is also an incitement to violence or a public-order threat, in which the State's interest aligns with the victim's. For the ordinary defamation complaint — a malicious post, a fake review, a coordinated harassment thread — Rule 3(2) of the IT Rules 2021 is the operative instrument, with the criminal-complaint and civil-suit routes running in parallel.
The civil tort line — R Rajagopal, the John Doe, and damages
The civil action for defamation is doctrinally older than the criminal route and, for many online-defamation patterns, more effective. The civil tort tracks the common-law definition — a defamatory imputation, of and concerning the plaintiff, published to a third person, causing actual or presumed damage to reputation. The defences — truth (justification), fair comment, qualified privilege, absolute privilege, consent — are the common-law defences modulated by Indian doctrine. The remedies are damages (general and aggravated), injunctions (interim and permanent), and the John Doe (Ashok Kumar) injunction for unidentified online defendants.
The John Doe injunction has been the workhorse remedy for online defamation since the early 2010s. The Delhi High Court, the Bombay High Court and the Madras High Court have granted dynamic injunctions that bind not only the identified defendant but a class of similar future infringers and the intermediaries who carry the impugned content; the injunctive frame draws on Christian Louboutin SAS v Nakul Bajaj, 2018 SCC OnLine Del 12215, and the active-intermediary doctrine articulated there. Where the defamatory online content is also obscene, identity-theft-based or impersonating, the civil suit is typically pleaded alongside the criminal complaint and the Rule 3(2) takedown; the three tracks reinforce each other rather than compete.
The constitutional gloss is supplied by R Rajagopal v State of Tamil Nadu, (1994) 6 SCC 632 and the post-Puttaswamy informational-privacy framework. R Rajagopal held — in the specific factual context of an autobiography of a condemned prisoner — that a public official has no remedy in damages for the publication of what is shown to be substantially true in relation to acts and conduct in the discharge of official duties, except where the publication is shown to have been made with reckless disregard for truth. The doctrine is the Indian analogue of the New York Times v Sullivan actual-malice standard, modulated for Indian constitutional conditions. The High Courts have applied R Rajagopal to online publication — including journalistic publication, social-media commentary on public officials, and consumer-review platforms — and the doctrinal effect is a thicker safe-harbour for online commentary on public conduct of public figures than the bare text of Section 356 BNS would suggest.
Forum, jurisdiction and the extraterritoriality question
Two practical questions follow the substantive law. The first is forum. Criminal defamation is initiated on a complaint to a Magistrate of the First Class under Section 223 of the Bharatiya Nagarik Suraksha Sanhita, 2023 [Section 200 CrPC], with the inquiry under Section 225 BNSS [Section 202 CrPC] before issuance of process; only the aggrieved person may complain (Section 222 BNSS [Section 199 CrPC]). The FIR route under Section 173 BNSS [Section 154 CrPC] is not available for the standalone defamation offence — defamation under Section 356 BNS is non-cognizable. Where the online defamation is bundled with a cognizable IT-Act offence (Section 66C, 66D, 66E, 67), the FIR route opens for the cognizable limb, and the defamation complaint runs in parallel before the Magistrate. The civil suit is filed in the District Court or High Court of jurisdiction.
The second is jurisdiction in online cases. Where the defamatory online publication is accessible across India, the orthodox view since Banyan Tree Holding (P) Ltd v A Murali Krishna Reddy, 2009 SCC OnLine Del 3780 (Delhi High Court, full Bench) requires the plaintiff to show that the defendant purposefully availed itself of the jurisdiction — mere accessibility is insufficient. The Section 197 BNSS [Section 177 CrPC] ordinary-place-of-offence rule, the Section 198 BNSS [Section 178 CrPC] continuing-offence rule, and the special provision in Section 199 BNSS [Section 179 CrPC] (offences triable where act done or consequence ensues) together supply the criminal-side framework; the High Court rulings have varied in their application to online speech, and the Supreme Court has not yet settled the question.
Section 75 of the IT Act, 2000 supplies a separate extraterritoriality rule for the IT-Act offences — the Act applies to any offence or contravention committed outside India by any person if the act or conduct constituting the offence or contravention involves a computer, computer system or computer network located in India. The Section 75 reach is the basis on which IT-Act offences (including the Section 66C, 66D, 66E and 67 limbs of an online-defamation matter) can be pursued against foreign-resident defendants where the affected computer resource is in India. The BNS itself, in Section 1(5), supplies a parallel general-law extraterritoriality for offences committed by Indian citizens abroad, and the Section 197 BNSS framework supplies the procedural overlay.
