Online Stalking, Doxxing, and Deepfakes in India — What the Law Says, BNS and IT Act Sections, and How to Get Help

The legal framework — BNS + IT Act working together

India's approach to online harassment law combines two overlapping frameworks:

The Bharatiya Nyaya Sanhita, 2023 (BNS) — in force from 1 July 2024, replacing the IPC. The BNS does not create a standalone "cyber crimes" chapter, but it extends existing criminal offences to acts committed through electronic means. Key relevant sections: 75 (sexual harassment), 77 (voyeurism), 78 (stalking), 351 (criminal intimidation), 353 (false statements), 356 (defamation).

The Information Technology Act, 2000 (IT Act) — India's primary technology law, amended in 2008, covering computer crimes and digital evidence. Key relevant sections: 66C (identity theft), 66D (cheating by personation), 66E (violation of privacy), 67 (obscene content), 67A (sexually explicit content), 67B (child pornography).

In most online harassment cases, police register offences under both BNS and IT Act sections simultaneously, giving prosecutors multiple legal grounds.

Cyberstalking — Section 78 BNS

Section 78 of the BNS 2023 is the primary provision covering cyberstalking. It replaced Section 354D IPC (inserted after the 2013 criminal law amendments following the Delhi Gang Rape case).

What Section 78 BNS covers

A person commits stalking who:

• Follows, contacts, or attempts to contact a woman to foster personal interaction despite a clear indication of disinterest
• Monitors a woman's use of the internet, email, or any other electronic communication
• Repeatedly contacts a woman through social media, WhatsApp, email, or phone despite being blocked
• Tracks a woman's physical location through digital means (GPS tracking, phone location data)
• Creates fake profiles to continue contacting a woman after being blocked on her real profiles
• Sends unsolicited explicit content, images, or messages repeatedly

Punishment under Section 78 BNS

First vs subsequent offence — the cognizability shift

A critical legal point: on the first offence, Section 78 BNS stalking is non-cognizable (police need a Magistrate's warrant to arrest). On the second or subsequent offence, it becomes cognizable — police can arrest without a warrant. This means: if you are a repeat victim by the same person, the police have more direct power to act. Document every incident carefully so the pattern of repetition is clear.

Doxxing — what it is and what laws apply

Doxxing means researching and publicly publishing private, personally identifying information about a person — typically to facilitate harassment, threats, or vigilante action against them. Common doxxing content: home address, workplace, phone number, family members' details, financial information, or photos that identify location.

Laws that cover doxxing in India

When doxxing becomes a more serious offence

If someone publishes your personal information and that information is then used by others to physically threaten, assault, or stalk you, the original doxxer can also be held responsible for the consequences under the principle of common intention (Section 61 BNS) — making them co-accused in the subsequent offences. Courts have begun applying this principle in organised online harassment campaigns.

Deepfakes — AI-generated fake content and the law

Deepfakes are AI-generated or AI-manipulated videos, images, or audio that realistically replace someone's face, voice, or body with fabricated content. India does not yet have a standalone deepfake law, but existing provisions are comprehensive in their coverage.

Laws applicable to deepfakes

MeitY Deepfake Guidelines — November 2023

The Ministry of Electronics and IT issued guidelines in November 2023 specifically addressing deepfakes under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021. Key requirements for platforms: social media platforms must not host deepfake content that impersonates a person; platforms must provide a mechanism to report deepfakes; verified users who create deepfakes face stricter action. The guidelines also require platforms to act within 24 hours of reports of deepfake content depicting a person without consent.

Revenge porn and non-consensual intimate images

The non-consensual sharing of intimate images (NCII) — commonly called "revenge porn" — is a serious and growing problem in India. It is covered primarily under Section 77 BNS and IT Act Section 66E.

Section 77 BNS — voyeurism

Section 77 BNS covers not only secretly recording a woman but also disseminating such material. It includes:

• Capturing any image of a woman engaged in a private act without her consent
• Publishing or transmitting such images without consent — whether or not the original recording was consensual
• Sharing intimate images originally shared in trust (consensually) after a relationship ends

Punishment: First conviction — 1 to 3 years imprisonment + fine. Subsequent conviction — 3 to 7 years + fine. This is a cognizable and non-bailable offence.

IT Act Section 66E

Violation of privacy — specifically capturing, transmitting, or publishing the image of a person's private areas without their consent. Punishment: up to 3 years imprisonment and/or ₹2 lakh fine.

