Authored By: P V Visruth
Samrat Vikramaditya University
I. Introduction
In 2023, India crossed the threshold of 900 million internet users, making it one of the largest and fastest-growing digital populations in the world.[1] With this expansion has come an alarming rise in digital abuse. The National Crime Records Bureau recorded over 67,000 cybercrime cases in 2022, a figure widely regarded as a significant undercount given prevailing barriers to reporting.[2] Among the most pervasive forms of digital abuse are cyberbullying and online harassment, which encompass threats, stalking, hate speech, non-consensual sharing of intimate images, and coordinated campaigns of targeted abuse. Women, children, journalists, activists, and members of marginalised communities bear a disproportionate burden of this harm.[3][4]
Despite the scale and severity of these harms, India does not possess a dedicated statutory framework for cyberbullying or online harassment. The legal response is fragmented across several instruments, including the Information Technology Act, 2000 (IT Act),[5] the Bharatiya Nyaya Sanhita, 2023 (BNS), the Protection of Children from Sexual Offences Act, 2012 (POCSO), and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules 2021). While these instruments address aspects of digital misconduct, they do not treat cyberbullying as a coherent and distinct category of harm, and significant gaps in victim protection, platform accountability, and enforcement persist.
II. The Existing Legal Framework
A. The Information Technology Act, 2000
The IT Act constitutes the primary statute governing electronic conduct in India. Although it was enacted primarily to facilitate e-commerce and digital governance, several provisions are routinely invoked in cyberbullying and harassment cases. § 66C criminalises identity theft, and § 66D addresses cheating by impersonation through electronic means, both of which are commonly employed in harassment campaigns.[6] §’s 67, 67A, and 67B prohibit the electronic publication of obscene, sexually explicit, and child sexual abuse material respectively, and are relevant to non-consensual intimate image sharing and child exploitation.[7] § 72 creates a limited right against unauthorised disclosure of personal information obtained in the course of providing a service.[8]
The IT Act’s principal limitation is its design: it was conceived as a regulatory instrument for electronic transactions, not as a victim-protection statute. It does not define cyberbullying, create a standalone offence of online harassment, or establish procedures specifically adapted to the needs of harassment victims. The penalties it prescribes are often disproportionately low relative to the harm caused.
B. The Bharatiya Nyaya Sanhita, 2023
The BNS, which replaced the Indian Penal Code 1860, retains and modifies several provisions applicable to online harassment. § 351 criminalises criminal intimidation communicated through any medium, including electronic platforms.[9] § 79 penalises words, gestures, or acts intended to insult the modesty of a woman, an offence whose application to online conduct remains judicially unsettled.[10] §’s 77 and 77A introduce provisions on voyeurism and electronic stalking respectively, the latter being a development of some significance in addressing digital surveillance and harassment.[11]
The BNS’s provisions, while broader than those of its predecessor, remain anchored in a physical-world conception of harm. They do not address the phenomenon of coordinated harassment by anonymous actors, the cross-jurisdictional dimensions of online abuse, or the psychological and reputational dimensions of sustained digital campaigns.
C. The Protection of Children from Sexual Offences Act, 2012
POCSO provides the most specific protections available to a defined class of victims. § 11 through 14 criminalise sexual harassment of a child, including harassment committed through electronic means, and address the use of digital platforms to display or distribute child sexual abuse material.[12] POCSO’s victim-centric procedural framework, including special courts and restrictions on disclosure of the victim’s identity, represents a legislative model that does not extend to adult victims of online abuse. This differential protection is difficult to justify given the severity of harm experienced by adult victims.
D. Intermediary Obligations Under the IT Rules, 2021
The IT Rules 2021 impose compliance obligations on social media intermediaries and other online platforms. Rule 4(2) requires significant social media intermediaries to identify the originator of messages upon lawful order, a provision intended to address the problem of anonymous abuse.[13] Rule 3(1)(b) requires intermediaries to inform users that certain categories of content, including material that is harassing or harmful to children, are prohibited.[14] Rule 4(1)(d) mandates the appointment of a Grievance Officer in India to address user complaints.[15]
The IT Rules 2021 represent a significant step towards platform accountability, but they operate primarily through a notice-and-compliance model. Content removal timelines, at thirty-six hours for content flagged as falling within specified categories, are frequently inadequate given the viral speed at which harmful content propagates. No positive obligations exist on platforms to proactively identify and suppress systematic harassment campaigns.
