Significant Social Media Intermediaries: Rule 4 Additional Due Diligence

Crossing fifty lakh registered users changes an intermediary's legal life: Rule 4 of the IT Rules, 2021 adds a compliance establishment in India, monthly transparency, proactive monitoring duties and, for messaging services, the most contested obligation in Indian platform law, identification of the first originator. Topic 73 defined the category; this note, as asked, studies the Rule 4 layer in full: the officers, the reports, the tools, verification, the traceability regime with its encryption conflict, the comparison with ordinary intermediaries, and the 2026 synthetic content additions.

1. The Compliance Establishment

Figure 1: The Rule 4 establishment

• Chief Compliance Officer. A key managerial personnel or senior employee resident in India, responsible for ensuring compliance with the Act and the Rules. He is liable in proceedings relating to relevant third party information where the intermediary fails to observe due diligence, after being heard, the provision that puts a named individual behind platform compliance.
• Nodal contact person. An employee resident in India, distinct from the CCO, for round the clock coordination with law enforcement agencies and officers, ensuring compliance with their orders and requisitions.
• Resident Grievance Officer. Resident in India, performing the Rule 3(2) functions, the acknowledgement, disposal and imagery clocks (Topic 74), so the grievance seat itself sits within the jurisdiction.
• Monthly compliance report. Published every month: complaints received and action taken, and the content removed or disabled through proactive monitoring, the transparency spine of the regime.
• Physical contact address in India. Published on the website or app, ending the era of platforms with no Indian door to serve papers on.

2. Tools, Tracking and Verification

Figure 2: The operational duties beyond the officers

• Automated tools and proactive monitoring. The SSMI shall endeavour to deploy technology based measures, including automated tools, to proactively identify information depicting rape or child sexual abuse, and information identical to content previously removed. The rule builds in its own limits: the measures must be proportionate to the interests of free speech and privacy, with human oversight and periodic review of the tools, an endeavour duty, not an outcome guarantee.
• Grievance tracking. Every complaint receives a ticket enabling the complainant to track its status, with reasons communicated for action and inaction, feeding the appeal to the Grievance Appellate Committee.
• Voluntary user verification. Users who wish to verify their accounts are given an appropriate mechanism, verification against an active Indian mobile number among the modes, and a demonstrable and visible mark of verification. Voluntariness is the point: the rule stops well short of mandatory identity linking.

3. The First Originator Requirement

Figure 3: Rule 4(2) from duty to the encryption question

• Messaging intermediaries. The duty binds an SSMI providing services primarily in the nature of messaging: it must enable the identification of the first originator of information on its computer resource, traceability of who introduced a message into the platform, not a log of everyone who forwarded it.
• The order. Only on a judicial order by a court of competent jurisdiction, or an order of the competent authority under Section 69 and the Interception Rules (Topic 72), so the trigger imports the s.69 discipline of reasons, confirmation and review.
• The serious offence threshold. Orders may issue only for prevention, detection, investigation, prosecution or punishment of offences relating to the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, or public order, or offences of rape, sexually explicit material or child sexual abuse material, punishable with imprisonment of not less than five years; nothing smaller qualifies.
• The limits. No order where a less intrusive means is effective; the intermediary is not required to disclose the contents of any message or any information about the first originator's other users; and where the first originator is located outside India, the first originator within India of that information is deemed the first originator for the purpose.
• End to end encryption vs traceability. Encrypted services contend that identifying an originator requires either breaking encryption or hashing and fingerprinting every message for everyone, undermining the privacy of all users to trace a few, and that the rule exceeds ss.79 and 69 and fails Puttaswamy's proportionality test. The WhatsApp and Meta challenge filed in the Delhi High Court in 2021, with the connected petitions on the 2021 Rules, remains pending, and the duty has not been enforced against an end to end encrypted service pending adjudication, the constitutional issue your syllabus flags.

4. The Comparison and the 2026 Additions

Figure 4: Ordinary intermediary against SSMI

• Significant vs ordinary intermediary. Both live under Rule 3 and its clocks; the SSMI adds the three resident officers, the physical address, monthly reporting, the proactive monitoring endeavour, tracking, voluntary verification and, for messaging, traceability exposure. The threshold is the notified fifty lakh registered users, and the Government may also designate a non-threshold intermediary as significant where its services pose a material risk.
• Additional 2026 SGI duties. The synthetic content amendment adds the SSMI-specific apparatus of Topic 75: the user declaration whether uploaded content is synthetically generated, reasonable and proportionate technical verification of that declaration, and the prominent label on declared or detected synthetic content, with knowing failure operating as a due diligence breach.
• The stakes. Rule 7 makes every one of these duties a condition of the s.79 safe harbour, and the CCO provision adds personal exposure, which is why the Rule 4 apparatus, not the offences chapter, is where platform compliance budgets live (Topic 67)

5. Frequently Asked Questions

What additional due diligence must a significant social media intermediary observe?

Appointment of a Chief Compliance Officer, a 24x7 nodal contact person and a Resident Grievance Officer, all resident in India; publication of a physical contact address in India; monthly compliance reports; an endeavour to deploy automated tools with human oversight to identify rape and child sexual abuse imagery and previously removed content; complaint tracking; a voluntary verification mechanism with a visible mark; for messaging services, the ability to identify the first originator on qualifying orders; and, since 2026, the user declaration, verification and labelling duties for synthetically generated information.

When can a messaging platform be ordered to identify the first originator of a message?

Only by a judicial order or an order of the competent authority under Section 69, and only for the prevention, detection, investigation, prosecution or punishment of offences relating to sovereignty and integrity, security of the State, friendly relations, public order, or rape, sexually explicit material or child sexual abuse material, punishable with imprisonment of five years or more. No order may issue where a less intrusive means is effective, the platform need not disclose message contents or other users' information, and if the first originator is outside India, the first originator within India is deemed the originator. The rule's compatibility with end to end encryption is under challenge in the pending WhatsApp litigation.

6. Related Topics

• Topic 74: Rule 3 Due Diligence. The floor beneath the Rule 4 layer.
• Topic 75: Synthetically Generated Information. The 2026 duties in detail.