IT (Intermediary Guidelines & Digital Media Ethics Code) Amendment Rules, 2026
Frequently Asked Questions on the amendments notified on 10th February 2026, effective 20th February 2026. Prepared by MeitY.
📥 Download Official Documents
OCWC Handbook for LEAs
Official Operational Reference by I4C, MHA
IT Act, 2000 — Full Text
Available at indiacode.nic.in
Gazette Notification G.S.R. 120(E)
Amendment Rules 2026 — egazette.gov.in
Amendment Rules 2026 — MeitY
meity.gov.in official upload
Consolidated IT Rules, 2021 (Updated)
With all amendments incorporated
⏱️ Key Amended Timelines
The 2026 amendments significantly tighten compliance timelines for intermediaries:
📋 Frequently Asked Questions
The Amendment Rules, 2026 amend the IT Rules, 2021 to strengthen the due diligence framework for intermediaries, particularly in relation to synthetically generated information (SGI) and associated online harms. Key areas include:
- Insertion of definitions for "audio, visual or audio-visual information" and "SGI"
- Clarification that SGI references include unlawful acts information
- Removal/disablement through automated tools does not violate safe harbour under Sec. 79(2)(a)/(b)
- Strengthened user awareness — periodic info every 3 months
- Reduced timelines for takedown and grievance redressal
- New SGI due diligence framework under Rule 3(3)
- Additional SSMI obligations under Rule 4(1A)
Notified via Gazette G.S.R. 120(E), dated 10th February 2026, effective 20th February 2026.
The amendments were introduced due to rapid advances in AI and machine learning technologies. Online platforms can now generate highly realistic synthetic content (deepfakes, synthetic voice, fabricated media). While SGI has legitimate benefits for innovation and accessibility, it also enables serious harms:
- Deepfake-based impersonation and fraud
- Non-consensual intimate imagery generated by AI
- Misinformation threatening public order and national integrity
- CSEAM (Child Sexual Exploitation and Abuse Material) generation
The amendments create a comprehensive framework to harness SGI benefits while preventing misuse.
Under the amended Rules, intermediaries must observe enhanced due diligence — including deploying reasonable technical measures (automated tools) to prevent unlawful SGI, labelling permissible SGI, strengthening grievance timelines, and cooperating with government orders within revised timelines. SSMIs have additional obligations including user declaration, technical verification, and prominent labelling before publishing SGI.
SGI is defined under Rule 2(1)(wa) as audio, visual or audio-visual information which is artificially or algorithmically created/generated/modified/altered using a computer resource, in a manner that it appears real/authentic/true and depicts any individual or event in a manner indistinguishable from a natural person or real-world event.
Examples of SGI:
- AI-generated realistic video of a virtual human speaking as a real person
- Synthetic voice reproducing a natural person's voice (voice cloning)
- AI-generated realistic reconstruction of an event
- AI-generated image of a person at an event that never happened
What is NOT SGI:
- Routine edits: cropping, compression, noise reduction, brightness correction
- Privacy blur/masking of faces or number plates
- Translations, subtitles, closed captioning, audio descriptions
- Educational/training materials using illustrative/hypothetical content
Yes. The amendments clarify that for purposes of these Rules, references to "information" in the context of unlawful acts include SGI. This means all existing obligations on intermediaries regarding unlawful information now explicitly cover synthetically generated information as well.
No. The amendments clarify that removal or disabling access to information including SGI in compliance with the Rules (including through reasonable technical measures / automated tools) shall not amount to violation of Section 79(2)(a) or 79(2)(b) conditions (safe harbour). This encourages intermediaries to proactively act against unlawful SGI without fear of losing safe harbour protection.
Under amended Rule 3(1)(a), intermediaries must periodically inform users at least once every three months about rules, privacy policy, terms and user obligations. Intermediaries facilitating SGI creation must provide additional warnings about responsible use and legal consequences of misuse.
