IT Act and Social Media: IT Rules 2021, Significant Intermediaries and User Liability

Social media is where most Indians now read news, share opinions and meet strangers, and where much online harm occurs. The IT Act does not mention social media by name; it regulates it through the intermediary framework of Section 79 and the IT Rules, 2021, which created special categories and duties for social media platforms. Topics 7 and 17 covered the safe harbour and free speech. This note focuses on the platforms themselves and their users: how social media is classified, what significant platforms must do, what users can be liable for, how complaints are handled, the rules on influencers and children, and what courts have said about platform power.

1. The Largest Public Square Ever Built

A town square has a few hundred people and a local police station. Social media is a square of hundreds of millions, owned by private companies, where a rumour can reach a village and trigger violence before anyone checks it. The law's approach is layered: every user is responsible for what they say, every platform must keep basic order, and the largest platforms, like the owners of a stadium rather than a corner shop, carry extra duties.

2. How Social Media Is Classified

Figure 1: Three tiers of intermediaries under the IT Rules, 2021

• Intermediary (s.2(1)(w) IT Act). Any person who, on behalf of another, receives, stores or transmits electronic records or provides a service with respect to them.
• Social media intermediary (Rule 2(1)(w)). An intermediary which primarily or solely enables online interaction between two or more users and allows them to create, upload, share, disseminate, modify or access information.
• Significant social media intermediary (Rule 2(1)(v)). A social media intermediary with registered users in India above the threshold notified by the Central Government, currently 50 lakh.
• Why tiers. Duties scale with reach: a small forum and a platform with hundreds of millions of users are not treated alike.

3. Duties of All Social Media Platforms (Rule 3)

• Rules and policy. Publish rules, a privacy policy and a user agreement, and inform users not to host content that is obscene, invades privacy, impersonates another person, threatens India's unity or public order, or is otherwise unlawful.
• Takedown. Remove content on a court order or a reasoned intimation from an authorised government officer, within three hours since the February 2026 amendment.
• Preservation and assistance. Preserve removed content and related records for 180 days, and provide information to authorised agencies for verification of identity or investigation within 72 hours of an order.
• Intimate images. Remove content exposing a person's private area or showing them in a sexual act, including morphed images, within two hours of a complaint.
• Synthetic content. Label AI-generated content and preserve its metadata (see Topic 21)

4. Additional Duties of Significant Platforms (Rule 4)

Figure 2: Additional duties of significant social media intermediaries

• Officers in India. A Chief Compliance Officer personally responsible for compliance, a nodal contact person available to law enforcement at all times, and a Resident Grievance Officer, all resident in India.
• Transparency. Monthly compliance reports on complaints received and action taken, including proactive removals.
• First originator (Rule 4(2)). A significant platform providing messaging services must enable identification of the first originator of a message on a court or government order, limited to serious offences such as those relating to sovereignty, security of the State, public order, rape or child sexual abuse material, and only where less intrusive means are ineffective. The provision has been challenged as breaking end-to-end encryption.
• Proactive tools (Rule 4(4)). The platform must endeavour to use technology to identify content depicting rape or child sexual abuse.
• User protections. Users may voluntarily verify their accounts (Rule 4(7)); and where the platform removes content on its own initiative, it must notify the user of the grounds and give them an opportunity to dispute the action (Rule 4(8))

5. What Users Can Be Liable For

Figure 3: User conduct on social media and the provisions that apply

• No immunity for users. The safe harbour protects platforms, not the people who post. A user is liable as author or publisher of what they post, share or forward.
• Forwarding. Forwarding defamatory or inciting content can itself amount to publication, although courts consider knowledge and intention.
• Cyberbullying and trolling. There is no offence called cyberbullying, but criminal intimidation, stalking, insulting the modesty of a woman, defamation and the IT Act offences cover most forms.
• After Shreya Singhal. Merely offensive or annoying posts are not an offence; Section 66A has been struck down and must never be invoked.

6. Grievance Redressal

Figure 4: The grievance route for social media users

• Grievance officer. Every platform must appoint one, acknowledge complaints within 24 hours and resolve them within seven days, as amended in 2026.
• Grievance Appellate Committees. Created by the 2022 amendment, they hear appeals from users dissatisfied with a grievance officer's decision, filed within 30 days.
• Courts. Users may still approach the courts, including for restoration of wrongly suspended accounts or removal of unlawful content.

7. Influencers, Elections and Children

• Influencers. The Central Consumer Protection Authority's guidelines on misleading advertisements and endorsements (2022), and its disclosure guidance for social media influencers (2023), require clear disclosure of any paid or material connection with a brand.
• Elections. The Election Commission has directed removal of fake and deepfake content during elections and required labelling of AI-generated political content (see Topic 21)
• Children. Once the DPDP Act's substantive provisions commence, platforms must obtain verifiable parental consent before processing the personal data of anyone under 18, and may not track, behaviourally monitor or target advertising at children (s.9)

8. The Courts on Social Media

Figure 5: Key decisions on social media

• Tehseen S. Poonawalla v. Union of India, (2018) 9 SCC 501. Responding to lynchings triggered by rumours, the Court directed governments to curb and stop the dissemination of irresponsible and explosive messages and videos on social media that incite mob violence, and to register cases against those spreading them.
• Shreya Singhal (2015), Kunal Kamra (2024), X Corp (2025). The constitutional limits on regulating online speech, the fall of the fact check unit, and the Sahyog portal (see Topic 17)

9. Quick Revision and Memory Aids

• 'Corner shop and stadium'. Ordinary and significant platforms.
• '50 lakh'. The threshold for significant social media intermediaries.
• 'CCO, Nodal, RGO'. The three resident officers.
• '24 hours, 7 days, 30 days'. Acknowledge, resolve, appeal to the GAC.
• 'Platform shielded, poster liable'. User liability.
• 'Ajit Mohan: power means accountability'. The courts on platforms.

10. Frequently Asked Questions

What is a significant social media intermediary?

A social media intermediary with registered users in India above the notified threshold of 50 lakh, which must comply with additional duties under Rule 4 of the IT Rules, 2021, including appointing resident compliance, nodal and grievance officers, publishing monthly reports and, for messaging services, enabling identification of the first originator on order.

11. Related Topics

• Topic 17: IT Act and Freedom of Speech. Constitutional limits on regulating posts.
• Topic 23: IT Act and Online Platforms. The wider platform economy.