Privacy In The Age Of Platform Compliance: Instagram’s Withdrawal Of End-To-End Encryption And The Unfinished Reach Of Puttaswamy

By /

Author(s): Dr S.Krishna and Ms. Pooja Soni

Paper Details: Volume 4, Issue 5

Citation: IJLSSS 4(5) 09

Page No: 114 – 127

Download Paper

ABSTRACT

On 8 May 2026, Meta discontinued the option to encrypt Instagram direct messages end-to-end, eleven days before covered platforms in the United States became bound by the notice-and-removal obligations of the TAKE IT DOWN Act[1], and within three months of India notifying the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, which compressed statutory takedown timelines for synthetically generated content to as little as two to three hours[2]. Meta has publicly attributed the withdrawal to low user adoption of an optional feature introduced in 2023. This paper argues that this account, while accurate as far as it goes, is incomplete. Read against the expanding statutory traceability regime under the Information Technology Rules, 2021[3], and the conditional nature of intermediary safe-harbour immunity under Section 79 of the Information Technology Act, 2000[4], Instagram’s withdrawal of encryption looks less like routine product rationalisation and more like a private compliance response to converging regulatory pressure in India and the United States. Using doctrinal legal research drawn from the Constitution of India, statutory material, and the Supreme Court’s nine-judge decision in Justice K.S. Puttaswamy v. Union of India[5], the paper asks whether India’s constitutional privacy jurisprudence can reach this kind of hybrid harm — one produced jointly by a private platform’s design choice and an indirectly coercive regulatory architecture. It finds that Puttaswamy’s proportionality standard, though doctrinally robust against direct state action, was framed principally as a vertical right against the State under Article 21[6], leaving unresolved the situation where private intermediaries make privacy-diminishing choices under the shadow of statutory compulsion. The paper concludes that this is a genuine gap in Indian privacy law and proposes one legislative and one judicial reform to close it.

Keywords: Right to Privacy; Article 21; Puttaswamy; End-to-End Encryption; Traceability; IT Rules 2026; Safe Harbour; Proportionality; Digital Personal Data Protection Act 2023; Instagram.

1. INTRODUCTION AND THESIS

Instagram began in 2010 as a photo-sharing application and was acquired by Meta Platforms in 2012; it now serves close to three billion monthly users, a figure equivalent to roughly a third of the world’s population routed through a single private messaging surface. In December 2023, Meta introduced an opt-in feature allowing users to encrypt Instagram direct messages end-to-end. On 8 May 2026, it withdrew that feature. The company’s stated justification was unremarkable: adoption of the optional setting had been low, the feature was costly to maintain, and users who wanted encrypted messaging could migrate to WhatsApp instead.

This paper takes the position that the official explanation, while not false, is incomplete, and that the incompleteness matters for constitutional law. Instagram’s withdrawal fell eleven days before the notice-and-removal obligations of the United States’ TAKE IT DOWN Act became enforceable against covered platforms on 19 May 2026[7], and only months after India notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, which extended the originator-traceability mandate first imposed on significant social media intermediaries in 2021[8] to synthetically generated content, and compressed statutory takedown timelines to as little as two to three hours for the most serious categories[9]. Under both regimes, a platform’s ability to access, scan and produce message content — precisely what end-to-end encryption is designed to prevent — has become closely tied to its ability to retain legal immunity: continued Section 79 safe harbour in India[10], and avoidance of civil penalty exposure in the United States. Read together, these developments gave Meta a strong compliance-driven incentive to prefer an accessible, traceable message architecture over a privacy-protective one, an incentive that a pure product-adoption story does not capture.

The thesis advanced here is twofold. First, Instagram’s withdrawal of encryption is best understood not as an isolated product decision but as a private compliance response to a converging traceability and safe-harbour regime, a form of regulation by proxy, in which the state achieves an outcome it could not straightforwardly mandate outright by conditioning a private actor’s legal survival on it. Second, and more significantly, Indian privacy jurisprudence, anchored in the Supreme Court’s decision in Justice K.S. Puttaswamy v. Union of India[11], does not yet possess a settled doctrinal mechanism for scrutinising this kind of hybrid harm, because the proportionality standard Puttaswamy articulated was built for a vertical relationship, the State acting directly upon the individual, and has not been clearly extended to private action taken under the shadow of state-created compulsion. That is the gap this paper sets out to demonstrate, and, in its concluding section, to propose closing.

