How 2026 IT Rules Automate Censorship

[Rishi is a student at NALSAR University of Law.]

On 10 February 2026, the Ministry of Electronics and Information Technology (MeitY) notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026, effective from 20 February 2026. The target is synthetically generated information (SGI), also known as deepfakes or AI-generated audio or video designed to appear real. The urgency is understandable. The recent incidents showed how fabricated intimate content can severely damage a person’s dignity within hours of upload. The problem is real, the harm is documented, and the regulatory gap was genuine. Fast-moving technology often invites reactive policymaking. In attempting to protect citizens from malicious AI-generated content, the State is forcing social media platforms to rely on a blunter, equally dangerous form of automated censorship. 

What the Law Actually Says

To understand the argument, one must first understand what has actually changed. Intermediaries, as defined under Section 2(1)(w) of the Information Technology Act 2000 (IT Act), to mean any platform that stores or transmits user content, from Instagram to a regional news aggregator, are now subject to a drastically accelerated compliance regime. SGI is newly defined under Rule 2(1)(wa) as audio, visual, or audio-visual information which is artificially or algorithmically created, generated, modified, or altered using a computer resource, in a manner that such information appears to be real, authentic, or true, likely to be perceived as indistinguishable from a natural person or real-world event excluding routine or good-faith editing, formatting, enhancement or creation.

The most consequential change is in Rule 3(1)(d), which slashes the takedown timeline from 36 hours to 3 hours upon receiving a court order or written notice from a government officer of at least Joint Secretary rank. For especially sensitive categories, non-consensual intimate deepfake images, content depicting terrorism, or material likely to provoke violence, Rule 3(2)(b) compresses this window further to 2 hours. That is a 92% reduction in response time. The clock begins the moment the notice arrives, not when the intermediary has had an opportunity to evaluate it.

Rule 3(3)(a)(i) goes a step further. It mandates that significant social media intermediaries, which are large platforms such as Meta, YouTube, and X (formerly Twitter) to deploy reasonable and appropriate technical measures to proactively prevent the upload of unlawful SGI. This is not reactive moderation triggered by a complaint. It is automated gatekeeping before content ever goes live. The previous best-efforts standard, which gave platforms a measure of grace for good-faith compliance attempts, has been replaced by a strict liability model, directly tied to the safe harbour protection under Section 79 of the IT Act.

When Immunity Becomes a Leash

Section 79 of the IT Act, is the legal spine of the Indian internet economy. It grants intermediaries conditional immunity from liability for content posted by users, commonly known as safe harbour. The logic is intuitive. You cannot hold the telephone company liable for what people say over the phone. The immunity, however, is conditional. Under Section 79(2)(c), intermediaries must observe due diligence and follow government-prescribed guidelines. Under Section 79(3)(b), they lose immunity if they fail to act on actual knowledge of unlawful content.

The Supreme Court’s landmark ruling in Shreya Singhal v. Union of India defined “actual knowledge” narrowly and precisely. It means a court order or a government order that satisfies the constitutional requirements of Article 19(2), not a private complaint, not corporate pressure, not an executive nudge. This was a crucial safeguard. It prevented platforms from being strong-armed into removing content merely because someone powerful found it inconvenient.

The 2026 rules operate within this structure but strain it to the breaking point. Justice GS Patel in Kunal Kamra v. Union of India described this dynamic as “an intermediary will do anything to retain safe harbour. It will bend the knee to a Government directive regarding content. Its business depends on safe harbour and immunity from prosecution for hosted content. Between safe harbour and user's rights regarding content, the intermediary faces a Hobson’s choice; and no intermediary is quixotic enough to take up cudgels for free speech.” The 2026 rules have made this Hobson’s choice more acute and more consequential than at any prior point in India's internet regulatory history.

Human Review is Mathematically Impossible in 3 Hours

Three hours sounds like a reasonable period until one examines what responsible legal review of a takedown notice actually requires. A properly handled takedown notice demands reading and verifying the legal basis of the notice or order identifying the precise content at issue; assessing whether that content actually violates the law or is instead constitutionally protected political satire, journalism, or artistic commentary; escalating to legal counsel where the question is non-trivial; and then acting. Even in a well-resourced platform with dedicated compliance teams working around the clock, this process routinely takes longer than 3 hours for contested content. For smaller or regional platforms operating with limited legal staff and irregular hours, it is simply beyond reach.

This is not procedural indulgence. It is the minimum that due process requires. In Shreya Singhal v. Union of India, the court recognised this when it held that intermediaries cannot be expected to make rapid, independent judgments about legality, which is precisely why the court required court or government orders before safe harbour could be lost. Speed without procedure is censorship wearing a compliance badge.

How AI Becomes the Censor

To comply with 3-hour reactive takedowns and proactive filtering under Rule 3(3)(a)(i), platforms will turn and indeed, can only turn to automated AI content moderation. This is not speculation. It is the only technically and commercially viable option at the scale these rules demand. Automated moderation tools work through pattern recognition. They scan content against databases of known-illegal material, using classifiers trained on visual similarities, audio fingerprints, and metadata signatures. They are extraordinarily fast. They are also unusually blunt.

