Internet Law in India: Online Rights, Cybercrime, Intermediaries and Digital Disputes

Introduction

The internet has become part of everyday commercial, professional and personal activity. Websites, social-media platforms, online marketplaces, digital payments, cloud services, domain names, mobile applications and user-generated content can create legal issues involving contracts, privacy, intellectual property, cybercrime, consumer protection, intermediary liability and electronic evidence.

Internet law in India is therefore not contained in one statute. The Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 form an important part of the framework, while other laws apply according to the subject matter and conduct involved.

What is internet law?

Internet law is a broad description for legal rules that apply to conduct involving online platforms, digital communications and internet-enabled services. It can include rules concerning electronic records and signatures, cyber offences, intermediary due diligence, online content, privacy, intellectual property, e-commerce, digital contracts and civil or criminal remedies.

The same online incident can involve several legal questions. For example, a fake website using a company’s trademark may raise trademark and passing-off issues, while the manner in which the website was created or used may also raise cybercrime questions. The appropriate legal analysis therefore depends on the actual facts.

Major areas covered by internet law in India

• cybercrime and unauthorised access;
• electronic records and digital evidence;
• intermediary liability and due diligence;
• online speech and unlawful content;
• privacy and personal-data protection;
• online contracts and electronic signatures;
• e-commerce and consumer protection;
• trademark, copyright and domain-name disputes;
• online financial fraud and digital payments;
• online impersonation and identity theft;
• advertising and digital marketing compliance; and
• jurisdiction and enforcement in cross-border disputes.

Information Technology Act, 2000

The Information Technology Act, 2000 is a central statute for several aspects of Indian internet law. It provides legal recognition to electronic records and electronic signatures and contains provisions dealing with computer-related offences, compensation, intermediary liability, blocking of information, protected systems and cyber-security institutions.

The Act should not, however, be read as a complete code for every online dispute. Contract law, intellectual-property statutes, consumer law, criminal law, data-protection law and other legislation can apply depending on the facts.

Cyber offences committed through the internet

Online conduct can constitute an offence where the statutory ingredients are satisfied. Common examples include identity theft, cheating by personation using computer resources, unauthorised access, dishonest or fraudulent computer-related acts, online financial fraud and unlawful publication or transmission of specified material.

The Bharatiya Nyaya Sanhita, 2023 may also apply where online conduct satisfies offences under the general criminal law, such as cheating, personation, forgery, criminal intimidation or other offences. A complaint should therefore describe the actual conduct and available evidence rather than relying only on a general label such as “internet crime”.

Electronic contracts and online agreements

Businesses regularly enter into agreements through websites, applications, emails and electronic platforms. Indian law recognises electronic records subject to applicable statutory requirements, and contracts formed electronically can be legally significant.

Online terms should be drafted so that users can reasonably access and understand the contractual conditions. Businesses should maintain appropriate records showing the version of terms presented, the user’s acceptance where relevant, transaction details and other evidence capable of establishing the contractual relationship.

Electronic signatures

Electronic signatures can have legal validity when used in accordance with the applicable statutory framework. The legal effect depends on the type of electronic authentication, the document, the parties and any applicable exclusions or formal requirements.

Businesses should distinguish between an ordinary electronic acceptance, a digital signature and other forms of electronic authentication. A legally significant transaction may require a particular form of execution or additional formalities.

Intermediaries and online platforms

Internet platforms may qualify as intermediaries under the Information Technology Act depending on their role and the statutory definition. The IT Rules, 2021 prescribe due-diligence obligations for intermediaries and additional requirements for significant social media intermediaries and other specified entities.

The availability of statutory safe-harbour protection is subject to the conditions prescribed by law. An intermediary should not assume that the mere fact that it hosts third-party content automatically resolves every question of liability.

Intermediary due diligence

Due diligence requirements can include publication of rules and policies, grievance-redressal mechanisms, specified obligations concerning unlawful information, cooperation with lawful directions and additional requirements for certain categories of intermediaries.

The exact obligations depend on the intermediary’s classification and the applicable version of the Rules. Businesses operating platforms should therefore review the provisions actually in force rather than relying on summaries of older versions.