What to do if your images are shared without consent

1. Document immediately: Screenshot all posts, profiles, and URLs showing the content before it is taken down
2. Report to the platform: Use the platform's emergency reporting tool — most platforms have "non-consensual intimate images" as a specific report category with 24-hour action commitment
3. Report to StopNCII.org: A global platform (now operational in India) that creates a hash of the image and shares it with participating platforms to prevent re-upload
4. File a complaint at cybercrime.gov.in under "Women/Child Related Crimes" → "Online and Social Media Related Crime"
5. File an FIR citing Section 77 BNS and IT Act 66E — this is a cognizable offence

Fake profiles and identity theft

Creating fake social media profiles impersonating another person — using their photos, name, and details — is covered under:

• IT Act Section 66D — cheating by personation using a computer resource or communication device — up to 3 years + ₹1 lakh fine
• IT Act Section 66C — identity theft — fraudulently using another's electronic identity — up to 3 years + ₹1 lakh fine
• BNS Section 319 — cheating by personation — using another's name or character to deceive — imprisonment + fine

For fake profiles: report to the platform; provide your own profile link and evidence that the fake profile is impersonating you. Also file at cybercrime.gov.in with screenshots of both your real profile and the fake one.

How to report — channels and what to expect

What information to have ready when filing

• Screenshots of all offending content with date/time visible
• URLs, usernames, profile links
• Timeline of incidents (dates and descriptions)
• Any communications from the harasser (messages, emails)
• Names and contact details of witnesses if any
• Your Aadhaar and contact details
• Evidence that you blocked the person (and harassment continued)

Platform obligations under IT Rules 2021

Under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, social media platforms with significant user bases (Twitter/X, Instagram, Facebook, YouTube, WhatsApp) have specific obligations:

• Appoint India Grievance Officer: Must be an Indian resident; name and contact details must be published
• Acknowledge complaints within 24 hours
• Resolve complaints within 15 days
• Act within 24 hours for: sexual content; deepfakes impersonating a person; content depicting minors sexually
• Act within 72 hours for national security/emergency content
• Traceability: On court or government order, large platforms must trace the original sender of a message

If a platform's Grievance Officer does not respond or resolve your complaint satisfactorily, you can escalate to the Grievance Appellate Committee (GAC) established by the central government — a three-member panel that hears appeals against platform decisions.

Online harassment — questions people actually ask

Can men be victims of cyberstalking under Section 78 BNS?

Section 78 BNS specifically protects women — its language refers to stalking "any woman." Men who are cyberstalked can file complaints under IT Act Section 66E (privacy violation), Section 351 BNS (criminal intimidation), or Section 356 BNS (defamation) depending on the nature of the harassment. There is a gap in Indian law in that there is no gender-neutral stalking provision equivalent to Section 78. The POCSO Act and JJ Act protect children regardless of gender for related offences.

The person harassing me is anonymous — can anything be done?

Yes. Cyber crime police have the power to send preservation and disclosure orders to platforms requiring them to reveal the IP address, device ID, and account registration details of an anonymous user — even if the account has been deleted. IP addresses resolve to ISPs, which can then identify the subscriber. This process takes time (typically weeks to months) but is increasingly effective. Courts can also grant emergency preservation orders to prevent deletion of account data. File the complaint even when the person appears anonymous — investigation reveals identity in most cases.

What if the harasser is in another country?

Jurisdiction is complex for overseas harassers, but not helpless. Indian law applies where the victim is located, and Indian courts can take cognisance. Police can: send Mutual Legal Assistance Treaty (MLAT) requests to the harasser's country; work through INTERPOL for serious cases; and request the platform (which typically has servers in the US) to provide account data under US court orders. For content removal, platforms act under Indian orders regardless of where the harasser is located. Getting content taken down is often achievable even when criminal prosecution of an overseas harasser is not.

Can I file both a BNS criminal complaint and a civil suit for online harassment?

Yes — you can pursue criminal and civil proceedings simultaneously. A civil suit can seek: injunction (court order stopping the harassment); damages for mental distress, reputation harm, and lost income; mandatory deletion of all harassing content. Criminal proceedings seek to punish the offender. The two are independent — winning or losing one does not affect the other. Civil courts have awarded significant compensation in online harassment cases. A lawyer experienced in cyber law can run both tracks effectively.

Can I share the harasser's identity publicly to warn others?

This requires careful thought. Publishing the alleged harasser's identity before a conviction carries its own legal risks: if your identification is wrong, you face defamation liability; even if correct, it can be seen as vigilante doxxing and may complicate your own legal proceedings. The safer approach: file the complaint with authorities, let the legal process proceed, and if you want to warn the community, describe the conduct pattern without identifying the specific person. If you have a court order or conviction, sharing that is safer. Consult a lawyer before naming the harasser publicly.

Related guides