Draft IT (Second Amendment) Rules 2026: MeitY Expands Oversight to Users
Why in News?
On 31 March 2026, the Ministry of Electronics and Information Technology (MeitY) published the Draft Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Second Amendment Rules, 2026 for public consultation. The draft, released under Sections 69A, 79 and 87 of the Information Technology Act, 2000, marks the third substantive amendment cycle since the parent 2021 Rules were notified.
Unlike earlier iterations that addressed intermediaries (social media platforms) and digital news publishers, the 2026 draft expands compliance obligations to a new category: individual users who post “news and current affairs” content at scale. A user who posts such content beyond prescribed thresholds would be treated akin to a publisher, requiring grievance officer contact details, code-of-ethics adherence and takedown responsiveness within fixed timelines.
On 17 April 2026, Human Rights Watch (HRW) issued a public response urging MeitY to withdraw the draft, arguing that it “collapses the safe-harbour architecture and imports direct obligations onto ordinary speakers.” The Internet Freedom Foundation (IFF) and the Electronic Frontier Foundation (EFF) filed detailed consultation comments flagging Article 19(1)(a) and Article 14 infirmities.
UPSC Relevance at a Glance
| Dimension | Detail |
|---|---|
| GS Paper | GS2 — Polity, Governance, Fundamental Rights |
| Prelims | IT Act 2000 Sections 69A/79/87; IT Rules 2021; Shreya Singhal case; Bombay HC ruling on Fact-Check Unit |
| Mains | Safe-harbour doctrine; Article 19(1)(a) limits; chilling effect; delegated legislation tests |
| Syllabus Tags | Digital Rights, Executive Rule-Making, Judicial Review, Media Regulation |
Background and Context
India’s internet speech architecture rests on two pillars of the IT Act, 2000. Section 79 grants intermediaries conditional immunity (“safe harbour”) for third-party content, provided they exercise due diligence and act on actual knowledge or a court/government order. Section 69A allows the Union government to block information online on defined grounds drawn narrowly from Article 19(2) of the Constitution.
The first rules under Section 79, notified in 2011, were challenged and judicially narrowed in Shreya Singhal v Union of India (2015). The Supreme Court struck down Section 66A for vagueness, read down Section 79(3)(b) so intermediaries need act only on court/government orders, and reaffirmed that restrictions on speech must be “narrowly tailored” to Article 19(2) grounds.
The IT Rules 2021 replaced the 2011 framework. They introduced a three-tier grievance mechanism, required Significant Social Media Intermediaries (SSMIs) with over 50 lakh users to appoint a Chief Compliance Officer, Nodal Contact Person and Resident Grievance Officer, and mandated traceability of the “first originator” for messaging platforms under Rule 4(2). Part III of the 2021 Rules, notably, extended oversight to digital news publishers and OTT platforms under the Ministry of Information and Broadcasting (MIB), a move the Bombay and Madras High Courts partially stayed.
The 2023 amendment inserted Rule 3(1)(b)(v) creating a government-notified Fact-Check Unit (FCU) to flag “fake, false or misleading” information about central government business. In Kunal Kamra v Union of India (2024), the Bombay High Court struck this down as violating Articles 14, 19(1)(a) and 19(1)(g), holding that truth cannot be adjudicated by an executive body that is also an interested party.
The 2026 draft is the first to pierce the user-intermediary distinction that has defined Indian internet law for 25 years. For related governance context, see form-6-controversy-electoral-rolls-allegations-2026 and a-social-media-ban-will-not-save-our-children.
Key Features and Provisions
User-as-Publisher Classification
The draft introduces “Significant User-Publishers of News and Current Affairs” (SUPNCA), a new category covering individual accounts that post current-affairs content to audiences crossing a notified threshold (proposed: 1 lakh followers on a single platform or aggregate of 5 lakh across platforms). A SUPNCA must:
- Publish contact details of a grievance officer resident in India.
- Adhere to the Code of Ethics in Appendix to Part III of the 2021 Rules (earlier limited to digital news publishers).
- Take down content within 36 hours of a legitimate complaint; within 24 hours for content deemed to impersonate or depict private parts.
- Furnish self-declaration of compliance annually to MeitY.
Expanded Takedown Grounds
Rule 3(1)(d) is proposed to be amended to include content that “presents demonstrably false claims on matters of public record” and content that “undermines public confidence in election processes.” Neither phrase is defined in the draft.
Role of MIB
Part III jurisdiction continues to rest with the Ministry of Information and Broadcasting, but the 2026 draft creates an inter-ministerial Digital Content Review Panel combining MeitY and MIB officials to adjudicate user-publisher disputes.
Traceability and Encryption
Rule 4(2) on traceability is retained and extended to “significant user-to-user information services,” a phrase broad enough to cover federated and end-to-end encrypted platforms. WhatsApp’s pending challenge before the Delhi High Court (WhatsApp LLC v Union of India, 2021) remains undecided.