Recent development: 2026 amendments to the IT Rules

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 introduced additional due-diligence requirements concerning synthetically generated information, commonly associated with AI-generated or manipulated content. The framework addresses definitions, user awareness, labelling or identification of permitted synthetically generated information and additional obligations for significant social media intermediaries.

The amended framework also addresses timelines for specified compliance and grievance processes. The Ministry of Electronics and Information Technology has published explanatory material describing these changes. Platforms and users should therefore distinguish the current notified rules from earlier draft proposals and consultation material.

The legal significance of AI-generated content can extend beyond intermediary compliance. Depending on the content and its use, issues concerning impersonation, privacy, copyright, trademark, defamation, fraud or other unlawful conduct may arise.

Online content and unlawful information

Not every offensive, inaccurate or disputed online statement automatically creates the same legal consequence. The relevant question may involve defamation, privacy, intellectual property, impersonation, threats, obscenity, fraud, contempt, unlawful disclosure or another statutory category.

A person seeking removal of online content should preserve the content and surrounding circumstances before requesting its removal where possible. Screenshots, URLs, account identifiers, timestamps, copies of communications and other relevant records can help establish what was published and when.

Defamation on social media

Statements published online can potentially give rise to defamation proceedings where the legal requirements are satisfied. The fact that a statement is posted on social media does not create a separate universal rule for defamation.

Context matters. A statement of fact, opinion, satire, allegation or reproduction of another statement may raise different legal questions. Defences and statutory exceptions also need to be considered rather than assuming that every disputed statement is actionable.

Online impersonation

Impersonation can occur through fake social-media accounts, websites, email addresses, messaging accounts or other digital identities. It can cause financial loss, reputational harm and confusion among customers or contacts.

Evidence should include the account or website address, screenshots, messages, payment requests, registration information where available and communications with the platform. If a trademark is being misused, the incident may also involve intellectual-property remedies.

Domain names and internet law

Domain names can have substantial commercial value and may become the subject of disputes where they are identical or confusingly similar to a trademark or established business identity.

A domain-name dispute may involve trademark infringement, passing off, contractual or administrative procedures and, in appropriate cases, civil proceedings. The legal assessment should consider the domain name, the nature of the website, the relevant trademark rights, actual use and the surrounding circumstances.

Online trademark infringement

Trademark infringement can occur in online environments where the statutory requirements are satisfied. Examples may include unauthorised use of a registered mark on a website, marketplace listing, advertisement, social-media account, domain name or other commercial communication.

Online use should be assessed in context. Merely displaying a word online does not automatically establish trademark infringement; the nature of the use, the rights relied upon, the goods or services and the applicable statutory provisions are relevant.

Copyright and internet content

Websites contain photographs, videos, text, graphics, software, music, illustrations and other material that may be protected by copyright. Copying or communicating protected material online can raise infringement questions depending on the nature and extent of the use and any applicable statutory exception.

Website owners should maintain records showing ownership or lawful licensing of material published online. Creators should similarly preserve original files, dated records and agreements with employees, agencies or contractors where ownership is relevant.

Online privacy and personal data

Internet businesses routinely collect personal information through registration forms, applications, cookies, analytics systems, payment processes and customer-support channels. Privacy compliance requires consideration of what data is collected, why it is processed, who receives it, how it is secured and how long it is retained.

The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 form an important part of India’s current data-protection framework, subject to their respective commencement provisions. Sector-specific requirements and contractual obligations may also apply.

Online shopping and e-commerce

E-commerce transactions can raise questions concerning contracts, product information, pricing, refunds, delivery, warranties, consumer rights, unfair trade practices, privacy and payment security.

An online seller should ensure that product descriptions and material terms are accurate and that the platform’s policies are consistent with applicable law. Consumers should preserve order confirmations, invoices, payment records, communications and product information where a dispute arises.

Consumer disputes involving online platforms

Consumers can face disputes involving defective goods, deficient services, misleading representations, cancellation, refund or non-delivery. The Consumer Protection Act, 2019 and rules made under it can be relevant depending on the transaction.