2. RESEARCH METHODOLOGY

This paper adopts a doctrinal method, examining primary legal sources alongside secondary commentary and Meta’s own transparency reporting. Primary sources include the Constitution of India, particularly Articles 14, 19 and 21; the Information Technology Act, 2000; the Digital Personal Data Protection Act, 2023[12]; the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and their 2026 amendment; and the judicial decisions in Justice K.S. Puttaswamy v. Union of India, M.P. Sharma v. Satish Chandra[13], Kharak Singh v. State of U.P.[14], and Anuradha Bhasin v. Union of India[15]. Secondary sources include the Justice B.N. Srikrishna Committee’s 2018 data protection report[16] and the United States’ TAKE IT DOWN Act, referenced comparatively to illustrate a parallel regulatory logic operating on platforms outside India. Statutory and case-law material was located using SCC Online, Manupatra, AIR Online and Indian Kanoon. Factual claims about platform conduct, including the timing of Meta’s encryption withdrawal and the volume of Indian government requests for user data, are drawn from Meta’s published transparency reporting and contemporaneous reporting on the 2026 rule changes in both jurisdictions[17]. The paper does not rely on empirical or survey data; its claims are interpretive and doctrinal.

3. DOCTRINAL ANALYSIS

3.1 THE CONSTITUTIONAL FOUNDATION

Article 21 of the Constitution provides that no person shall be deprived of life or personal liberty except according to procedure established by law[18]. For decades the outer boundary of that guarantee was uncertain. In M.P. Sharma v. Satish Chandra[19] and, later, Kharak Singh v. State of U.P.[20], the Supreme Court declined to read an independent right to privacy into the Constitution, leaving surveillance-adjacent state action largely outside fundamental-rights scrutiny. That position was decisively overturned by a nine-judge bench in Justice K.S. Puttaswamy (Retd.) v. Union of India[21], which held that privacy is intrinsic to life and personal liberty under Article 21 and is further protected by the freedoms guaranteed under Articles 14 and 19. The Court did not treat privacy as an absolute right; it held that the State may restrict it, but only where the restriction is backed by law, pursues a legitimate state aim, and is proportionate, meaning it goes no further than necessary to achieve that aim. This three-part test of legality, legitimacy and proportionality is now the standard against which Indian courts measure state intrusions into private life, and it was applied again in Anuradha Bhasin v. Union of India[22], where the Court held that restrictions on internet access must be lawful, necessary and proportionate, confirming that the proportionality standard travels into the digital environment rather than stopping at its edge.

3.2 THE STATUTORY TRACEABILITY REGIME

Parallel to this constitutional development, a statutory architecture has grown around what platforms must do with user communications. The Information Technology Act, 2000 grants intermediaries conditional immunity from liability for user-generated content under Section 79[23], subject to due-diligence obligations. Rule 4(2) of the Information Technology Rules, 2021 added a specific obligation for significant social media intermediaries providing messaging services: on receipt of a judicial order or an order under Section 69 of the Act, the intermediary must be able to identify the first originator of a message[24]. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified on 10 February 2026, expanded this framework considerably. It brought synthetically generated and AI-manipulated content within the traceability and labelling obligation, required tamper-resistant provenance metadata, and reduced the general takedown window from thirty-six hours to three, with an even narrower two-hour window for the most serious categories such as non-consensual intimate imagery and deepfakes[25]. Failure to comply carries a direct consequence: loss of the Section 79 safe harbour, exposing the platform itself to liability for what its users post, as though it had authored the content. The Digital Personal Data Protection Act, 2023[26] adds a further layer, regulating how platforms process personal data generally, though its data-fiduciary obligations sit uneasily alongside a traceability mandate that presumes continued platform access to unencrypted content.

3.3 CONVERGENCE

Placed side by side, the constitutional and statutory tracks point in different directions. Puttaswamy constrains the State; the 2021 and 2026 Rules expand what platforms must be able to hand over to the State, on pain of losing the immunity that makes their business model viable. Instagram’s withdrawal of end-to-end encryption sits at exactly that intersection. Encrypted messages cannot be traced to a first originator, cannot be scanned for the provenance markers the 2026 Rules require, and cannot be produced within a two-to-three-hour takedown window. A platform that keeps encryption switched on for its highest-traffic messaging surface is, under the current rules, choosing to risk its own safe harbour, at the same moment its largest overseas market was tightening a comparable notice-and-removal obligation under the TAKE IT DOWN Act[27]. Meta’s account of low adoption may well be true as a matter of product usage; on this reading, it is also the more comfortable of two explanations, since the alternative, that a compliance calculation drove the timing, invites exactly the constitutional question this paper raises.