III. Gaps and Shortcomings of the Current Framework
A. Absence of a Unified Definition and Offence
The most fundamental shortcoming of India’s legal regime is the absence of a statutory definition of cyberbullying or online harassment. Courts and police agencies must identify which of several disconnected provisions applies to any given factual scenario, producing inconsistent outcomes and creating obstacles to prosecution. This fragmentation is particularly acute in cases involving coordinated harassment by multiple actors, doxxing, or the sustained psychological abuse that does not involve any single act of identifiable criminality but inflicts serious cumulative harm.
B. The Anonymity Problem
A distinctive feature of online harassment is that perpetrators frequently act anonymously or under pseudonyms. While the originator-tracing obligation in the IT Rules 2021 addresses this in principle, its implementation requires a lawful order from a competent authority, a process that is slow and procedurally burdensome. The practical effect is that many victims cannot identify their harasser, and even those who can face significant delays that allow the harm to compound. The Supreme Court’s judgment in Shreya Singhal, while rightly striking down the overbroad § 66A of the IT Act, did not itself address the structural problem of anonymous abuse.[16]
C. Cross-Border Jurisdiction
Online harassment frequently involves perpetrators and platforms located outside India. The IT Act’s jurisdictional provisions apply to offences involving a computer resource located in India, but this formulation leaves significant uncertainty where the perpetrator, the platform’s servers, and the victim are in different jurisdictions. The absence of clear bilateral or multilateral frameworks for mutual legal assistance in cybercrime matters compounds this difficulty, rendering many harassment incidents effectively beyond the reach of Indian law enforcement.
D. Enforcement Deficiencies and Victim Barriers
Police forces across India remain largely ill-equipped to investigate cybercrime. Specialised cyber cells exist in metropolitan areas, but their capacity is limited relative to caseload, and awareness of applicable legal provisions among first responders is inconsistent. Many victims, particularly women and young people, report reluctance to approach law enforcement for fear of stigmatisation, re-traumatisation, or disbelief.[17] The legal system’s general design around the accused’s rights, without corresponding procedural protections for victims of online abuse, reflects an institutional gap that standalone cyberbullying legislation has the capacity to address.[18]
IV. Comparative Perspectives
A. The United Kingdom
The United Kingdom has enacted the Online Safety Act 2023, the most comprehensive legislative response to online harm in any major common law jurisdiction. The Act introduces a statutory duty of care on regulated service providers, requiring platforms to take proactive steps to protect users from a range of harms including harassment, hate speech, and non-consensual intimate image sharing.[19] Platforms are required to conduct risk assessments, implement safety measures proportionate to identified risks, and ensure accessible and effective user reporting mechanisms. The Act also creates new standalone criminal offences, including the sending of false information and cyber flashing.[20]
The duty of care model is significant because it shifts the regulatory logic from reactive removal of reported content to proactive harm prevention. The Office of Communications is empowered to impose substantial financial penalties for non-compliance. This enforcement architecture offers an instructive model for India.
B. Australia
Australia has adopted a regulatory model centred on an independent eSafety Commissioner with broad powers to investigate complaints, issue removal notices, and impose civil penalties on platforms and individuals. The Online Safety Act 2021 (Cth) and its subsequent amendments provide a graduated framework of obligations, including a basic online safety expectations regime that requires platforms to take reasonable steps to minimise serious online harms. Crucially, the Australian framework extends to adult victims of cyber abuse as a distinct category, not limited to sexual content, and allows the Commissioner to act swiftly where platforms fail to respond to complaints within specified timescales.[21]
C. The European Union
The European Union’s Digital Services Act (DSA) establishes a comprehensive framework of obligations for online intermediaries graduated according to their size and risk profile. Very large online platforms are required to conduct systemic risk assessments covering, among other things, the amplification of harmful content and its effects on fundamental rights. The DSA’s transparency and accountability requirements, combined with its enforcement by national Digital Services Coordinators and the European Commission, create a regulatory architecture of considerable depth.[22]
The comparative survey reveals a convergence around several principles: proactive platform obligations rather than purely reactive removal duties; independent regulatory enforcement with meaningful financial consequences; victim-accessible reporting mechanisms; and standalone definitions of specific online harms. These principles offer clear guidance for Indian legislative reform.
V. Constitutional Dimensions
Any reform of India’s online safety regime must engage with Article 19(1)(a) of the Constitution, which guarantees every citizen the right to freedom of speech and expression.[23] Restrictions on this right are permissible under Article 19(2) only on specified grounds, including decency, morality, and the sovereignty and integrity of India. It is submitted that a carefully drafted cyberbullying statute, targeting severe and targeted harassment rather than merely offensive expression, falls within the permissible restrictions of Article 19(2).
The constitutional case for reform is strengthened by Article 21, which the Supreme Court has interpreted to encompass a right to live with dignity and, following the Puttaswamy judgment, a right to informational privacy.[24][25] Cyberbullying and online harassment directly impair these rights. The state therefore bears a positive constitutional obligation to take reasonable legislative and regulatory measures to protect individuals from such interference, subject to the requirement that any restriction on expression be proportionate and clearly defined.