Online grievance mechanisms should generally be used where appropriate, but their use does not prevent a consumer from considering other remedies available under law. The appropriate forum depends on the transaction, parties and relief sought.

Online advertising and digital marketing

Digital advertising can involve trademark use, consumer-protection rules, privacy issues, contractual arrangements and sector-specific advertising restrictions. Businesses should ensure that material claims made in advertisements are capable of being substantiated where required.

Influencer marketing and affiliate arrangements can also require disclosure and contractual clarity. The precise requirements depend on the nature of the product, platform, relationship and applicable rules.

Online financial fraud

Internet-based payment fraud can involve phishing, remote-access scams, fake investment platforms, impersonation, unauthorised transactions and fraudulent payment requests.

Prompt action is important. Relevant material can include transaction references, UTR numbers, bank statements, messages, phone numbers, email addresses, URLs, screenshots and records of communications with the bank or payment provider.

Digital evidence in internet disputes

Electronic evidence may include emails, chats, social-media posts, website pages, server logs, IP information, account records, payment records, CCTV footage and electronic documents. The evidentiary value of such material depends on authenticity, integrity, source, preservation and the requirements governing electronic records.

The Bharatiya Sakshya Adhiniyam, 2023 contains provisions concerning electronic and digital records. Parties should therefore avoid unnecessary alteration or deletion of relevant material after a dispute arises.

Preserving website and social-media evidence

Where an online dispute is likely to result in proceedings, evidence should be preserved promptly. A useful record may include:

• the complete URL;
• date and time of access;
• screenshots or screen recordings where appropriate;
• account or profile identifiers;
• copies of relevant emails or messages;
• payment and transaction records;
• source documents and downloaded files where legally appropriate; and
• records showing subsequent changes or removal of the content.

Preservation should be carried out in a manner consistent with applicable evidentiary requirements and, where necessary, appropriate forensic procedures.

Cross-border internet disputes

The internet allows parties in different jurisdictions to interact easily. A dispute may therefore involve an Indian user, a foreign platform, a foreign server and a transaction conducted in India.

Questions of jurisdiction, applicable law, service of process, evidence located abroad and enforceability of orders can become important. The presence of a website accessible in India does not automatically resolve every jurisdictional issue.

Jurisdiction in online disputes

Jurisdiction depends on the cause of action, parties, statutory provisions and the facts establishing the connection with a particular forum. In an internet dispute, relevant facts may include where the claimant resides or carries on business, where the transaction occurred, where harm was suffered and where the defendant conducts relevant activities.

Courts may apply specific statutory rules depending on the nature of the proceeding. Jurisdiction should therefore be assessed before commencing proceedings rather than inferred merely from the accessibility of a website.

Online harassment and cyberstalking

Repeated unwanted digital communication, threats, impersonation or monitoring can raise criminal and civil issues depending on the conduct. Evidence should be preserved rather than deleted simply because it is distressing or unwanted.

Victims should record dates, account identifiers, messages, calls and other relevant information. Where there is an immediate threat to safety, appropriate law-enforcement assistance should be sought promptly.

Children and online platforms

Online services used by children require particular attention to privacy, safety and age-related requirements. The DPDP Act contains specific provisions concerning children’s personal data, while platform obligations may also arise under the IT Rules and other applicable law.

Businesses should avoid collecting more information than necessary and should design age-related processes with applicable legal requirements in mind.

Artificial intelligence and internet law

Generative AI has created new internet-law questions concerning synthetic images, audio, video and text. The same content may raise multiple issues, including impersonation, privacy, copyright, trademark, defamation and consumer deception.

The 2026 IT Rules amendments introduced additional requirements concerning synthetically generated information. Organisations using or enabling AI-generated content should therefore review platform obligations, user disclosures, content controls and record-keeping requirements applicable to their role.

Online platforms and grievance redressal

The IT Rules require specified intermediaries to maintain grievance mechanisms. Users should identify the relevant grievance process and preserve the complaint and response where an issue concerns content removal, account access or another platform decision.

The Ministry has also established Grievance Appellate Committees under the IT Rules framework. The availability and scope of a particular remedy depends on the platform, decision and applicable rules.

