India’s IT Regulation Timeline | SFLC.in
Digital Rights & Policy Tracker

India’s Information Technology Regulation Timeline

Tracking the shift from foundational e-commerce to binding AI regulations on content and their impact on digital freedoms (2000-2026)

Legislation Enforced

Information Technology Act, 2000

Legal recognition of e-transactions and cyber offences.
India was adopting the internet for commerce. The law aimed to enable e-governance and regulate emerging digital activity.
The broad, ambiguous powers granted under this foundational Act later became the primary basis for modern privacy and free speech violations.
Rules Notified

IT (Procedure & Safeguards for Blocking) Rules, 2009

Formalised government blocking powers over online content.
The government sought a structured mechanism to restrict access to information affecting sovereignty or public order.
Introduced blanket confidentiality on all blocking orders, leaving no scope for a hearing or challenge. A challenge on this confidentiality is currently pending before the Supreme Court.
Rules Notified

IT (Intermediaries Guidelines) Rules, 2011

Takedown on notice; due diligence obligations for intermediaries.
As platforms like Facebook/Twitter grew, the government wanted them to take responsibility for user-generated content.
Takedowns were based on vague categories like “offensive” content, leading to severe over-removal of lawful speech and private censorship.
Supreme Court Judgment

Shreya Singhal v. Union of India

Section 66A struck down. Content takedowns now require court or government orders.
Courts intervened to address the widespread police misuse of vague provisions to arrest citizens for online posts.
A landmark victory for digital rights. Section 66A was deemed unconstitutional. However, Section 69A’s (blocking powers) constitutionality was upheld.
Draft Rules Published

Draft IT (Intermediary Guidelines Amendment) Rules, 2018

Traceability mandates, automated filtering, and stricter due diligence.
Mob lynchings linked to WhatsApp rumours triggered proposals to identify message originators.
Traceability requirements essentially break end-to-end encryption, enabling architecture for mass surveillance of all citizens.
Rules Notified

IT (Intermediary Guidelines & Digital Media Ethics Code) Rules, 2021

Traceability, resident grievance officers, and regulation of OTT & news media.
Government aimed to bring social media, OTT, and digital news under a unified regulatory framework.
Currently facing multiple High Court challenges for violating free speech, excessive delegation of power, and lacking legislative backing.
Amendment Notified

IT (IGDMEC) Amendment Rules, 2022 — GAC

Grievance Appellate Committee (GAC) to review platform content decisions.
Introduced to give users an appellate mechanism against arbitrary account suspensions by platforms.
The GAC is entirely government-controlled, raising severe concerns about its independence, neutrality, and risk of state censorship.
Amendment Notified

IT (IGDMEC) Amendment Rules, 2023 — Fact-Checking Unit

Government-designated body (PIB) authorised to identify “false or misleading” info about the government.
Rising concerns about misinformation regarding government functioning.
The government becomes the sole arbiter of truth, directly suppressing dissent. The Bombay High Court deemed it unconstitutional; the matter remains in appeal.
Executive Advisory Issued

MeitY Advisory on Deepfakes

Platforms urged to take preventive measures against AI-generated deepfakes.
Rapid rise of AI deepfakes posing risks to elections and public trust.
Though technically non-binding, these advisories pressure platforms into compliance—normalising “informal regulation” without parliamentary oversight.
Bill Withdrawn

Broadcasting Services (Regulation) Bill, 2023

Heavy regulation of OTT, digital news, and individual influencers.
An attempt to unify regulation across all broadcasting mediums under a single license-raj system.
Faced widespread backlash due to overbroad definitions and extreme censorship risks to independent creators. Resulted in the Bill being withdrawn.
Executive Advisory Issued

MeitY Advisory (Compliance with IT Rules)

Reinforced due diligence and traceability expectations with threats of stricter enforcement.
Issued following perceived non-compliance by major tech platforms.
Continues the dangerous trend of “soft law”—imposing strict obligations on platforms without formal rulemaking or legal safeguards.
Draft Rules Published

Draft IT Amendment Rules (SGI / AI)

Mandatory labelling and accountability framework for synthetic/AI-generated content.
Proposed to combat the explosion of generative AI impersonation and misinformation.
The definition of “synthetic content” was dangerously broad. Ordinary edited videos or political satire could be wrongly regulated or censored.
Amendment Notified

IT Amendment Rules, 2026 (SGI Rules)

Binding AI labelling, rapid takedown obligations, and a formal SGI definition.
Government escalated its deepfake advisories into binding law with strict verification duties on platforms.
Extremely short takedown timelines (measured in hours) destroy due process. Platforms will over-censor user content to avoid severe penalties.
Draft Rules Published

Draft IT Rules (Second Amendment), 2026

Making advisories legally binding, expanding the IDC, and mandating data retention.
The government seeks to permanently formalise its “soft law” approach into hard enforcement mechanics.
By making executive advisories explicitly binding, the executive bypasses the parliamentary legislative process entirely, consolidating unchecked power.