Introduction
The migration of social life to digital platforms has created a new geography of harm. Bullying that once required physical proximity now reaches across cities and countries through a smartphone screen. Harassment that previously ended when the victim left a particular space now follows them into their bedroom, their workplace, and their family life through the constant accessibility of digital communication. Intimate images shared in trust are weaponised in betrayal through channels that reach thousands instantly and remain accessible indefinitely. For adolescent girls in particular, the intersection of online connectivity and offline social pressure creates a landscape of harm that existing legal frameworks have been slow to map and slower to address.
India’s Bharatiya Nyaya Sanhita 2023 contains provisions that are applicable to various forms of online harassment, but these provisions were not designed as a comprehensive framework for the range of harms that digital platforms enable. They are instead a collection of provisions designed for other primary purposes, assembled from the older IPC framework, that can be applied to cyberbullying and online harassment with varying degrees of fit. The result is a patchwork that leaves significant gaps, creates jurisdictional and definitional uncertainty, and fails to engage with the specific characteristics of platform-enabled harm, including its scale, its persistence, and the role of intermediary companies in enabling or preventing it.
This article examines the available legal framework, the gaps in it, and the case for dedicated online harassment legislation modelled on international experience.
Legal Framework
The BNS 2023 contains several provisions relevant to online harassment. Section 351 addresses criminal intimidation, defined as threatening a person with injury to cause that person to do what they are not legally bound to do or to omit what they are legally bound to do. This provision applies to online threats, including threats made through social media, messaging applications, and email. However, the provision requires the threat to be aimed at causing injury to the person, their reputation, or property, and the threatened person must be shown to have been in fear.
Section 78 BNS addresses stalking, including cyberstalking. The provision criminalises following a person, contacting or attempting to contact them, monitoring internet or email use or any other form of electronic communication, or exhibiting any other interest in them against the person’s express wishes. The inclusion of electronic monitoring and contact in the definition of stalking is an improvement over the IPC framework, but the provision applies primarily to the conduct of an individual rather than to the use of platforms to organise harassment by multiple persons, which is a characteristic of coordinated online abuse.
Section 79 BNS addresses voyeurism, covering the filming of intimate acts without consent, which encompasses a form of image-based abuse. Section 354D of the old IPC, corresponding to Section 78 BNS, addressed online stalking as part of the stalking offence. The retention and expansion of these provisions in the BNS is positive but does not constitute a comprehensive framework.
The Information Technology Act 2000 provides additional provisions. Section 66E addresses violations of privacy by capturing, transmitting, or publishing images of a person’s intimate parts without consent, prescribing imprisonment up to three years and fine. Section 67A addresses publishing or transmitting obscene or sexually explicit content electronically. Section 67B specifically addresses child sexual abuse material online, which is one of the most serious forms of digital harm to children.
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 impose obligations on significant social media intermediaries to establish grievance redressal mechanisms and to take action on complaints of harassment, non-consensual content, and other harmful material. However, these are primarily regulatory obligations for platforms rather than criminal provisions aimed at perpetrators, and compliance has been uneven.
Judicial Developments
Indian courts have addressed cyberbullying and online harassment in a number of contexts. Several High Courts have issued orders directing platforms to remove defamatory or harassing content on the basis of applications by victims, using their jurisdiction under Article 226 of the Constitution and the inherent jurisdiction to prevent harassment. The Delhi High Court has been particularly active in passing orders against coordinated online harassment of journalists, activists, and public figures.
The Supreme Court’s intervention in Shreya Singhal v. Union of India (2015), while primarily directed at Section 66A of the IT Act (which was struck down for overbreadth and chilling effect on free speech), also clarified the framework for distinguishing between protected speech and unprotected harmful communication online. The Court held that mere discussion or advocacy of ideas, however controversial, does not constitute incitement, and that criminal liability for online speech must be tied to conduct that creates a real and imminent risk of harm.
More recent jurisprudence has addressed deepfake content and non-consensual intimate image sharing. Several High Courts have issued interim orders directing platforms to remove deepfake videos of identifiable individuals, recognising that the absence of a specific offence does not preclude judicial protection through injunctions. However, the absence of a specific criminal provision means that perpetrators of deepfake intimate image abuse are prosecuted, if at all, under the IT Act’s obscenity provisions, which do not fully capture the harm of image-based sexual abuse against a specific person.
The National Commission for Women has issued advisories and recommendations on online harassment of women, and the Ministry of Women and Child Development has engaged with the Ministry of Electronics and Information Technology on the need for stronger legal responses. These inter-ministerial engagements have not yet produced legislation.
Contemporary Issues and Analysis
UNICEF India data and research by organisations including iCall and the Cyber Peace Foundation reveal that adolescent girls are disproportionately targeted by online harassment. The forms of harassment include impersonation, the creation of fake profiles, non-consensual sharing of intimate images (real or manipulated), coordinated abuse through mass messaging, trolling directed at social identity, and blackmail involving threatened disclosure of real or fabricated content. Each of these forms of harm presents different legal challenges and different platform-level responses.
The deepfake problem is particularly acute. The combination of widely available deepfake generation tools and the viral reach of social media means that sexually explicit manipulated images of identifiable women can be created and distributed with relative ease. India does not have a specific criminal offence for non-consensual deepfake intimate imagery. Prosecution under IT Act Section 67A for obscenity is possible but misframes the harm: the offence against the victim is not the obscenity of the content but the violation of their identity, dignity, and autonomy through the weaponisation of their likeness. This distinction matters for both the legal framework and for victim dignity in the prosecution process.
