Cart 0
2026 Updated Edition
Indian Data Laws & Meta
2026 Guide
A simple interactive guide explaining India's IT Rules 2021 → 2026 updates, the DPDP Act 2023, AI deepfake regulations, and what Instagram must share with the Indian government.
Start LearningWelcome to Indian Internet Law
India regulates the internet through multiple overlapping laws that affect social media platforms like Instagram, YouTube, X, and WhatsApp. These include privacy laws, platform responsibility rules, cybersecurity obligations, and criminal laws.
The most important active laws governing Instagram and other platforms today include:
- Information Technology Act 2000
- IT Intermediary Rules 2021
- IT Rules Amendments 2022, 2023, 2025 and 2026
- Digital Personal Data Protection Act 2023
- Indian Penal Code / Bharatiya Nyaya Sanhita cybercrime provisions
- Cybersecurity rules and CERT-In directives
Example:
The government regulates platforms like Instagram by making the platform responsible for removing illegal content and sharing user information when law enforcement issues legal orders.
2
What is Illegal on Instagram in 2026?
A practical, plain-English breakdown of the types of content that can trigger takedowns, account action, legal investigations, and criminal liability in India in 2026 — with examples, legal basis, Instagram's typical response, prevention tips, and reporting steps.
Overview — How to read this section
Each category below shows: What is illegal (short), Legal basis (which law/rule applies), Instagram's typical action, Real example, Prevention tips, and How to report.
Quick facts
- Takedown windows: 3 hours (serious unlawful content after authorised notice), 36 hours (other urgent takedowns), 7 days (general complaints).
- Evidence retention: Platforms must preserve removed content & metadata for 180 days.
- Labelling: All AI-generated content must be labelled and embedded with metadata.
Who enforces
Law enforcement (state/central police), MeitY / CERT-In for cyber incidents, Data Protection Board for DPDP violations, and courts for criminal prosecution under Bharatiya Nyaya Sanhita/other statutes.
The Core Internet Laws in India
Information Technology Act 2000
This is India's original cyber law that regulates online activity including hacking, cyber fraud, identity theft, and digital evidence.
- Introduced legal recognition of electronic records
- Defines cybercrime offences
- Allows government to block websites
IT Intermediary Rules 2021
These rules regulate how social media companies operate in India.
- Platforms must remove unlawful content
- Grievance officers must be appointed in India
- Companies must assist law enforcement investigations
DPDP Act 2023
This law regulates personal data collection and privacy.
- Users gain rights to access and erase data
- Companies must obtain consent before collecting data
- Penalties for misuse can reach hundreds of crores
AI / Synthetic Content Rules (2026)
India now regulates deepfakes and AI generated media.
- AI content must be clearly labelled
- Platforms must remove illegal synthetic media quickly
- Users creating deceptive deepfakes may face penalties
How Governments Request Data From Instagram
When police or government agencies investigate crimes, they may request information from platforms like Instagram. These requests must follow legal procedures.
Typical Data Requested
- User registration details
- Email addresses
- Login IP addresses
- Device identifiers
- Posts or messages linked to an investigation
Key Fact:
Platforms must assist government investigations and provide information when ordered by authorised agencies.
Safe Harbor Explained
Safe Harbor is the legal protection that allows platforms like Instagram to host user content without being held responsible for every post made by users.
Example:
If a user uploads illegal content, Instagram is not automatically guilty. However, the platform must remove it when notified or it can lose safe harbor protection.
AI & Deepfake Laws Explained
India introduced new rules targeting synthetic media and deepfakes.
- AI generated content must be labelled clearly
- Platforms must detect and remove harmful deepfakes
- Misleading AI content may be treated as misinformation
Example Scenario:
Someone creates a fake video of a politician announcing a fake policy. This could trigger immediate removal and legal investigation.
💡 DID YOU KNOW?
Instagram restricted more than 28,000 pieces of content in India in 2025 based on legal government requests. When law enforcement sends a valid legal order, platforms may share IP addresses, login devices, account details, and even messages relevant to investigations.