The striking down of § 66A in Shreya Singhal illustrates the constitutional risk of overbroad drafting. That provision used terms such as ‘grossly offensive’ and ‘menacing character’ without adequate definition, enabling its misuse against legitimate political speech. A future cyberbullying statute must define its scope with precision, incorporating criteria such as the severity, persistence, and targeting of the conduct, to avoid chilling effects on protected expression.
VI. Proposals for Reform
The foregoing analysis supports a multi-layered approach to reform. The Law Commission of India and Parliamentary Standing Committees have on previous occasions recommended legislative action in this area, and those recommendations have remained unimplemented.[26][27] This article submits that further delay is unjustifiable.
First, Parliament should enact a dedicated Online Safety and Cyberbullying Act that establishes a statutory definition of cyberbullying and online harassment encompassing persistent, targeted digital conduct that causes or is likely to cause significant harm to the victim. The Act should create standalone criminal offences for categories of severe conduct, including doxxing, sustained coordinated harassment, and non-consensual intimate image sharing, with penalties calibrated to the gravity of harm rather than the technical mechanism of its commission.
Second, the Act should establish a statutory Online Safety Authority, modelled on the Australian eSafety Commissioner, with powers to receive and investigate victim complaints, issue platform removal notices enforceable within defined time limits, and impose proportionate civil penalties for non-compliance. The Authority should be resourced and empowered to act in emergency cases involving imminent harm to an identifiable victim.
Third, platform obligations should be elevated from the current notice-and-compliance model to a proactive duty of care. Regulated platforms above a defined user threshold should be required to conduct annual risk assessments identifying how their design features and algorithms may facilitate or amplify harassment, and to implement proportionate safety measures. These obligations should be enforceable by the Online Safety Authority with meaningful financial consequences for non-compliance.
Fourth, victim-centric procedural reforms should be introduced. These should include mandatory anonymisation of victim identities in all proceedings, specialised adjudicatory procedures analogous to those in POCSO cases, and a streamlined mechanism for courts to issue emergency protection orders requiring immediate content removal and restraining further contact. Trained cyber-crime prosecutors and police officers with dedicated mandates are essential to close the enforcement gap.
VII. Conclusion
The digital sphere has become an indispensable part of modern life, shaping communication, education, employment, political participation, and social interaction for millions of Indians. Yet the law continues to treat many forms of online abuse as isolated incidents rather than manifestations of a broader and evolving threat. Cyberbullying and online harassment are not merely technological problems; they are infringements upon dignity, privacy, autonomy, and equal participation in public life. When victims are forced to withdraw from online spaces out of fear, intimidation, or sustained abuse, the promise of a free and inclusive digital society is fundamentally compromised.
The existing legal framework, dispersed across multiple statutes and regulatory instruments, struggles to respond to the realities of anonymous harassment, coordinated abuse campaigns, platform-driven amplification, and cross-border misconduct. As digital interactions become increasingly central to everyday life, the costs of legal inaction continue to rise. Effective protection cannot depend upon fragmented remedies, delayed enforcement, or the goodwill of private platforms. It requires a coherent legal architecture that recognizes online harm as a distinct category of injury deserving of clear definitions, meaningful remedies, and institutional accountability.
The challenge before India is not whether online safety and free expression can coexist, but whether the legal system can evolve quickly enough to protect both. A digital democracy cannot remain truly democratic when participation itself becomes a source of vulnerability. Ensuring safety, dignity, and accountability in online spaces is therefore not simply a matter of regulatory reform; it is a prerequisite for preserving the constitutional values that underpin the digital public sphere.
Reference(S):
Cases
Donoghue v Stevenson [1932] AC 562 (HL).
Jacob Mathew v State of Punjab (2005) 6 SCC 1.
Justice K S Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.
Ritu Kohli v Manish Vyas (2000) (Delhi).
Shreya Singhal v Union of India AIR 2015 SC 1523.
Vishaka v State of Rajasthan (1997) 6 SCC 241.
Legislation
Bharatiya Nyaya Sanhita 2023 (India).
Constitution of India.
Digital Services Act (EU) 2022/2065.
Information Technology Act 2000 (India).
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India).
Online Safety Act 2023 (UK).
Online Safety and Cybercrime Act 2024 (Australia) (Cth).
Protection of Children from Sexual Offences Act 2012 (India).
Secondary Sources
Internet and Mobile Association of India (IAMAI), India Internet Report 2023 (IAMAI, 2023).