The braided route — what the architecture looks like in practice
Online defamation in 2026 is therefore worked on four parallel tracks. The civil suit (damages plus interim injunction, often John-Doe-flavoured) is the workhorse for high-value reputation damage and for class-of-defendant scenarios. The criminal complaint under Section 223 BNSS for the Section 356 BNS offence is the slower disciplining instrument, sustained by Subramanian Swamy, used selectively where the gravity warrants and the complainant has the appetite for a multi-year matter. The IT-Act FIR — Section 173 BNSS for the cognizable IT-Act offences (66C, 66D, 66E, 67 where applicable) — is the cognizable route where the defamation is bundled with one of those specific harms. And the Rule 3(2) grievance plus Rule 3A GAC appeal is the operational takedown route, with the Section 69A blocking route held in reserve for the State-interest cases.
The legal-architectural question that animates the doctrinal commentary is whether this four-track structure is coherent. The criminal-defamation route survives Subramanian Swamy but is in tension with the speech-protective reading of Shreya Singhal; the IT-Rules takedown route operates on a non-judicial actual-knowledge channel that Shreya Singhal's read-down was supposed to foreclose; the Section 69A route remains constitutionally entrenched but procedurally opaque; and the civil tort line, after R Rajagopal and Puttaswamy, has absorbed a stronger free-speech defence than the bare Section 356 BNS text contemplates. The braid holds in practice — but the seams are visible, and the next round of constitutional litigation, around the pending challenges to the IT Rules 2021 and to the Digital India Act draft, will test which threads survive.
Open questions and unresolved doctrinal tensions
Three doctrinal questions remain genuinely unresolved in 2026.
The first is the future of the criminal-defamation route. Subramanian Swamy v Union of India, (2016) 7 SCC 221, settled the constitutional question against the petitioners, but the policy debate on decriminalisation continues, with the Law Commission, multiple Standing Committees of Parliament, and the broader legal-academic commentary divided. The Section 356 BNS drafting has preserved the IPC structure without amendment; the next round of review is expected in the Digital India Act consultations.
The second is the constitutionality of the GAC under Rule 3A of the IT Rules 2021. The Government's position is that the GAC is an executive grievance-appellate mechanism with no judicial functions. The civil-society challenge — pending in different forms before different High Courts — is that the GAC's binding power over private platform decisions, the executive composition of the GAC, and the absence of an explicit statutory anchor in the IT Act, place it in tension with the separation-of-powers framework and with Shreya Singhal. Kunal Kamra v Union of India, 2024 SCC OnLine Bom 360, on the Fact-Check Unit limb, has set up the analytical framework within which the GAC question will be resolved.
The third is the jurisdictional reach of Indian courts over foreign-headquartered platforms and foreign-resident defendants in online-defamation matters. Section 75 of the IT Act, 2000 supplies a textually broad extraterritoriality for IT-Act offences; the parallel civil-suit position is more contested, with the Banyan Tree purposeful-availment test sitting uneasily against the dynamic-injunction practice of the Delhi and Bombay High Courts. The Supreme Court has not yet settled the doctrine, and the DPDP Act, 2023, when fully operationalised through 2025–2026, will add a horizontal data-protection overlay that may reshape the jurisdictional calculus.
For the individual complainant — the journalist whose reputation is being shredded on a coordinated social-media thread, the small-business owner whose Google reviews have been weaponised, the public figure on the receiving end of a defamatory deepfake — the 2026 framework is workable. Section 356 BNS supplies the criminal route. The civil suit and the John Doe injunction supply the remedies of damages and takedown. The IT-Act residuum catches the bundled harms. Section 79 read with the Rule 3(2) machinery supplies the platform-level remedy. Shreya Singhal disciplines the architecture; Subramanian Swamy sustains the criminal arm; R Rajagopal and Puttaswamy supply the speech-protective gloss. The architecture is layered, contested, and imperfect — but it is operational, and a complainant who works the four tracks in parallel has serious prospect of vindication on at least one of them.