Cyber security and internet law

Cyber security is closely connected with internet law but is not identical to it. A security breach may involve the Information Technology Act, data-protection requirements, contractual obligations and criminal law at the same time.

Businesses should maintain appropriate access controls, authentication, backups, incident-response procedures, vendor controls and employee awareness. A documented response plan can also assist in preserving evidence and assessing reporting obligations.

Online business terms and website policies

Businesses operating websites or applications commonly use privacy policies, terms of use, refund policies, shipping terms, cookie notices and other documents. These documents should accurately reflect actual business practices.

A website policy should not promise a process that the business does not follow. Material contractual terms should also be presented in a manner that gives users a reasonable opportunity to understand the transaction and applicable conditions.

Common internet-law mistakes

• Assuming that everything published online is free to copy.
• Assuming that a domain name automatically creates trademark rights.
• Deleting evidence before preserving the original material.
• Using customer data for a new purpose without reviewing the applicable framework.
• Ignoring intermediary grievance mechanisms.
• Failing to document online transactions and electronic acceptance.
• Assuming that a foreign platform cannot be subject to Indian legal proceedings.
• Using another person’s photograph, logo or content without checking rights.
• Failing to secure business email, cloud and social-media accounts.
• Relying on old summaries of the IT Rules without checking current amendments.

Practical internet-law checklist for businesses

1. Identify the online services and platforms used by the business.
2. Record ownership of domain names and digital accounts.
3. Review trademarks and copyrighted material used online.
4. Maintain suitable website terms and privacy notices.
5. Map personal-data collection and processing.
6. Review vendor and cloud-service contracts.
7. Implement account-security and access controls.
8. Maintain an incident-response process.
9. Preserve electronic evidence when a dispute arises.
10. Monitor relevant changes to internet and data-protection law.

When a legal dispute arises online

The first step is usually to identify the legal right or obligation affected. A dispute involving a hacked account may require a cybercrime response, while a copied photograph may primarily involve copyright, and a misleading online brand may involve trademark or passing-off law.

Once the legal issue is identified, the evidence, jurisdiction, limitation period and available remedies can be assessed. Depending on the circumstances, remedies may include platform complaints, statutory complaints, criminal proceedings, civil injunctions, damages, contractual relief or other appropriate orders.

Documents that may be relevant

Depending on the dispute, relevant material may include contracts, website terms, privacy notices, invoices, emails, chats, screenshots, URLs, domain records, trademark certificates, copyright records, transaction details, bank statements, server logs, access records, incident reports and correspondence with online platforms.

Frequently Asked Questions

1. What is internet law in India?

Internet law is a broad field covering legal issues arising from online activity, including cybercrime, electronic contracts, intermediary liability, privacy, intellectual property, e-commerce and digital evidence.

2. Is there one Internet Law Act in India?

No. The Information Technology Act, 2000 is a principal statute, but several other laws can apply to online conduct depending on the subject matter.

3. What is an intermediary?

An intermediary is a person or entity described within the statutory definition in the Information Technology Act in relation to receiving, storing or transmitting electronic records or providing specified services. Classification depends on the facts and statutory requirements.

4. What is intermediary safe harbour?

Section 79 of the Information Technology Act provides a statutory framework limiting intermediary liability in specified circumstances, subject to the conditions and due-diligence requirements contained in law.

5. Can a social-media platform be legally required to remove content?

Removal obligations can arise under applicable law and the IT Rules, including through specified legal directions or due-diligence processes. The precise route depends on the content and circumstances.

6. What should I do if someone creates a fake account in my name?

Preserve the profile URL, screenshots, messages and other evidence, report the account through the relevant platform process and consider an appropriate cybercrime or legal complaint depending on the conduct.

7. Can a domain name infringe a trademark?

A domain name can form part of a trademark or passing-off dispute where the legal requirements are satisfied. The actual use of the domain and the relevant rights must be examined.

8. Can I use photographs found on the internet?

Not automatically. A photograph may be protected by copyright, and permission, a valid licence or a statutory exception may be necessary depending on the intended use.