Law Commission of India, Report No 267, ‘Hate Speech’ (Ministry of Law and Justice 2017).
National Crime Records Bureau, Crime in India 2022 (Ministry of Home Affairs 2023).
Parliamentary Standing Committee on Information Technology, ‘Safeguarding Citizens’ Rights and Prevention of Misuse of Social/Online News Media Platforms’ (Lok Sabha Secretariat 2021).
UNESCO, Behind the Numbers: Ending School Violence and Bullying (UNESCO, 2019).
Debarati Halder and K Jaishankar, Cyber Crime and the Victimization of Women: Laws, Rights and Regulations (IGI Global 2012).
Payal Arora and Usha Raman, ‘Gendering the Digital: The Inter§’s of Gender, Technology and Law in India’ (2019) 13 Asian Journal of Law and Society 201.
Pavan Duggal, Cybersecurity Law in India (LexisNexis India 2021).
Software
Google, NotebookLM
[1]Internet and Mobile Association of India (IAMAI), ‘India Internet Report 2023’ (IAMAI, 2023) 12.
[2]National Crime Records Bureau, Crime in India 2022 (Ministry of Home Affairs 2023) Table 17A.
[3]UNESCO, ‘Behind the Numbers: Ending School Violence and Bullying’ (UNESCO, 2019) 22.
[4]Committee on the Elimination of Discrimination against Women, General Recommendation No 35 on Gender-Based Violence against Women (CEDAW/C/GC/35, 2017) [20].
[5]Information Technology Act 2000 (India), s 66A (struck down in Shreya Singhal v Union of India AIR 2015 SC 1523).
[6]Information Technology Act 2000 (India), s 66C (identity theft) and s 66D (cheating by personation).
[7]Information Technology Act 2000 (India), s 67 (publishing obscene material), s 67A (sexually explicit acts), s 67B (child sexual abuse material).
[8]Information Technology Act 2000 (India), s 72 (breach of confidentiality and privacy).
[9]Bharatiya Nyaya Sanhita 2023 (India), s 351 (criminal intimidation), s 74 (assault or use of criminal force on a woman with intent to outrage her modesty).
[10]Bharatiya Nyaya Sanhita 2023 (India), s 79 (word, gesture or act intended to insult the modesty of a woman).
[11]Bharatiya Nyaya Sanhita 2023 (India), s 77 (voyeurism) and s 77A (stalking by electronic communication).
[12]Protection of Children from Sexual Offences Act 2012 (India), ss 11–14.
[13]Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India), Rule 4(2).
[14]ibid, Rule 3(1)(b).
[15]ibid, Rule 4(1)(d) (requirement for significant social media intermediaries to appoint a Grievance Officer in India).
[16]Shreya Singhal v Union of India AIR 2015 SC 1523 [95]–[96] (Supreme Court of India, striking down s 66A on grounds of overbreadth and chilling effect on free speech).
[17]Ritu Kohli v Manish Vyas (2000) (Delhi) (one of the earliest cases of cyber-stalking in India, predating dedicated legislative provisions).
[18]Vishaka v State of Rajasthan (1997) 6 SCC 241 (establishing constitutional obligations to protect women from harassment before dedicated legislation existed).
[19]Online Safety Act 2023 (UK), s 179 (definition of cyberflashing as a standalone criminal offence).
[20]Online Safety Act 2023 (UK), ss 6–10 (duties of care imposed on regulated services); Explanatory Notes, [12]–[18].
[21]Online Safety and Cybercrime Act 2024 (Australia) (Cth); eSafety Commissioner, ‘Adult Cyber Abuse Scheme’ <www.esafety.gov.au> accessed 10 June 2026.
[22]Digital Services Act (EU) 2022/2065, Arts 14–17 (notice and action mechanisms), Arts 33–34 (systemic risk assessments for very large online platforms).
[23]Constitution of India, Art 19(1)(a) (freedom of speech and expression); Art 19(2) (permissible restrictions).
[24]Constitution of India, Art 21 (right to life and personal liberty as interpreted to include right to privacy: Justice K S Puttaswamy (Retd) v Union of India (2017) 10 SCC 1).
[25]Justice K S Puttaswamy (Retd) v Union of India (2017) 10 SCC 1 [164]–[185] (Chandrachud J, on the right to informational privacy as a fundamental right).
[26]Law Commission of India, Report No 267, ‘Hate Speech’ (Ministry of Law and Justice 2017) 75–79 (recommending targeted legislative amendments to address online abuse).
[27]Parliamentary Standing Committee on Information Technology, ‘Safeguarding Citizens’ Rights and Prevention of Misuse of Social/Online News Media Platforms’ (Lok Sabha Secretariat 2021) Recommendation 8.