The platform intermediary dimension adds a layer of complexity that existing criminal law does not address. A perpetrator of online harassment may be anonymous, may be located in another country, or may be one of dozens of persons participating in a coordinated harassment campaign. The platform on which the harassment occurs may have effective technical capability to restrict or remove the content but may not have adequately exercised that capability. Existing criminal law addresses only the individual perpetrator, leaving the platform’s role in enabling or amplifying the harm largely unaddressed except through the grievance mechanism obligations in the IT Rules 2021.
The problem of anonymous abuse presents particular evidentiary challenges. Identifying the person behind an anonymous account requires cooperation from the platform, which may be a foreign company, and from the intermediary service providers through which they operate. The process of obtaining this information through legal process is slow and technically complex. By the time the perpetrator is identified, the harm has already been inflicted and is often irreversible. The legal framework has not effectively addressed the specific challenge of anonymous coordinated abuse.
Comparative and International Perspective
The United Kingdom’s Online Safety Act 2023 represents the most comprehensive legislative response to platform-enabled harm yet enacted in a major democracy. The Act creates specific offences including the sending of flashing images to persons with epilepsy, the sending of unsolicited sexual images (cyberflashing), and the sharing of intimate images without consent, which include deepfake intimate images. It also imposes positive duties on platforms to take proactive steps to prevent and remove harmful content, with enforcement through the Office of Communications and the possibility of significant financial penalties for non-compliance. The Act’s approach of combining new individual offences with platform-level duties represents a more complete response to online harm than focusing on either dimension alone.
Australia’s Online Safety Act 2021 established the Office of the eSafety Commissioner, an independent regulatory body with powers to direct platforms to remove harmful content, investigate complaints, and impose penalties for non-compliance. The Commissioner has used these powers in high-profile cases involving non-consensual intimate imagery and coordinated harassment, demonstrating that a dedicated regulator with specific enforcement powers can make a meaningful difference in the speed and effectiveness of takedown responses.
Germany’s Network Enforcement Act, which preceded the Online Safety Act, required platforms to remove clearly illegal content within defined timeframes and faced criticism for inducing over-removal. The subsequent refinement of the German approach, and its influence on the EU Digital Services Act 2022, illustrates the evolution of regulatory thinking from simple takedown requirements to a more nuanced risk-based framework.
The European Union’s Digital Services Act 2022, which applies to Indian users of EU-based platforms, imposes obligations on Very Large Online Platforms regarding systemic risk assessment and mitigation, including risks from coordinated harassment and non-consensual intimate imagery. Indian users are indirect beneficiaries of these obligations, but India has no equivalent domestic framework to ensure that platforms apply comparable standards to all their users.
Practical and Policy Implications
The practical significance of the legal gap is most acute for the most vulnerable victims. A teenager who is subjected to coordinated online harassment by classmates using multiple anonymous accounts faces a situation where the legal framework provides inadequate immediate remedies. The police may be unfamiliar with the technical dimensions of the complaint; the school may lack clear protocols for responding to online bullying that occurs outside school premises but affects the school environment; and the platform may have grievance mechanisms that respond within days or weeks rather than the hours within which viral harm spreads.
The mental health consequences of cyberbullying are well-documented internationally and increasingly documented in Indian research. Studies of adolescent populations have linked sustained online harassment to depression, anxiety, social withdrawal, and in severe cases self-harm. The legal system’s inability to provide timely protection and redress means that the burden of harm falls entirely on the victim and their family, with no corresponding accountability for the perpetrator or the platform.
Suggestions and Reforms
India needs a dedicated Online Harassment and Cyberbullying Act that consolidates the existing scattered provisions, fills the identified gaps, and creates a regulatory framework specifically designed for platform-enabled harm. The Act should create specific offences for non-consensual sharing of intimate images, including deepfake intimate images, distinguishable from existing obscenity provisions by focusing on the violation of the victim’s autonomy rather than the obscenity of the content. The Act should create a specific cyberflashing offence. It should provide for enhanced penalties where the victim is a minor.
A dedicated online safety regulatory authority, modelled on Australia’s eSafety Commissioner, should be established with powers to direct platforms to remove harmful content, investigate complaints, and impose penalties for non-compliance. The authority should have a specific brief for the protection of women and children from platform-enabled sexual harm.
Platform intermediaries should be required to maintain expedited removal processes for non-consensual intimate imagery, with a maximum response time of twenty-four hours for verified complaints. Non-compliance should attract regulatory penalties under the IT Act rather than merely the reputational consequences that currently motivate platform action.
Conclusion
The BNS 2023 represents a codification and modest updating of criminal law, but it does not represent a reimagining of criminal law for the digital environment. The provisions applicable to cyberbullying and online harassment are functional but inadequate for the specific harms that platform-enabled abuse produces. Adolescent girls, women journalists, activists, and others who are disproportionately targeted by online harassment are protected by a legal framework that requires them to navigate scattered provisions, slow processes, and platform grievance mechanisms that are designed more to manage reputational risk for the platform than to protect the dignity and safety of the victim. Comprehensive online safety legislation, a dedicated regulatory authority, and specific offences for image-based sexual abuse are the reforms that the scale and severity of the problem demands.