Under amended Rule 3(1)(d), when an intermediary receives actual knowledge through a court order or reasoned intimation from an authorised officer (not below DIG rank), it must remove or disable access to specified unlawful information within 3 hours. This has been reduced from 36 hours.
Example: If an intermediary receives an intimation at 11:00 AM to disable a deceptive SGI video, it must comply by 2:00 PM.
- General grievances: Reduced from 15 days to 7 days
- Removal grievances (Rule 3(1)(b)): Reduced from 72 hours to 36 hours
- Nudity/Sexual/NCII/Morphed/Impersonation: Reduced from 24 hours to 2 hours
Rule 3(3) titled "Due diligence in relation to synthetically generated information" prescribes:
- Deployment of technical measures to prevent unlawful SGI
- Explicit prohibition of high-risk SGI categories
- Mandatory labelling and provenance embedding for permissible SGI
- Safeguards to prevent tampering/removal of labels/metadata/identifiers
Under Rule 3(3)(a)(i), intermediaries must deploy reasonable technical measures to prevent:
- CSEAM, NCII, obscene/pornographic content — including content invasive of bodily privacy
- Deceptive impersonation SGI — deepfakes showing persons making statements they never made
- False document / electronic record SGI — fabricated IDs, certificates, official letters
- Explosives/arms related SGI — enabling preparation of explosive material or weapons
- False event depiction SGI — fabricated recordings depicting events that didn't occur (riots, attacks, election violence)
Under Rule 3(3)(b), for SGI that is not prohibited, intermediaries must ensure:
- Clear and prominent SGI label visible to all users
- Permanent metadata/provenance mechanisms and unique identifiers embedded for identification
- No functionality that undermines SGI identification (e.g., no "remove watermark" or "export without metadata" options)
This ensures transparency and traceability of all synthetically generated content.
Rule 4(1A) introduces enhanced ex-ante obligations for Significant Social Media Intermediaries (SSMIs). Before allowing users to display, upload or publish information, SSMIs must:
- Obtain a user declaration as to whether content is SGI
- Deploy technical measures to verify the declaration prior to publication
- Ensure prominent labelling where confirmed as SGI
Example: Before publication, an SSMI may require the uploader to declare "AI-generated: Yes/No", verify using metadata/detection signals, and apply a prominent label if confirmed SGI.
The proviso to Rule 4(1A) clarifies that where an SSMI knowingly permits, promotes or fails to act upon SGI in contravention of the Rules, it shall be deemed to have failed to exercise due diligence under the IT Rules, 2021. This strengthens platform accountability regarding unlawful SGI.
The amendments strengthen Rule 4(4) by moving from an "endeavour"-based formulation to a clearer, mandatory and proportionate obligation for SSMIs to deploy reasonable and appropriate technical measures, including automated tools, to ensure effective due diligence. This aligns with the overall approach of strengthened technological due diligence for unlawful content including SGI.
🔐 IT Act 2000 — Key Sections for OCWC
| Section | Offence | Punishment |
|---|---|---|
| Sec. 66C | Identity theft | Up to 3 years + fine up to ₹1 lakh |
| Sec. 66D | Cheating by personation using computer resources | Up to 3 years + fine up to ₹1 lakh |
| Sec. 66E | Violation of privacy (publishing private images) | Up to 3 years + fine up to ₹2 lakh |
| Sec. 67 | Publishing obscene material electronically | Up to 3–5 years + fine |
| Sec. 67A | Publishing sexually explicit material electronically | Up to 5–7 years + fine |
| Sec. 67B | Publishing CSEAM / child sexual abuse material | Up to 5–7 years + fine |
| Sec. 69 | Government interception/monitoring of information | Procedural — lawful evidence gathering |
| Sec. 72 | Breach of confidentiality and privacy | Up to 2 years + fine |
| Sec. 79 | Safe harbour for intermediaries — conditions for immunity | Procedural — notice & takedown |