Grievance Timelines
| Category | Acknowledge | Resolve |
|---|---|---|
| Intermediary complaint (existing) | 24 hours | 15 days |
| SUPNCA complaint (proposed) | 24 hours | 36 hours for takedown |
| Impersonation/non-consensual imagery | Immediate | 24 hours |
Penalties
Non-compliance triggers loss of safe harbour under Section 79 for intermediaries and, for SUPNCAs, prosecution under Section 45 of the IT Act (residual penalty of up to Rs 25,000) plus deactivation requests to the host platform.
Significance
- Addresses platform-era harms: Coordinated inauthentic behaviour, deepfake-driven defamation, and synthetic election content have scaled faster than the 2021 framework anticipated. The draft attempts to plug gaps identified by the Parliamentary Standing Committee on Communications and IT in its 2024 report.
- Harmonises publisher obligations: Treating high-reach individual accounts like publishers recognises that influence, not institutional form, drives public-opinion impact.
- Strengthens victim remedies: Faster takedown windows for impersonation and non-consensual intimate imagery respond to civil-society demands documented by the National Commission for Women and the Cyber Crime Coordination Centre (I4C) under MHA.
- Provides regulatory certainty: A single notified threshold replaces ad hoc executive orders under Section 69A.
- Signals Indian digital sovereignty: Aligns with the Digital India Act (Draft, 2025) trajectory of domestic-first platform governance, comparable to EU’s Digital Services Act (DSA).
- Institutionalises grievance flow: The Digital Content Review Panel offers an appellate layer short of judicial review.
Concerns, Criticisms and Challenges
The draft has attracted pointed constitutional critique. HRW (17 April 2026) argued the SUPNCA category lacks an “intelligible differentia” and tests the equality guarantee under Article 14, because follower counts are platform-generated metrics unrelated to editorial responsibility. IFF submitted that the phrase “demonstrably false claims on matters of public record” is unconstitutionally vague, violating the void-for-vagueness doctrine the Supreme Court applied in Shreya Singhal.
The Editors Guild of India flagged a chilling effect: journalists with large personal followings would face overlapping obligations under the Press Council Act, the Cable Networks Act and now the IT Rules. The 36-hour takedown window, EFF noted, incentivises over-removal because the cost of refusal (prosecution, deplatforming) is asymmetric.
The Fact-Check Unit precedent looms large. In Kunal Kamra, the Bombay High Court held that executive determination of “truth” is inherently suspect when the executive is a party of interest. Rule 3(1)(d)’s new proviso mirrors the FCU’s logical structure. Senior counsel Sajan Poovayya has argued the clause would be struck down on identical reasoning.
Encryption concerns persist. The extension of Rule 4(2) to “significant user-to-user information services” effectively criminalises end-to-end encryption designs. The Karnataka High Court, in X Corp v Union of India (2025), expressed doubts about the constitutionality of the parallel Section 69A “Sahyog Portal” framework.
Federalism worries also surface. Content takedown is increasingly invoked by state police under Section 91 CrPC / 94 BNSS. Absence of a state consultation mechanism in the Draft Rules weakens cooperative federalism principles articulated in the S.R. Bommai (1994) line of cases.
Comparative and Historical Perspective
| Framework | Year | Primary Target | Safe Harbour Treatment | Key Weakness |
|---|---|---|---|---|
| IT Rules 2011 | 2011 | Intermediaries | Broad immunity | Read down in Shreya Singhal |
| IT Rules 2021 | 2021 | Intermediaries + Publishers | Conditional on due diligence | Parts partially stayed |
| 2023 Amendment | 2023 | Fact-Check Unit | — | Struck down (Bombay HC) |
| 2026 Draft | 2026 | Intermediaries + Publishers + SUPNCAs | Conditional + user-level duties | Article 14, 19(1)(a) challenges expected |
| EU DSA | 2022 | Very Large Online Platforms | Risk-based, no user duties | Resource-intensive audits |
| US Section 230 | 1996 | Interactive computer services | Strong statutory immunity | Limited takedown incentive |
Historically, Indian courts have insisted that speech restrictions pass the proportionality test articulated in K.S. Puttaswamy (2017) and Anuradha Bhasin v Union of India (2020). The 2026 draft, by creating an open-ended user obligation, pushes against that doctrinal line.
Way Forward
- MeitY and MIB should jointly publish a gazetted impact assessment defining SUPNCA with quantitative thresholds and sunset review.
- Parliament should consider placing user-publisher obligations in primary legislation (pending Digital India Act) rather than subordinate rules, addressing delegated-legislation concerns raised in In re Delhi Laws Act (1951).
- Law Commission of India could examine harmonisation with Bharatiya Nyaya Sanhita 2023 provisions on misinformation.
- Supreme Court e-Committee should operationalise a fast-track judicial review channel for takedown orders, moving beyond the current Article 226 route.
- Data Protection Board of India under the DPDP Act 2023 should coordinate with MeitY to avoid overlapping grievance regimes.
- MEA and DPIIT should engage bilateral partners (UK, EU, Singapore) to avoid extra-territorial compliance conflicts.
- Civil society engagement must move beyond 30-day consultation windows; a standing multi-stakeholder advisory on internet rulemaking, modelled on TRAI’s open-house discussions, would improve legitimacy.
