How to report non-consensual deepfakes and NCII under BNS and IT Act

1. The Hook

You are in a Discord server or a WhatsApp group. Someone drops a "meme" that isn't actually a meme—it is a morphed, sexually explicit photo of a girl from your tuition class or a leaked private video of a friend. The group is blowing up with laughing emojis. People are calling it "dark humour" or "dank."

But here is the reality: this isn't humour. It is a cognizable offence that can land the creator and the distributor in jail for years. Whether it is a deepfake generated by AI or a "revenge porn" video, you don't have to be a silent spectator. If you or someone you know is being targeted, the law is actually on your side, and you can take action without even stepping into a police station initially.

2. What the law actually says

In India, the legal framework for digital crimes is a combination of the Information Technology (IT) Act, 2000 and the Bharatiya Nyaya Sanhita (BNS), 2023 (which replaced the IPC on July 1, 2024).

The IT Act, 2000

• Section 66E: Deals with the violation of privacy. If someone intentionally captures, publishes, or transmits the image of a "private area" of any person without their consent, they can face up to 3 years in jail or a fine of up to ₹2 lakh.
• Section 67 & 67A: These are the heavy hitters. Section 67 covers publishing obscene material, while Section 67A specifically covers material containing "sexually explicit acts." For a first conviction under 67A, the punishment is up to 5 years in jail and a ₹10 lakh fine.

The Bharatiya Nyaya Sanhita (BNS), 2023

• Section 77 (Stalking): If someone monitors a person's use of the internet or electronic communication to foster personal interaction despite a clear indication of disinterest, it is stalking.
• Section 79: This replaces the old Section 509 IPC. It punishes any word, gesture, or act intended to insult the modesty of a woman, including via digital means.
• Section 356: Deals with defamation. If a deepfake is used to harm someone’s reputation, this section applies.

The Procedural Power

Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2024, the police are mandated to register an FIR for cognizable offences. Furthermore, the Supreme Court in Lalita Kumari vs. Govt. of U.P. (2014) ruled that if a complaint discloses a cognizable offence (like sexually explicit content), the police must register an FIR immediately. You can also file a Zero FIR at any police station, regardless of where the crime happened.

3. Step-by-step playbook

Step 1: Secure the Evidence (The "Receipts")

Before the uploader deletes the post or the group is dissolved, you need a forensic trail.

• Do not just take screenshots: Use a screen-recording app to show the platform (e.g., Instagram), the profile of the uploader, the timestamp, and the content itself.
• Capture URLs: On a browser, copy the direct link to the post or profile.
• Metadata: If you received the file on WhatsApp, do not delete it. The file's metadata (hidden info like when it was created) is vital for the Cyber Crime reporting portal.

Step 2: Use the "StopNCII" Tool

If the content is Non-Consensual Intimate Imagery (NCII), use StopNCII.org. This tool is supported by the Government of India and major platforms like Meta and X. It creates a digital fingerprint (hash) of your photo/video so that platforms can automatically detect and block it from being uploaded, without you having to share the actual file with a human moderator.

Step 3: Report to the Platform's Grievance Officer

Under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, social media companies are legally required to remove non-consensual nude or morphed images within 24 hours of receiving a complaint.

• Go to the Help/Report section of the app.
• Select "Non-consensual sexual content" or "Harassment."
• If the automated report fails, find the "Grievance Officer" contact on the platform's India-specific legal page and send a formal email with your evidence.

Step 4: File a complaint on CyberCrime.gov.in

This is the official National Cyber Crime Reporting Portal.

1. Visit cybercrime.gov.in.
2. Select "Report Women/Child Related Crime."
3. You can choose to "Report Anonymously" if you are a witness, but if you are the victim, it is better to "Report and Track" to ensure an FIR is filed.
4. Upload the screenshots and URLs you saved in Step 1.
5. Timeline: You should receive an acknowledgement (an SMS/email with a category number) within 24–48 hours. The complaint is then forwarded to your local Cyber Cell.

Step 5: Escalating to a Zero FIR

If the online portal is slow and the content is spreading fast, go to your nearest police station.

• Tell them you want to file a Zero FIR under Section 173 of the BNSS and Section 67A of the IT Act.
• If the officer refuses, show them the Lalita Kumari (2014) judgement.
• If they still refuse, you can send your complaint via registered post to the Superintendent of Police (SP) or use the PG Portal for grievance redressal.

Step 6: Mental Health Support

Dealing with digital violence is draining. If you are feeling overwhelmed, reach out to Mental health helplines (iCall, Vandrevala, NIMHANS) for confidential support. You are not alone in this.

Browse all civic-action guides

Where it usually breaks

Even with the law on your side, the system can feel like it’s lagging. Here is where things typically go sideways and how you can push back:

1. The "It’s Just a Joke" Gaslighting: When you approach the police, an officer might try to downplay the incident, saying, "Bachche hain, galti ho gayi" (They are kids, it was a mistake). They might suggest you just "block and move on."

   • The Workaround: Remind them that under Section 173 of the BNSS, they are legally bound to register an FIR for cognizable offences. If they still refuse, mention the Lalita Kumari vs. Govt. of U.P. (2014) Supreme Court judgment. If that fails, send your complaint via Registered Post to the Superintendent of Police (SP) or use the National Cyber Crime Reporting Portal.

2. The 24-Hour Ghosting: Platforms like Instagram or X (formerly Twitter) are legally required under Rule 3(2)(b) of the IT Rules, 2021 to remove non-consensual nude or morphed images within 24 hours. Sometimes, their automated systems send a "This doesn't violate our community standards" reply.