How These Laws Affect YOU
Select your profile below.
📱 Everyday Instagram User
If you mainly scroll, post photos, and message friends, the law affects you in these ways:
- Platforms must remind you of illegal content rules every 3 months.
- If someone posts your private photos or impersonates you, complaints must be resolved within 7 days.
- Intimate image complaints must be removed in 2 hours.
- Your account data may be shared with authorities when a valid legal order is issued.
IT Rules: 2023 vs 2026
| Feature | 2023 Rules | 2026 Amendment |
|---|---|---|
| AI / Deepfakes | Not specifically defined | Defined as Synthetically Generated Information |
| Content Removal | 36 hours | 3 hours |
| User Warnings | Once per year | Every 3 months |
| Complaint Resolution | 15 days | 7 days |
DPDP Act 2023 Explained
Your Rights
- Explicit consent before data collection
- Right to delete your personal data
- Mandatory breach notification
- Protection for children's data
Government Access
The Indian government can exempt agencies from data protection rules for national security, sovereignty, and public order investigations.
This means law enforcement can legally request your data from platforms like Instagram when investigating crimes.
Key Facts That Most People Don't Know
Key Fact: Even if you delete your Instagram post or account, platforms must retain related data for 180 days to assist investigations under IT Intermediary Rules.
Key Fact: Platforms must remove unlawful content within 3 hours after receiving a valid government or court notice under the updated 2026 rules.
Key Fact: Posting obscene or harassing messages online led to one of India's first cybercrime convictions in Suhas Katti v. State of Tamil Nadu (2004), where a man was convicted for sending obscene messages using a fake online identity.
Key Fact: Courts have confirmed that social media screenshots can be used as legal evidence in defamation cases, such as Anuraag Mittal v. Flipkart Internet Pvt Ltd (2020). ([vintagelegalvl.com](https://www.vintagelegalvl.com/post/cyber-defamation-in-india?utm_source=chatgpt.com))
Key Fact: Fake social media accounts created to defame individuals have led to criminal cases in India, including a Karnataka High Court case where a man was accused of creating fake profiles of his sister‑in‑law to post defamatory content online. ([scconline.com](https://www.scconline.com/blog/post/2025/11/14/kar-hc-refuses-quash-defamation-case-over-sister-in-law-fake-social-media-accounts/?utm_source=chatgpt.com))
Key Fact: Courts have also issued injunctions against AI deepfakes used in advertisements after individuals discovered fake videos falsely promoting products in their name. ([recordoflaw.in](https://recordoflaw.in/deepfakes-and-the-law-addressing-legal-accountability-for-ai-generated-misinformation/?utm_source=chatgpt.com))
Key Fact: A man was arrested in India for creating AI‑generated obscene images of a woman using photos taken from her social media accounts and posting them online through a fake account. ([timesofindia.indiatimes.com](https://timesofindia.indiatimes.com/city/gurgaon/man-from-assam-held-for-circulating-ai-morphed-photos-of-gurgaon-woman-on-social-media/articleshow/125549673.cms?utm_source=chatgpt.com))
Key Fact: Courts can order social media platforms to remove abusive videos of minors; for example, the Kerala High Court directed platforms to remove a manipulated video targeting a 14‑year‑old girl. ([timesofindia.indiatimes.com](https://timesofindia.indiatimes.com/city/kochi/minor-girls-plaint-hc-directs-social-media-platforms-to-remove-abusive-video/articleshow/121833289.cms?utm_source=chatgpt.com))
FAQs
Only with lawful orders in serious investigations.
Certain deepfakes that impersonate individuals or spread misinformation can be illegal under the new 2026 rules.
Yes. Platforms must remove unlawful content or risk losing safe harbor protections under Indian law.
Indian Data Laws 2026 Guide
Educational guide explaining IT Rules 2021 (Amended 2026) and DPDP Act 2023.