The core concerns are over-removal and bias. An AI classifier trained to detect deepfakes and non-consensual intimate content will predictably misidentify constitutionally protected expression. It lacks the nuance to distinguish malicious SGI from political satire using AI-assisted caricatures to criticize public figures’ speech, squarely safeguarded by Article 19(1)(a). Furthermore, automated moderation will inevitably censor investigative journalism that uses AI-generated imagery to illustrate documented events lacking original footage. Finally, blunt algorithmic tools will suppress legitimate artistic expression where AI generation is a deliberate medium, not a deceptive mechanism. Also, who gets to decide which content to be moderated, the government, the intermediary, or the opaque AI algorithm trained on datasets?

Rule 3(1)(cb) does nominally allow satire and creative synthetic works that do not violate the law, and Rule 2(1)(wa) carves out routine editing and accessibility enhancements. But these are paper protections. An automated classifier cannot read intent. It cannot distinguish between a deepfake crafted to defame and a satire crafted to critique. This means that when a creator knows that their AI-assisted political cartoon can be auto-removed within hours of a government notice with no human review, no opportunity to be heard, and no pre-removal notice, they may not create it at all. This is the algorithmic version of the heckler’s veto. It is not a single heckler shouting down a speaker, but a structural design where any sufficiently aggressive complainant can trigger automated suppression of lawful speech, with the platform’s commercial survival ensuring compliance. The algorithm does not adjudicate; it executes.

The 2026 IT Amendment Rules fundamentally fracture the fundamental rights under Article 19(1)(a) and Article 21. By mandating automated, system-wide content removal without pre-takedown hearings, the rules fail the constitutional proportionality test. In the fleeting internet economy, post-facto grievance mechanisms are practically useless; suppressing a journalist’s expose or a satirical video for even 24 hours permanently undermines its impact. This framework replicates the structural vices found to be struck down by the Bombay High Court in Kunal Kamra v. Union of India. There, the government’s Fact Check Unit was found to be invalid for exercising unchecked executive censorship without independent review. Ultimately, the 2026 rules institutionalise a parallel, automated censorship regime devoid of procedural fairness.

The rules are also focused on large global platforms like Meta, Google, and X that have the engineering budgets to build automated compliance infrastructure. But the IT Rules apply to all intermediaries, regardless of size. India has a thriving ecosystem of smaller regional social media platforms, vernacular news apps, hyperlocal community networks, and independent digital publishers. For these entities, maintaining round-the-clock compliance teams, deploying certified AI detection systems, and building 2-hour takedown pipelines are not merely challenging; they are existential. Global big tech can absorb these regulatory costs through scale, whereas domestic startups cannot. Consequently, these rules inadvertently entrench the very monopolies they aim to regulate, stifling the homegrown digital diversity India has historically championed.

What a Workable Framework Would Look Like

Criticism without construction is merely a complaint. A workable framework would incorporate three reforms.

First, a tiered takedown timeline. A 2-to-3-hour window is defensible for unambiguously criminal content such as child sexual abuse material, direct incitement to imminent violence. For content whose illegality is genuinely contested, a 24-to-48-hour window with mandatory legal review would preserve due process without sacrificing speed on clear cases. The European Union’s Digital Services Act provides a workable model. It calibrates timelines to content severity and mandates user notification and appeal rights.

Second, a pre-removal notice to the content creator, except where notice would frustrate an active law enforcement objective. Natural justice principles such as audi alteram partem, the right to be heard, are not bureaucratic niceties. They are constitutional requirements. There is no principled reason a content creator should lose access to their work without an opportunity to respond, unless exigent circumstances specifically require it.

Third, an independent statutory review body for contested takedowns, not a government-staffed Fact Check Unit, which the Bombay High Court in the Kunal Kamra case has already struck down, but an autonomous adjudicator operating at the speed the digital environment demands. Rule 2(1B) currently offers some protection for automated removals made in compliance with the rules. Still, it does not resolve the reverse liability a platform faces if its moderation tool erroneously suppresses lawful content. That ambiguity systematically incentivizes over-removal.

Conclusion

The IT Amendment Rules 2026, are the product of a genuine problem. Deepfakes cause real harm at real speed, and the 36-hour takedown window of the 2021 rules was genuinely insufficient in an environment where fabricated video can shape an election, destroy a reputation, or incite violence in a fraction of that time. But the solution has overshot the problem. By mandating 2-to-3-hour takedowns, abolishing the best-efforts shield, and requiring proactive AI filtering, MeitY has made algorithmic censorship the only commercially viable compliance strategy for platforms of every size. The political satirist, the investigative journalist, and the opposition campaigner using AI tools to make a clearly labelled critique all stand in the crossfire of a system optimized for speed over accuracy. The heckler’s veto has been built into the algorithm, and algorithms, unlike courts, do not read constitutions.

India is attempting to use law to govern a technology it does not fully control, by relying on a technology it cannot fully audit, to enforce standards it has not fully defined. The rules must be revisited not to weaken the regulation of genuine deepfakes, but to ensure that the remedy does not become the disease. India’s constitutional democracy has spent decades establishing that restrictions on speech must be reasonable, proportionate, and subject to independent review. The 2026 amendment rules risk dismantling that architecture in 180 minutes.