This is one of the few situations where the law provides a genuinely fast takedown route, and it is worth knowing the exact provision to cite, because it changes how platforms respond.
The 24 hour rule
Under Rule 3(2)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, an intermediary must, on receiving a complaint from or on behalf of an individual, take reasonable and practicable measures to remove or disable access within two hours to content that exposes the private area of an individual, shows full or partial nudity, depicts a sexual act, or is in the nature of impersonation including artificially morphed images. Cite this rule expressly in your complaint. Generic reports go into a queue; a complaint that names Rule 3(2)(b) usually does not.
Report in parallel, immediately
- The platform, using its dedicated reporting flow and then its India grievance officer by email.
- cybercrime.gov.in, using the Report Women/Child Related Crime section, which permits reporting anonymously and is designed for exactly this.
- Helpline 1930, and the local cyber crime police station.
- Preserve URLs, screenshots and account handles before reporting, because content disappears and reappears elsewhere.
Write the complaint tightly. Name the rule, list every URL in a numbered table, state in one line that the content was published without your consent, and ask for three things: removal, preservation of the uploader's subscriber and log records, and written confirmation with a ticket number. Do not attach the images; the URLs are enough. Our note on how to report a cyber crime in India sets out the portal fields.
If the platform does not comply
The rule has teeth because of what sits behind it. An intermediary's protection from liability under Section 79 of the Information Technology Act, 2000 is conditional on observing the due diligence the 2021 Rules require and on acting when it receives a court order or a government notification. A platform ignoring a properly framed complaint is arguing about its own safe harbour, and saying so is more effective than repeating the request.
- Escalate to the Grievance Appellate Committee constituted under the 2021 Rules, which hears appeals against an intermediary's decision or its failure to decide.
- Ask the police to write to the intermediary for removal and preservation. A request routed through the investigating officer is treated differently from one sent by an individual.
- Where the material is hosted abroad and the platform is unresponsive, the blocking machinery under Section 69A of the Information Technology Act exists and the police or the Ministry can be asked to invoke it.
- A civil suit can produce a mandatory injunction directing removal, and courts have directed search engines to de-index the URLs so the material stops surfacing on a search of your name. Ask for the order to extend to mirror and re-uploaded copies as they appear; one tied to a fixed list is obsolete within a week.
Victims often hesitate because the images are intimate. The law protects your identity: disclosure of the identity of a victim of certain offences is itself an offence, proceedings can be held in camera, and the cybercrime portal permits anonymous reporting. Do not let embarrassment cost you the takedown window.
The offences involved
- Section 77 BNS, voyeurism, covering capturing or disseminating images of a woman engaged in a private act
- Section 66E of the IT Act, violation of privacy by capturing or publishing images of a private area without consent
- Sections 67, 67A and 67B of the IT Act, for obscene and sexually explicit material, with 67B covering material depicting children
- Section 78 BNS for stalking, and Section 308 BNS for extortion where money is demanded
Where the person in the material is a child, Section 67B and the POCSO Act apply, the obligation to report falls on anyone who knows of it, and the matter must go to the police rather than be handled by a takedown alone.
How the images were obtained usually matters
Say in the complaint how the material came to exist and how it was published. Images taken with consent in a relationship and put up after it ended, images captured without the person's knowledge, images taken by breaking into an account or cloud backup, and images that were never real but generated or morphed each lead to a different provision and a different investigation. If an account was compromised, change the credentials on every service sharing that password or recovery number first; our guide to protecting yourself from cyber fraud covers that lockdown in order.
Where the images are synthetic or morphed, the position is if anything stronger. The 24 hour rule expressly covers content in the nature of impersonation including artificially morphed images, and courts have separately restrained the unauthorised use of a person's face, likeness and voice: our note on personality rights and deepfakes in India sets out how those injunctions are framed. Do not be talked out of acting by the claim that "it is not really you"; that is the wrong of it, not a defence to it.
Sextortion
If someone is threatening to publish images unless you pay, do not pay; payment invariably leads to further demands. Preserve the chat, report on 1930 and the portal, and report the account. If it involves a video call recording, note that these are frequently recorded and morphed rather than genuine.
In order: stop replying, but do not delete or block until you have captured the conversation, because a blocked chat is often lost. Screenshot the profile, the handle, the demand and any UPI ID given. If money has gone, call 1930 the same hour so a hold can be sought. Warn one trusted person, because the second stage of these frauds is a message to your contact list. Then keep a dated chronology, so that if the material resurfaces months later a fresh complaint takes an afternoon rather than a reconstruction from memory.