Internet Freedom Foundation (IFF)@internetfreedom
Sound the Alarm : IFF’s First Read on MeitY's Draft IT Rules Second Amendment, 2026
New Delhi, 30 March 2026
On 30 March 2026, the Ministry of Electronics and Information Technology published proposed amendments to the IT Rules, 2021, inviting public comments by 14 April, a comment period of barely fifteen days for changes with far reaching consequences for free speech and intermediary governance in India. We have conducted a quick review of the draft amendments. Despite being presented as "clarificatory and procedural," they represent a dangerous expansion of executive power over online speech.
We wish to state at the outset that these proposed amendments need to be immediately withdrawn and every member in our citizenry should demand their roll back and stand with the Constitution of India. These proposed amendments come at a time of fear and increased government directed censorship, especially of online political speech that includes parody and satire of the government, including the Prime Minister.
In brief the five changes are listed below:
1. Rule 3(1)(g) and 3(1)(h): Insertion of phrases within existing clauses making data retention obligations under the IT Rules additional to retention requirements under any other law.
2. Rule 3(4): Insertion of a new clause that mandates intermediary compliance with MeitY-issued clarifications, advisories, directions, SOPs, codes of practice, and guidelines, making such compliance a condition for retaining safe harbour under Section 79 of the IT Act. These are not anchored to the rule making powers of the IT Act, 2000 and provide uncanalised power to MEITY despite it stating otherwise.
3. Rule 8(1) proviso: A substitution in the proviso that expands applicability of MIB’s oversight mechanism in Part III of the rules to: (1) intermediaries and (2) users who are not “publishers” and post/share news and current affairs content online. This oversight mechanism contains the blocking powers of MIB by way of Rule 14 (Inter-Departmental Committee), Rule 15 (Procedure for issuing directions to block), and Rule 16 (Emergency blocking provisions).
4. Rule 14(2) : A substitution that expands the scope of the IDC from hearing "complaints or grievances" to hearing "matters", including those referred by the Ministry of Information and Broadcasting.
5. Rule 14(5) : Replaces "complaints or grievances" with "the matter" in relation to IDC examination and recommendations.
A massive expansion of an unconstitutional censorship and regulatory power
First and most concerningly, Rule 3(4) creates a sweeping power for MeitY to issue binding instruments which are not anchored in law such as clarifications, advisories, directions, SOPs, codes of practice, and guidelines that intermediaries must comply with as a condition of safe harbour under Section 79 of the IT Act.
The Supreme Court's 2015 judgment in Shreya Singhal v. Union of India (2015) 5 SCC 1, remains the foundational precedent governing intermediary liability. It constrains the proposed amendments in several ways. First, the court read down Section 79(3)(b) to require that "actual knowledge" of unlawful content must come through a court order or government notification. Any Rule 3(4) making MeitY, "clarifications, advisories, directions, SOPs", lower the constitutional threshold for intermediary due diligence obligations.
Further, the settled principle in Indian administrative law, reaffirmed in Indian Express Newspapers v. Union of India (1985) 1 SCC 641 and Confederation of Ex-Servicemen Associations v. Union of India (2006) 8 SCC 399, is that delegated legislation must remain within the four corners of the parent statute. It is important to note that the rule-making power under Section 87(1) of the IT Act is confined to, "carry[ing] out the provisions" of the Act. Section 87(2)(zg) authorizes rules for intermediary guidelines under Section 79(2), and Section 87(2)(z) for blocking procedures under Section 69A(2). Justice Chandurkar's judgement in the Kunal Kamra case clearly found the FCU amendment was not properly referable to either provision. Hence, any Rule 3(4) mandating compliance with MeitY advisories would face identical challenges since they create substantive new obligations not contemplated by Sections 79 or 87.
Even though Rule 3(4)(b)(ii) states that such, “advisories” etc. need to, “clearly specify the statutory provision or legal basis under which it is issued”, since these are not required to be published or made public there is every likelihood these will be issued with secrecy and hence may just in a tautological manner refer back to Section 79(3)(b) of the IT Act. This is similar to a logical fallacy in which it is clearly observable that a student is cheating on an exam who then claims that they may be permitted to continue cheating since they are stating at the same time they are not cheating.