4. REASONS FOR INSTAGRAM WITHDRAWING ENCRYPTION

Although Meta officially cited low adoption as the principal reason for discontinuing encrypted DMs, the decision must also be understood within a broader regulatory and policy environment.

  • Low User Adoption

Meta stated that relatively few Instagram users opted into encrypted messaging. Because the feature was optional and not widely promoted, many users either did not know it existed or chose not to activate it.

  • Child Safety Concerns

Governments and child-protection organizations have increasingly argued that fully encrypted messaging makes it more difficult to detect child sexual exploitation, grooming, and the sharing of child sexual abuse material (CSAM).

  • Law Enforcement Pressure

Police and intelligence agencies worldwide have expressed concern that criminals increasingly rely on encrypted messaging platforms for Terrorism, Organized crime, Human trafficking, Financial fraud, Drug trafficking, Online extortion and Cybercrime. Investigators argue that encryption can significantly reduce their ability to collect digital evidence, even where judicial authorization exists.

  • Regulatory Compliance

Digital platforms now face stricter obligations in many jurisdictions regarding online safety, illegal content, and risk management. The growing regulatory focus has increased pressure on platforms to demonstrate effective moderation and cooperation with lawful investigations.

5. CONCERNS REGARDING THE GROWING POWER AND FUNCTIONING OF SOCIAL MEDIA PLATFORMS 

  • Rise in Digital Fraud and Impersonation: Proposed features such as WhatsApp usernames, which allow users to communicate without displaying mobile numbers, could facilitate phishing, name-squatting, identity theft, and digital arrest scams.
    • MeitY has raised concerns over the rollout, while Meta maintains that phone numbers will remain linked at the backend and usernames of verified public figures and government bodies will be reserved. 
  • Anonymity vs Traceability: Privacy-enhancing features such as username-based communication and End-to-End Encryption (E2EE) can reduce public exposure of personal information but complicate law-enforcement investigations.
    • They may also facilitate offences under Sections 66C (identity theft) and 66D (cheating by impersonation) of the IT Act, 2000. 
    • The government classified WhatsApp as a Significant Social Media Intermediary (SSMI) under the IT Act, 2000 and IT Rules, 2021, making it subject to due-diligence obligations.
      • However, the Internet Freedom Foundation argued that Section 79 only provides conditional safe-harbour protection and does not empower MeitY to approve or withdraw platform features. 
  • Inadequacy of Reactive Anti-Piracy Enforcement: The government identified over 3,100 Telegram channels allegedly distributing pirated films and OTT content, demonstrating the limitations of a purely channel-by-channel notice-and-takedown approach, as infringing content can rapidly reappear.
    • Copyright infringement is a criminal offense under the Copyright Act, 1957, and the Cinematograph Act, 1952. 
    • The government has asked Telegram to deploy systems to proactively detect, report, and disable access to pirated audio-visual content. The development reflects a shift from reactive content removal towards preventive due diligence by digital intermediaries.  
    • Telegram had become a “new dark web” used for cybercrime, fraud, and examination paper leaks. Earlier, the Centre had temporarily blocked the platform ahead of the NEET-UG 2026 re-examination under Section 69A of the IT Act, 2000. 
  • Safe Harbour Conundrum: Section 79 of the IT Act, 2000 grants intermediaries conditional immunity for third-party content.
    • However, failure to observe due diligence under the IT Rules, 2021, particularly regarding persistent piracy and unlawful content, can result in the loss of safe harbour protection. 
  • Algorithmic Facilitation of Child Exploitation: Investigations alleging that paid advertisements on Instagram promoted access to Child Sexual Exploitation and Abuse Material (CSEAM) and redirected users to Telegram channels expose serious vulnerabilities in automated advertisement approval and content-moderation systems.
    • Despite Meta’s stated zero-tolerance policy towards CSAM, sophisticated criminal networks can manipulate platform algorithms and moderation systems to distribute illegal content, highlighting the limitations of technology-driven moderation at scale. 
  • Online Child Safety and Human Rights: The circulation and commercialisation of CSAM/CSEAM violate children’s dignity and fundamental rights and attract stringent provisions under the Protection of Children from Sexual Offences (POCSO) Act, 2012 and the Information Technology Act, 2000 and undermine the UN Convention on the Rights of the Child (UNCRC).
    • The government has directed Meta to disable such content and submit an Action Taken Report (ATR). 
  • Weaponisation of Synthetically Generated Information (SGI): AI-generated deepfakes, voice clones, Non-Consensual Intimate Imagery, and synthetic identities threaten individual dignity, electoral integrity, cybersecurity, and public trust. 
  • Algorithmic Amplification of Online Harms: Digital platforms increasingly act as active curators rather than passive intermediaries, as recommendation and advertising algorithms can amplify misinformation, fraudulent content, piracy, and harmful synthetic media.
    • In some cases, viral misinformation and inflammatory content have contributed to communal violence and riots, prompting governments to temporarily block platforms or internet services, raising questions about the need for greater platform accountability and liability.  
  • Cross-Border Enforcement Challenges: Platforms such as WhatsApp, Telegram, and Instagram operate across multiple jurisdictions, complicating investigation, evidence collection, content removal, and prosecution of transnational digital crimes.