   • The Workaround: Do not stop there. Take the "Reference ID" from that rejection and file an appeal on the Grievance Appellate Committee (GAC) portal at gac.gov.in. This is a government-run body that can overrule the platform’s decision.

3. The "VPN" Dead-end: Police might tell you they can’t track the person because they used a VPN or a fake ID.

   • The Workaround: While tracking an IP is hard, platforms are required to preserve "user information and records" for at least 180 days under Rule 3(1)(h) of the IT Rules, 2021, even if the account is deleted. Insist that the Investigating Officer (IO) sends a formal notice to the platform to "preserve and share subscriber information."

4. The Privacy Paradox: You’re scared that filing a complaint will make the video/photo go "viral" in the legal system.

   • The Workaround: You can request an "In-camera" trial under Section 366 of the BNSS to ensure your privacy is protected during court proceedings. You can also request the court to mask your identity in the judgment copies.

Templates / script

A. Script for calling the 1930 Helpline

Use this for immediate advice or if the deepfake is being used for financial extortion (sextortion).

"Hello, I am calling to report a cybercrime. Someone has created and circulated a non-consensual deepfake/morphed image of me/my friend on [Platform Name]. This is a violation of Section 66E and 67A of the IT Act. I have the URLs and screenshots ready. Please guide me on the next steps for a formal complaint and how to ensure the content is taken down within the 24-hour window mandated by IT Rules 2021."

B. Email to the Platform’s Grievance Officer

Find the email in the platform's 'Legal' or 'Contact' section. Usually, it's something like [email protected].

Subject: URGENT: Take-down request for Non-Consensual Intimate Imagery (NCII) - Rule 3(2)(b) IT Rules 2021

Body: Dear Grievance Officer,

I am writing to report the following content that contains [non-consensual nudity / morphed sexually explicit imagery] of [Me / Name of Victim].

Link to content: [Paste URL here] User Profile of Uploader: [Paste Profile URL here]

Under Rule 3(2)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, your platform is required to remove or disable access to such content within 24 hours of receipt of this complaint.

Please find the attached screenshots as evidence. I request you to acknowledge this receipt and provide a reference number for this complaint. Failure to act within the stipulated time will lead to further legal action via the GAC and the Cyber Cell.

Regards, [Your Name] [Your Phone Number]

C. Complaint Draft for the Cyber Cell/Police Station

Carry two copies; get one stamped as your "Receiving."

To, The SHO/In-charge, [Name of Cyber Cell/Police Station], [City, State]

Subject: Complaint regarding the creation and circulation of non-consensual morphed imagery under BNS and IT Act.

Sir/Madam,

I wish to report a cognizable offence committed by [Name/Username of accused, if known] or [Unknown person]. On [Date], I discovered that [describe the incident—e.g., a deepfake video was posted in a WhatsApp group/Discord server].

The content is sexually explicit and was created/shared without consent. This act constitutes an offence under:

1. Section 66E, 67, and 67A of the IT Act, 2000 (Violation of privacy and publishing obscene/sexually explicit material).
2. Section 79 of the BNS, 2023 (Act intended to insult the modesty of a woman).
3. Section 356 of the BNS, 2023 (Defamation, if applicable).

I have attached the following evidence:

1. Screenshots of the content and the uploader's profile.
2. The URL/Link to the post.
3. Screen recording of the incident.

I request you to register an FIR immediately as per the mandate in Lalita Kumari vs. Govt. of U.P. (2014) and initiate an investigation to identify the accused and remove the content from the internet.

Yours faithfully, [Your Name] [Your Address] [Your Phone Number]

FAQs

1. Does it cost money to file a cybercrime complaint? No. Filing a complaint on the National Cyber Crime Reporting Portal or at a police station is completely free. If any official asks for a "fee" to process your file or "track the IP," they are acting illegally. You can report such demands to the State Vigilance Department.

2. Can I report a deepfake if I am not the person in the video? Yes. Anyone can report "Obscene Content" or "Child Sexual Abuse Material" (CSAM) on the national portal. However, for Non-Consensual Intimate Imagery (NCII) involving adults, the law usually requires the victim or someone authorised by them to file the complaint to ensure the victim's agency is respected.

3. What if the person who made the deepfake is a minor (under 18)? They are still liable, but they will be processed under the Juvenile Justice (Care and Protection of Children) Act, 2015. Instead of a regular jail, they may be sent to a "Special Home" or ordered to perform community service. The crime is still recorded, and the content will still be taken down.

4. Will the police take my phone away as "evidence"? They might ask to "seize" your device if the evidence is on it. However, you can provide a "certified copy" of the data or a forensic image of the relevant parts. Under Section 63 of the Bharatiya Sakshya Adhiniyam (BSA), 2023, digital records are admissible. You can request the police to only take the specific files/logs rather than the physical phone.

5. How long does the whole process take? The "take-down" of the content should happen within 24 hours of reporting to the platform. The police investigation (identifying the person) can take anywhere from a few weeks to several months, depending on whether the platform (like Meta or Google) cooperates quickly with the data request.

6. Can I file a complaint if the deepfake is just "funny" and not sexually explicit? Yes. If the deepfake is used to damage your reputation or harass you, it can fall under Section 356 (Defamation) or Section 79 (Insulting modesty) of the BNS. Even if it's not "nude," if it's used for bullying, it is actionable.

7. Is there a way to report without my parents finding out? The Cyber Crime Portal allows you to report "Women/Child Related Crime" anonymously in the initial stage. However, for a full-blown FIR and investigation, the police will eventually need a statement. If you are a minor, a legal guardian’s involvement is usually required. If you're over 18, you are a legal adult and can handle the case yourself.