The practical effect of Rule 3(4) is that intermediaries face a perpetual compliance threat. Any failure to comply with any MeitY-issued instrument, however vague, however rapidly issued may cost them their safe harbour. The response for an intermediary is over-compliance and over-censorship.
Circumventing existing stay orders
The original proviso to Rule 8(1) stated that Part III applied to intermediaries only "for the purposes of rules 15 and 16" i.e., content blocking directions and emergency blocking. The amended proviso now extends this to Rule 14, bringing intermediaries and user-generated news/current affairs content under the jurisdiction of the Inter-Departmental Committee.
Under Rules 9(1) and 9(3) of the 2021 IT Rules, there is a Code of Ethics compliance requirement and the three-tier grievance redressal mechanism, both of which were stayed by the Bombay High Court on 14 August 2021 as prima facie violative of Article 19(1)(a) and ultra vires the IT Act. On the oversight mechanism in Rules 14, 15, and 16, the Bombay High Court granted the petitioners to seek relief on this rule when an Inter Departmental Committee is established. The Madras High Court affirmed this stay as having pan-India effect in its order of 16 September 2021 in T.M. Krishna v. Union of India, observing that "an oversight mechanism to control the media by the government may rob the media of its independence."
Both these cases, along with other cases challenging various provisions of the 2021 IT Rules, are now pending adjudication before the Delhi High Court.
The expansion of Rule 8(1) to cover Rules 14, 15, and 16 is an attempt to expand the blocking powers of MIB to both intermediaries and users who are not “publishers” but post news and current affairs content online. The IDC can now examine "matters" relating to user-generated news content on intermediary platforms without the Code of Ethics framework having been adjudicated as constitutional; the government effectively obtains the content oversight machinery that three High Courts found illegal, through a different procedural door.
Transforming the IDC from Grievance Body to Censorship Apparatus
The original Rule 14(2) required the IDC to hear "complaints regarding violation or contravention of the Code of Ethics." The amended version removes this requirement entirely.
The IDC now hears:
(a) grievances arising from decisions at Level I or II; or
(b) "matters" referred to by the Ministry.
Clause (b) is unconstrained since, (a) there is no requirement that the "matter" arise from a complaint, (b) no requirement that the "matter" relate to a Code of Ethics violation; and (c) no requirement that the affected party be heard before the referral. The Ministry of Information and Broadcasting can, on its own motion, refer any content-related "matter" to the IDC.
The cumulative effect of the amendments to Rules 8 and 14 is to reconstruct the oversight machinery that the Bombay and Madras High Courts found constitutionally suspect, in a form designed to evade the existing interim orders. The IDC, previously limited to the three-tier complaints process under the stayed Rules 9(3), 12, and 13 framework, now operates as a free-standing censorship committee that can take up "matters" referred by the executive.
Increased user surveillance through mandatory data retention directions
Insertion of phrases within existing clauses making data retention obligations under the IT Rules additional to retention requirements under any other law. For instance, the mandatory data retention of user data beyond 180 days within Rule 3(1)(g) and 3(1)(h) may be prescribed for longer periods and other purposes raising risks of surveillance and even potentially data leaks of sensitive data that is stored for longer periods of time. Government mandates for data retention as to their legal authority and hence period of retention will be beyond those contained under the IT Act.
SOS for Digital Rights
IFF urges an urgent rollback!
We are alarmed by the continuing expansion of unchecked executive power that is opposed to the Constitution of India. The present actions of MEITY smack of digital authoritarianism and we call on them to withdraw these proposed amendments.
The proper course is to await judicial determination of the pending challenges, respect interim protections granted by constitutional courts, and pursue regulatory objectives through parliamentary legislation rather than subordinate instruments that exceed the parent statute.
If not withdrawn, IFF will file a detailed response before the comment deadline. We call upon all stakeholders to submit their objections before 14 April 2026 at itrules.consultation@meity.gov.in
