Not directly through these rules. Rule 4(2) only requires WhatsApp to identify the first originator of a forwarded message — not the content itself. This requires a court order or Section 69 order, only for serious offences (terrorism, sovereignty, CSAM, etc.).

For actual message interception, the government must follow the separate IT (Interception) Rules 2009 with proper authorisation. End-to-end encryption means the platform itself can't read message content — but it CAN identify who started a forwarding chain.

No. The definition has explicit carve-outs for "routine or good-faith editing, formatting, enhancement" that doesn't "materially alter, distort, or misrepresent" the original content. A fun face filter that makes you look like a cat isn't pretending to be real.

The law targets content that is "perceived as indistinguishable from a natural person or real-world event." However, if someone uses AI to create a hyper-realistic video of you saying things you never said — that's clearly caught.

Under Rule 7, non-compliance = loss of "safe harbor" under Section 79(1) of the IT Act. The platform becomes directly liable for the content — as if it created it. It can face prosecution under the IT Act and Bharatiya Nyaya Sanhita.

The Chief Compliance Officer (India-resident) becomes personally liable if they failed due diligence — though they must be given a hearing first. This is the nuclear option; the threat alone ensures compliance.

Yes, you're technically an intermediary. But don't panic — full SSMI obligations only kick in above 50 lakh users. As a small intermediary, your Rule 3 obligations are: publish policies, have a grievance mechanism, respond to law enforcement in 72 hours, take down illegal content on govt order in 3 hours.

The 2026 AI labelling rules primarily target platforms that enable creation of synthetic content. A simple comment section doesn't trigger those.

They operate in parallel, not hierarchy. IT Rules govern platform behaviour (content moderation, grievances, takedowns). DPDP Act governs data processing (consent, retention, breach notification). Where they overlap (e.g., law enforcement data access), both apply simultaneously. Neither overrides the other.

Under the 2026 rules, the platform must act within 2 hours (down from 24 hours) for content that: exposes private areas, shows nudity, depicts sexual acts/conduct, or involves impersonation including AI-morphed images. 📄 2026 PDF, Pg 11

Report it immediately through the platform's complaint mechanism. If unresolved, escalate to Grievance Appellate Committee.

Yes, with conditions. The rules don't ban AI art — they regulate it. (1) The platform must block illegal content creation (CSAM, false documents, impersonation). (2) Your output must be labelled with embedded metadata. (3) You must declare it as synthetic when uploading to social media.

The "routine creation of presentations, educational materials, research outputs" exception covers most creative and professional uses. The risk is in creating content that realistically portrays real people or events in misleading ways.

It depends on realism. The law targets content "perceived as indistinguishable from a natural person or real-world event." A clearly absurd meme with a politician's face on a cartoon body? Unlikely to qualify. An AI video making a politician appear to say something inflammatory in a realistic setting? Squarely covered.

The law looks at likelihood of deception, not intent. Even if you meant satire, if viewers could reasonably believe it's real, it's caught. Safest approach: label all AI-modified content clearly.