6. JUDGMENTS REGARDING DIGITAL REGULATION & SOCIAL MEDIA 

  • Shreya Singhal vs. Union of India, 2015: The Supreme Court (SC) upheld the constitutional validity of Section 69A, noting that it contains adequate procedural safeguards, including the requirement to record reasons in writing and the provision of a review committee to oversee the blocking orders. 
  • Tehseen Poonawalla vs. Union of India (2018): In response to mob lynchings fueled by fake news and WhatsApp forwards, the SC directed governments to take rigorous steps to stop the dissemination of irresponsible and explosive messages on social media that incite mob violence and lynching. 
  • Anuradha Bhasin vs. Union of India (2020): The SC ruled that the Freedom of Speech and Expression and the Freedom to Practice any Profession over the medium of the Internet is a constitutionally protected Fundamental Right under Article 19. 
  • Ajit Mohan (Facebook India) vs. Delhi Legislative Assembly (2021): The SC held that platforms like Facebook (Meta) have become “centers of concentrated power” and are no longer merely passive intermediaries.
    • Their algorithms actively curate content, giving them the power to influence mass opinion. 

7. KEY CHALLENGES IN REGULATING SOCIAL MEDIA PLATFORMS 

  • Defining the Scope of Intermediary Liability: Digital platforms increasingly curate, recommend, and monetise content through algorithms, blurring the distinction between a neutral intermediary under Section 79 of the IT Act, 2000 and an active publisher.
    • Determining when safe harbour protection should cease remains a major legal challenge. 
  • Absence of Ex-Ante Regulation: India’s regulatory framework is largely reactive (notice-and-takedown) rather than preventive (risk-based regulation).
    • Despite government requirements for platforms to clearly label AI-generated and synthetically generated content, enforcement and detection remain challenging.  
    • Initiatives such as the PIB Fact Check Unit, which identifies fake and misleading information related to the Union Government, help counter misinformation but largely operate after such content has already circulated, highlighting the need for stronger preventive mechanisms to address systemic digital risks.  
  • Regulating Proprietary Algorithms: Recommendation engines, advertising systems, and content moderation tools operate as opaque “black-box” algorithms, limiting regulatory oversight, independent auditing, and accountability for harmful outcomes. 
  • Fragmented Regulatory Ecosystem: Digital platforms are simultaneously governed by the IT Act, 2000, DPDP Act, 2023, Copyright Act, 1957, POCSO Act, 2012, Competition Act, 2002, and sector-specific regulations, leading to overlapping jurisdiction. 
  • Balancing Fundamental Rights with Platform Regulation: Regulatory measures must strike a balance between privacy (Article 21), freedom of speech (Article 19(1)(a)), innovation, and legitimate state interests such as national security, copyright protection, and child safety. 
  • Institutional Capacity Deficit: Effective regulation increasingly requires expertise in AI governance, algorithm audits, digital forensics, cryptography, and platform engineering, capacities that regulatory institutions and enforcement agencies are still developing. 
  • Lack of a Comprehensive Digital Platform Law: Unlike the EU’s Digital Services Act (DSA) and Digital Markets Act (DMA), India currently relies on multiple fragmented statutes, resulting in regulatory uncertainty and inconsistent compliance obligations for digital platforms. 

