The government on Tuesday notified new Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, issued under the IT Act, 2000, which amend the 2021 rules and apply
to all online intermediaries, including social media platforms, messaging services, content-hosting websites and AI-based platforms. The amendments, effective from 20 February 2026, significantly expand the regulatory scope by explicitly bringing artificial-intelligence-generated, synthetic and manipulated content—such as deepfakes, voice cloning and algorithmically altered text, images, audio or video—within the definition of regulated online content. By doing so, the rules remove any ambiguity about whether AI-generated material is covered and treat such content on par with other forms of user-generated information under Indian law.
Who are the new rules applicable to?
Issued under Section 87 of the IT Act, 2000, these rules amend the 2021 IT Rules. They apply to all intermediaries, including social media platforms, messaging apps, video-sharing platforms, AI-driven content platforms, any service that hosts, publishes, transmits, or enables access to user-generated content.
When will they come into effect?
They come into force from February 20, 2026
What are the new definitions?
The rules now explicitly define content that is:
- Generated wholly or partly by AI, algorithms, or automated systems
- Includes text, images, audio, video, or mixed formats
- Covers deepfakes, altered visuals, voice cloning, and simulated identities
This ends ambiguity about whether AI-generated material is regulated—it clearly is.
Which content is regulated?
Content is treated as regulated if it — alters reality in a deceptive way; is capable of misleading users about facts, identity, or events; is presented as authentic without disclosure
What does it mean for social media companies and platforms?
Platforms must now take active responsibility, not just reactive steps.
a) Reasonable efforts to prevent violations: Intermediaries must prevent hosting or circulation of unlawful content; use automated tools, human review, or other appropriate measures; and regularly review their systems to reduce misuse.
Failure to act despite knowledge is treated as non-compliance
b) Prohibited content categories: Platforms must act against content that violates Indian laws (criminal, civil, regulatory); national security and public order; court orders or government directions; user safety and dignity (harassment, impersonation, deception)
What are the rules on takedown and access restriction?
Mandatory response is required to orders when directed by courts, government authorities under valid legal powers. Platforms must remove content, disable access, restrict visibility and failure or delay will be treated as a violation of the rules.
What if there is a delay?
The amendments shorten and clarify response timelines, signaling that delays can attract penalties. Partial compliance is not sufficient.
What is the “3-hour window”? When does it apply?
The 3-hour window is an emergency compliance timeline built into the amended IT Rules framework. It applies in exceptional, high-risk situations, not routine complaints.
It is for cases when an intermediary receives a lawful direction relating to content that poses an immediate and serious risk, such as threats to national security or public order; risk of violence, riots, or mass harm; content linked to terrorism, child sexual abuse material, or severe impersonation; or time-sensitive misinformation likely to cause real-world harm.
In such cases, platforms are expected to remove, block, or disable access within 3 hours of receiving the direction.
This window exists because waiting 24 hours can be too late for rapidly spreading digital harm. The three-hour window is not optional and not advisory. Failure to act within this period is treated as prima facie non-compliance, even if action is taken later.
What is the labelling clause?
The labelling clause relates mainly to AI-generated, synthetic, or manipulated content. Intermediaries must ensure that users are not misled into believing synthetic or AI-generated content is real, especially when:
- A real person’s identity, voice, image, or likeness is used
- Content could influence public opinion, trust, or behaviour
- Content is presented as factual or authentic
Platforms may comply by labelling content as “AI-generated”, “synthetic”, or “manipulated”; adding contextual warnings; reducing visibility or distribution if labelling is not possible; and removing the content if it is deceptive or harmful
Who is responsible?
The responsibility is shared. Users must not deliberately misrepresent synthetic content as real. Platforms must take reasonable steps to detect, flag, or label such content once they are aware of it
What happens if platforms don’t follow these clauses?
For missing the 3-hour window: Immediate loss of safe harbour protection; potential criminal or civil liability; strong grounds for court or government enforcement action
For violating the labelling requirement: Content treated as misleading or unlawful; mandatory takedown or restriction; repeated failure can count as systemic non-compliance.
What are the time limits?
24 hours – Rapid response obligations: This is the most frequently triggered deadline.
It applies to content affecting public order, safety, or sovereignty. Complaints involving illegal, deceptive, or harmful content. Initial response to serious user grievances
What must be done?
Acknowledge the issue
Take interim action (remove, restrict, downrank, or block access)
Begin formal review
Platforms cannot wait for full internal evaluation before acting.
36 hours – Certain government directions: It is in cases where a lawful government order specifies this window (carried forward and reinforced from the 2021 framework).
The intermediaries must:
Remove or disable access to content within 36 hours
Report compliance if required
Failure counts as non-compliance under due-diligence obligations.
72 hours – Information assistance to authorities: When lawfully required, intermediaries must provide information, data assistance, user or content details (as permitted by law). This applies mainly to investigations and law-enforcement cooperation.
24 hours – Grievance acknowledgement: For user complaints filed through the platform’s grievance system, the complaint must be acknowledged within 24 hours. Silence or automated non-response is treated as failure of the grievance mechanism
15 days – Final grievance resolution: The platforms must decide and communicate a final outcome within 15 days. They must explain reasons for action or inaction. Take corrective steps if violation is found. Unresolved or ignored complaints weaken the platform’s compliance record.
“Without delay” – Self-detected violations: It is applicable if a platform detects illegal or prohibited content through AI tools or internal review or becomes aware of violations through any source
Immediate / ongoing – Repeat offender action: For accounts repeatedly violating rules, platforms must take timely escalatory action. Continued tolerance can be treated as systemic failure. No fixed hour count is given, but enforcement must be prompt and proportionate.
As specified in order – Court directions: Courts may set custom timelines depending on urgency. These override general timelines. Even shorter compliance windows can be imposed.
What is expected of the companies?
Intermediaries are allowed — and expected — to deploy automated moderation tools, use AI detection systems for harmful or synthetic content, combine automation with human oversight However, tools must be proportionate, over-removal without review can still be challenged.
What information is to be given to users?
Clearly inform users about prohibited content. Explain consequences such as content removal, account suspension, reduced reach or visibility. Users must be able to understand why action was taken.
What is the action against repeat or serious offenders?
Intermediaries may suspend or terminate accounts, restrict posting or sharing features, limit visibility of content. Especially in cases of repeated violations, serious harm or deception, coordinated misuse.
Is there a grievance redress framework?
Platforms must maintain an effective grievance mechanism, act on complaints within prescribed timelines, escalate unresolved issues appropriately. Non-response to grievances counts against compliance.
What is Safe harbour under Section 79?
It protects intermediaries from liability for user content only if they follow the rules.
Safe harbour is lost if — due diligence is not followed; platforms knowingly allow illegal or harmful content; orders are ignored or delayed.
Once safe harbour is gone, the platform can be directly sued or prosecuted.
Do they align with other laws?
The rules explicitly align with Bharatiya Nyaya Sanhita / criminal laws, cybersecurity laws, consumer protection laws and intellectual property laws.