Conclusion
The Draft IT (Second Amendment) Rules 2026 mark a doctrinal shift: for the first time, Indian subordinate legislation treats high-reach individual users as publishers. The policy instinct is defensible, given platform-era harms that the 2021 architecture did not foresee. But the constitutional scaffolding is thin. Vague takedown grounds, compressed timelines, and user-level duties risk replicating the very features the Supreme Court struck down in Shreya Singhal and the Bombay High Court reversed in Kunal Kamra.
A durable solution requires primary legislation, clearer definitions tied to Article 19(2) categories, independent appellate review, and respect for end-to-end encryption as a privacy-enabling technology under K.S. Puttaswamy. The executive’s task is not to abandon online regulation, but to design it inside the constitutional envelope. The consultation window closing in May 2026 is the moment to get it right.
Prelims Pointers
- Section 69A of the IT Act 2000 allows blocking for sovereignty, security, public order and related grounds.
- Section 79 grants conditional safe harbour to intermediaries.
- IT Rules 2021 were notified on 25 February 2021.
- Shreya Singhal v Union of India was decided on 24 March 2015.
- The 2023 Fact-Check Unit was struck down in Kunal Kamra v Union of India (Bombay HC, September 2024).
- Rule 4(2) of the 2021 Rules mandates traceability of the first originator.
- MeitY is the nodal ministry for Parts I and II of the Rules; MIB handles Part III.
- The Draft Rules 2026 were released on 31 March 2026.
- HRW issued its response on 17 April 2026.
- Significant Social Media Intermediary threshold is 50 lakh registered users.
- The Digital Content Review Panel proposed in the 2026 draft is an inter-ministerial body.
- The parallel EU instrument is the Digital Services Act (DSA).
Mains Practice Question
“The Draft IT (Second Amendment) Rules 2026 test the constitutional boundary between regulating online harms and preserving Article 19(1)(a).” Critically examine. (15 marks, 250 words)
- Explain the key shift: intermediary-centric to user-centric obligations; SUPNCA category; 36-hour takedowns.
- Apply Shreya Singhal and Kunal Kamra tests; discuss proportionality under Puttaswamy; highlight vagueness in “demonstrably false” clause.
- Suggest remedies: statutory basis, independent appellate review, encryption safeguards, multi-stakeholder consultation.
Frequently Asked Questions
What are the Draft IT (Second Amendment) Rules 2026?
Issued by MeitY on 31 March 2026 under the IT Act 2000, the draft amends the 2021 Intermediary Rules by creating a new category called Significant User-Publishers of News and Current Affairs (SUPNCA), extending compliance duties previously limited to platforms and digital news publishers to individual users above a follower threshold.
Why is the draft in news in April 2026?
Human Rights Watch issued a public critique on 17 April 2026 urging withdrawal, arguing that the draft collapses India’s safe-harbour architecture. Internet Freedom Foundation and Electronic Frontier Foundation filed consultation submissions flagging Article 19(1)(a), Article 14 vagueness and chilling-effect concerns.
How does the draft affect UPSC Prelims and Mains preparation?
For Prelims, candidates must note Sections 69A/79 of the IT Act, Rule 4(2) traceability, the Shreya Singhal (2015) ruling, and the Bombay HC’s 2024 Kunal Kamra judgment on the Fact-Check Unit. For Mains GS2, the topic aligns with executive rule-making, fundamental rights, and digital governance debates.
What is the SUPNCA category and its threshold?
Significant User-Publishers of News and Current Affairs covers individual accounts crossing 1 lakh followers on a single platform or 5 lakh aggregate across platforms, who post news and current-affairs content. They must appoint a grievance officer, follow the Code of Ethics and respond to takedown complaints within 36 hours.
How does the 2026 draft differ from the 2021 Rules?
The 2021 Rules targeted intermediaries and digital news publishers. The 2026 draft retains those duties and adds user-level obligations, creates a Digital Content Review Panel combining MeitY and MIB, expands Rule 3(1)(d) to cover ‘demonstrably false’ claims, and extends Rule 4(2) traceability to ‘significant user-to-user information services’.
Why do critics cite the Shreya Singhal judgment?
In Shreya Singhal v Union of India (2015), the Supreme Court struck down Section 66A for vagueness and read down Section 79(3)(b). Critics argue the 2026 draft’s phrase ‘demonstrably false claims on matters of public record’ is similarly vague, fails the proportionality test from K.S. Puttaswamy, and would chill protected speech.
What happened to the 2023 Fact-Check Unit?
The 2023 amendment created a government Fact-Check Unit to flag ‘fake’ content about central government business. The Bombay High Court, in Kunal Kamra v Union of India (September 2024), struck it down for violating Articles 14, 19(1)(a) and 19(1)(g), holding that the executive cannot adjudicate truth while being an interested party.
What is the way forward?
Experts recommend moving user-publisher obligations into primary legislation via the pending Digital India Act, tying takedown grounds to Article 19(2) categories, preserving end-to-end encryption, creating an independent appellate tribunal, and institutionalising multi-stakeholder consultations beyond the 30-day comment window closing in May 2026.