8. INDIA’S PERSPECTIVE

India has witnessed rapid digital transformation, accompanied by a rise in cybercrime, misinformation, online fraud, and child exploitation. The government has consistently emphasized traceability and accountability in digital communications. The regulatory framework includes:

  • Information Technology Act, 2000
  • Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules
  • Digital Personal Data Protection Act, 2023

Authorities have argued that platforms should assist in identifying the origin of unlawful messages in specific circumstances, particularly when investigating serious offenses. Technology companies, however, have expressed concerns that mandatory traceability could compromise encryption and user privacy.

9. CONSTITUTIONAL DIMENSIONS

The encryption debate intersects with several constitutional principles.

  • Article 21

The Supreme Court of India recognized privacy as an intrinsic part of the right to life and personal liberty in the landmark Justice K.S. Puttaswamy v. Union of India (2017) decision. The judgment emphasized informational privacy and individual autonomy.

  • Reasonable Restrictions

Privacy rights are not absolute. Government restrictions may be justified if they satisfy tests of legality, necessity, proportionality and procedural safeguards. Therefore, any interference with encrypted communications must meet constitutional standards.

10. INTERNATIONAL APPROACHES

Countries have adopted differing approaches to encryption.

  • European Union

The EU strongly supports privacy but continues debating proposals aimed at combating online child exploitation while respecting encryption.

  • United Kingdom

The UK’s online safety framework places significant obligations on platforms to mitigate illegal content, prompting ongoing discussions about the relationship between encryption and safety technologies.

  • United States

American policymakers remain divided. Some advocate stronger encryption protections, while others seek mechanisms enabling lawful investigative access in exceptional circumstances.

  • Australia

Australia enacted legislation allowing authorities, under specified conditions, to require technical assistance from technology companies during investigations, though the scope and implementation remain subjects of debate.

11. CRITICAL EVALUATION

11.1 THE STRENGTH OF THE PROPORTIONALITY STANDARD

Puttaswamy’s proportionality framework is, on its own terms, a considerable doctrinal achievement[28]. It refuses the State a blank cheque to invoke national security or public order as self-justifying labels, and it forces a structured inquiry into whether a less restrictive measure could have achieved the same end. Anuradha Bhasin shows the standard has teeth: an entire category of state action, internet shutdowns, was made reviewable for proportionality where it had previously been treated as an untouchable executive prerogative[29].

11.2 THE VERTICAL-HORIZONTAL GAP

The difficulty is that Puttaswamy’s proportionality test is framed, both in its text and in its subsequent application, as a check on the State acting directly. Where the impugned act is a private company’s own decision, however commercially convenient that decision is for the State, courts have no settled route to apply the same scrutiny. The Puttaswamy bench did gesture toward a wider reach, observing that privacy interests may also require protection against private corporate action, but this observation has not hardened into a workable test for cases where a private actor’s decision is the product of state-created incentives rather than direct state command. Instagram’s design choice is not state action in the traditional Article 12 sense; Meta is not “the State” and no order compelled it to remove encryption specifically. Yet the choice would arguably not have been made, or not made on this timeline, absent a regulatory environment on two continents that increasingly penalises the inability to access message content. This is a category the existing three-part test was not built to catch: harm produced by regulatory design rather than regulatory command.

11.3 REBUTTING THE COUNTER-ARGUMENT

The strongest counter-argument is that this framing overreaches. On this view, Meta made an ordinary commercial decision; the traceability and takedown rules pursue a legitimate and pressing aim, given the genuine harms of deepfake abuse, non-consensual imagery and coordinated fraud that both the 2026 Rules and the TAKE IT DOWN Act target[30],[31]; and treating a private product decision as a constitutional question risks turning every platform’s terms of service into a matter for judicial review.

This objection is not baseless, but it proves less than it claims. First, the legitimacy of the state’s aim was never in dispute; Puttaswamy itself accepts that privacy yields to sufficiently important state interests[32]. The live question is not whether the aim is legitimate but whether the means are proportionate, and a blanket architectural change that removes the possibility of encrypted communication for close to three billion users, in order to reach a comparatively small population of bad actors, sits uneasily with the least-restrictive-means component of the Puttaswamy test, whichever actor formally executes the change. Second, the fact that Meta, not the government, pulled the trigger does not remove the state’s fingerprints from the outcome; it only removes the outcome from direct constitutional scrutiny, which is precisely the doctrinal gap this paper identifies rather than a reason to dismiss it. Third, extending scrutiny to state-induced private action need not open every commercial decision to judicial review: the reform proposed below is narrowly targeted at decisions causally traceable to a specific regulatory lever, such as safe-harbour conditioning, and not to private business judgment generally.