9. Are online contracts valid in India?

Electronic contracts can be legally significant where the requirements of contract law and applicable electronic-record provisions are satisfied. The transaction and method of acceptance should be examined.

10. Is an email legally valid evidence?

An email can constitute electronic evidence. Its evidentiary value depends on authenticity, source, integrity and compliance with the applicable rules governing electronic records.

11. What are the 2026 IT Rules amendments about?

The 2026 amendments strengthen certain intermediary due-diligence requirements concerning synthetically generated information and introduce additional provisions relating to labelling, user awareness, verification and specified compliance timelines.

12. Do the IT Rules apply to every website?

The applicability depends on whether an entity falls within the relevant statutory and regulatory categories. The obligations differ according to the type and role of the entity.

13. Can online statements result in defamation proceedings?

Potentially, if the legal requirements for defamation are satisfied. The statement, context, publication, identification, harm and applicable exceptions or defences may all be relevant.

14. What is digital evidence?

Digital evidence includes electronic information capable of being relevant to a legal proceeding, such as emails, chats, logs, digital documents, social-media records and transaction records.

15. Should I delete a fraudulent message after taking a screenshot?

It is generally preferable to preserve the original electronic material where possible. A screenshot may not by itself establish every issue concerning authenticity or origin.

16. Can an online payment fraud be a criminal offence?

Yes, depending on the conduct and statutory ingredients. Online payment fraud may involve provisions of the Information Technology Act and general criminal law.

17. Does the DPDP Act apply to websites?

It can apply where a website or associated service processes digital personal data within the scope of the Act, subject to its territorial and substantive provisions and commencement status.

18. Can AI-generated content create legal liability?

Potentially. Depending on the content and use, issues can include impersonation, privacy, copyright, trademark, defamation, fraud and intermediary compliance.

19. Can an Indian court deal with an internet dispute involving a foreign platform?

Potentially, depending on jurisdictional principles, the parties, the cause of action, applicable legislation and the circumstances connecting the dispute with India.

20. What evidence should a business preserve after an online attack?

Relevant material may include access logs, emails, account alerts, screenshots, transaction records, device information, server records, communications and incident-response documentation.

21. Can a consumer complain about an online purchase?

Yes, subject to the applicable consumer-protection framework and the facts of the transaction. Orders, invoices, payment records and communications should be preserved.

22. What is the difference between cyber law and internet law?

Cyber law commonly focuses on computer resources, cyber offences, electronic evidence and security, while internet law is a broader expression covering online contracts, platforms, content, privacy, e-commerce and intellectual property as well.

23. Can a business use another company’s trademark in an online advertisement?

Use of another party’s trademark should be assessed under trademark law and the particular circumstances. Commercial use can create infringement or passing-off issues where statutory requirements are satisfied.

24. Why is it important to preserve the URL of disputed online content?

The URL can help identify the location and context of the material and can assist in documenting the source of the content. It should be preserved together with date, time and other relevant records.

25. What is the first step in an internet-law dispute?

Identify the conduct, preserve relevant evidence and determine the legal right or obligation involved. The appropriate remedy can then be assessed with reference to jurisdiction, limitation and applicable law.

Key takeaways

Internet law in India covers a wide range of legal issues rather than a single category of disputes. The Information Technology Act, 2000 and IT Rules, 2021 remain important components of the framework, while criminal law, data protection, consumer law, intellectual-property legislation and contract law can apply to particular online activities. The 2026 IT Rules amendments also demonstrate the continuing development of intermediary obligations in response to new forms of synthetic and AI-generated content. Individuals and businesses should preserve digital evidence, review the legal framework applicable to their activities and avoid assuming that an online dispute can be resolved under one statute alone.

Important Disclaimer

This article is provided solely for general legal information and public awareness. It is not legal advice, legal opinion, or a legal solution to any specific facts or circumstances. Laws and their interpretation may change, and the application of law depends upon the facts of each individual matter. Readers should not rely upon this article as a substitute for obtaining appropriate legal advice concerning their specific circumstances. Nothing contained in this article creates, establishes or constitutes an advocate-client relationship between the reader and Trident Legal Services, Advocate Nikhil Rathod, or any other person associated with the publication.