12. CONCLUSION AND RECOMMENDATIONS

Instagram’s withdrawal of end-to-end encryption cannot be fully explained as routine product rationalisation once it is placed alongside the traceability obligations tightened by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026[33] and the conditional safe harbour under Section 79 of the Information Technology Act, 2000[34], and once its timing relative to the TAKE IT DOWN Act’s compliance deadline is taken seriously[35]. The episode illustrates a broader structural problem: India’s constitutional privacy standard, built through Puttaswamy[36] and reinforced in Anuradha Bhasin[37], is well equipped to review direct state action but has no settled doctrine for reviewing privacy-diminishing decisions that private platforms make because the State has made the alternative commercially punishing. Two reforms follow.

First, a legislative reform: any future amendment to the IT Rules that conditions safe-harbour immunity on traceability or content-scanning capability should be required to include a codified proportionality check, for instance restricting mandatory traceability to specific categories of serious harm identified through judicial or quasi-judicial authorisation on a case-by-case basis, rather than a blanket architectural requirement that pressures intermediaries into abandoning default encryption for all users in order to remain compliant.

Second, a judicial and doctrinal reform: courts should recognise, building on Puttaswamy’s own observation that privacy interests can run against private corporations[38], a limited category of regulatorily induced private action that is reviewable under Article 21 where a claimant can show the private decision was substantially caused by a specific state-created incentive, such as safe-harbour conditioning. This would not convert every platform decision into a constitutional matter; it would close the narrow but consequential gap illustrated by Instagram’s May 2026 decision, in which the most consequential privacy change affecting close to three billion users was made by a private company, under state-created pressure, entirely outside the reach of the very proportionality standard the Supreme Court spent nine judgments building.

[1]TAKE IT DOWN Act, Pub. L. No. 119-12, S. 146, 119th Cong. (2025) (notice-and-removal obligations for covered platforms became effective 19 May 2026).

[2]The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (notified 10 February 2026).

[3]The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, r. 4(2).

[4]The Information Technology Act, 2000, s. 79.

[5]Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.

[6]Constitution of India, art. 21.

[7]TAKE IT DOWN Act (n 1).

[8]IT Rules 2021, r. 4(2) (n 3).

[9]IT Amendment Rules 2026 (n 2).

[10]IT Act 2000, s. 79 (n 4).

[11]Puttaswamy (n 5).

[12]The Digital Personal Data Protection Act, 2023.

[13]M.P. Sharma v. Satish Chandra, AIR 1954 SC 300.

[14]Kharak Singh v. State of U.P., AIR 1963 SC 1295.

[15]Anuradha Bhasin v. Union of India, (2020) 3 SCC 637.

[16]Justice B.N. Srikrishna Committee, A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians (Report, 2018).

[17]Meta, Government Requests for User Data (Transparency Report), available at https://transparency.meta.com/reports/government-data-requests/.

[18]Constitution of India, art. 21 (n 6).

[19]M.P. Sharma (n 13).

[20]Kharak Singh (n 14).

[21]Puttaswamy (n 5).

[22]Anuradha Bhasin (n 15).

[23]IT Act 2000, s. 79 (n 4).

[24]IT Rules 2021, r. 4(2) (n 3).

[25]IT Amendment Rules 2026 (n 2).

[26]DPDP Act 2023 (n 12).

[27]TAKE IT DOWN Act (n 1).

[28]Puttaswamy (n 5).

[29]Anuradha Bhasin (n 15).

[30]IT Amendment Rules 2026 (n 2).

[31]TAKE IT DOWN Act (n 1).

[32]Puttaswamy (n 5).

[33]IT Amendment Rules 2026 (n 2).

[34]IT Act 2000, s. 79 (n 4).

[35]TAKE IT DOWN Act (n 1).

[36]Puttaswamy (n 5).

[37]Anuradha Bhasin (n 15).

[38]Puttaswamy (n 5).

Scroll to Top