How to report online harassment and NCII under the IT Act and BNS

The Hook

You are scrolling through a Telegram group or a niche subreddit when you see it: someone has shared a "leak" or a private photo of a girl from your tuition or college. The comments are filled with what the community calls "peak degenerate suar level mentality"—rating her, asking for more, or making vile threats. It is easy to feel disgusted and just close the app, but that doesn't stop the spread. Whether it is a deepfake, a non-consensual intimate image (NCII), or targeted harassment, you have the legal power to get it taken down and hold the uploader accountable without exposing yourself to danger.

What the law actually says

Indian law has caught up with "locker room" culture and digital abuse. Since July 1, 2024, the Bharatiya Nyaya Sanhita (BNS) and the Bharatiya Nagarik Suraksha Sanhita (BNSS) have replaced the IPC and CrPC, providing specific pathways for digital crimes.

1. The IT Act, 2000

This remains the primary statute for cybercrimes.

• Section 66E: Deals with the violation of privacy. Capturing, publishing, or transmitting the image of a private area of any person without their consent is punishable by up to 3 years in jail or a fine of up to ₹2 lakh.
• Section 67 & 67A: These are the heavy hitters for "degenerate" content. Section 67 deals with transmitting obscene material, while 67A specifically covers material containing sexually explicit acts. A first conviction under 67A can lead to 5 years in jail and a fine of up to ₹10 lakh.

2. Bharatiya Nyaya Sanhita (BNS), 2023

• Section 77 (Voyeurism): This replaces the old Section 354C IPC. It covers any man who watches or captures the image of a woman engaging in a private act where she would usually expect not to be observed. This includes sharing those images online.
• Section 78 (Stalking): Replaces Section 354D. If someone monitors a woman's use of the internet or electronic communication to foster personal interaction despite a clear indication of disinterest, it is stalking.
• Section 79: Replaces Section 509 IPC. It covers any word, gesture, or act intended to insult the modesty of a woman, including through digital means.

3. IT Rules, 2021 (Intermediary Guidelines)

Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, social media platforms (Intermediaries) are legally obligated to remove non-consensual intimate imagery—including morphed or deepfake images—within 24 hours of a complaint being filed. You can read more about reporting these on the Cyber Crime reporting portal.

Step-by-step playbook

If you encounter toxic content or are a victim of NCII, do not delete the evidence immediately. Follow this tactical sequence to ensure the law can actually work for you.

Step 1: Preserve the Digital Evidence

Before the uploader deletes the post or the group gets banned, you need a forensic trail.

• What to do: Take full-page screenshots on a desktop or long-scroll screenshots on mobile. Ensure the URL (web address) is visible.
• What to capture: The post itself, the profile/username of the uploader, the timestamp, and the comments (to prove harassment/intent).
• Pro-tip: Do not just take a photo of one screen with another phone. Use the built-in screenshot or screen recording functions to maintain metadata.

Step 2: Identify the Platform's Grievance Officer

Every major platform (Instagram, Reddit, Telegram, X) operating in India must have a Grievance Officer.

• What to do: Go to the platform’s 'Help' or 'Legal' section. Look for the "India Grievance Redressal" page.
• What to send: Link to the offending content, the screenshots you took, and a specific mention that the content violates Rule 3(2)(b) of the IT Rules 2021 (which mandates removal of NCII within 24 hours).
• Timeline: The platform must acknowledge your complaint within 24 hours and resolve it within 15 days (or 24 hours for NCII).

Step 3: File a Report on the National Cyber Crime Portal

If the content is serious, reporting to the platform isn't enough. You need a police record.

• What to do: Visit cybercrime.gov.in.
• Report Anonymously: If you are a witness to "suar level" groups sharing content of others, you can select "Report Women/Child Related Crime" and then "Report Anonymously."
• Report and Track: If you are the victim or know the victim, use this option to ensure an FIR is generated.
• What to upload: The screenshots from Step 1 and the URL of the group/profile.
• Expected Timeline: You will receive an acknowledgement number immediately. A local Cyber Cell officer usually calls within 48–72 hours to verify details.

Step 4: Request De-indexing (If leaked on websites)

If the content has reached "tube" sites or search engines:

• What to do: Use Google's "Request to remove personal information" tool. Select "Non-consensual explicit or nude imagery."
• What to bring: The specific Google search result URLs where the content appears.
• Timeline: Google usually reviews and de-indexes (hides from search results) within 2–4 days.

Step 5: Filing a Formal FIR (If the portal report stalls)

If the online report doesn't lead to action, you must go to a physical police station.

• What to do: Go to the nearest Cyber Police Station or any local station. Under Section 173 of the BNSS (which governs the registration of FIRs), the police are bound to record your information.
• Zero FIR: If the crime happened in another city or online, the police cannot refuse you. They must file a "Zero FIR" and transfer it to the relevant station. For more on this, see How to file an FIR (and what to do if police refuse).
• What to bring: A printed copy of your screenshots and the acknowledgement from the cybercrime portal.

Step 6: Use the "Right to be Forgotten"

While India doesn't have a standalone 'Right to be Forgotten' statute yet, High Courts (like the Delhi High Court in Zulfiqar Ahman Khan v. Quintillion Business Media, 2019) have recognized it as part of the Right to Privacy under Article 21.

• What to do: If a platform refuses to take down content that is ruining your reputation or safety, you can approach a High Court for an injunction.
• Timeline: This requires a lawyer and can take weeks, but it provides a permanent legal shield against the content being republished.

For broader issues of harassment in institutional spaces, refer to our guide on POSH at workplace and college. To see all your options for taking a stand, browse all civic-action guides.

Where it usually breaks

The system looks great on paper, but the "real world" has bugs. Here is where your complaint might get stuck and how to force a reboot.

1. The "Arrey Beta, Delete Kar Do" Brush-off

When you go to a local police station, an officer might tell you to just "ignore the trolls" or "delete your account" instead of filing an FIR. They often do this to keep their station's crime statistics low.

• The Workaround: Remind them of the Supreme Court judgment in Lalita Kumari v. Govt. of Uttar Pradesh (2014), which makes it mandatory for police to register an FIR if a cognizable offence (like NCII or stalking under BNS) is disclosed. If they still refuse, use Section 173 of the BNSS to file a Zero FIR. This forces them to record the complaint regardless of whether the crime happened in their jurisdiction. You can also send your complaint via registered post to the Superintendent of Police (SP).

2. The Platform's "24-Hour" Ghosting

While the IT Rules 2021 mandate a 24-hour takedown for NCII, platforms like Telegram or smaller forums often ignore automated reports.

• The Workaround: If the platform doesn't act within 24–72 hours, escalate to the Grievance Appellate Committee (GAC) via gac.gov.in. This is a government-run portal where you can appeal against the decisions (or lack thereof) of social media intermediaries. It puts direct pressure on the platform's legal team in India.

3. The "Evidence Not Verified" Trap

Police might claim they can't proceed because "screenshots can be morphed."

• The Workaround: Under the Bharatiya Sakshya Adhiniyam (BSA), 2023 (which replaced the Evidence Act), electronic records are primary evidence. When you submit screenshots, also provide a Section 63 BSA Certificate (a simple self-declaration form stating the device used and that the data wasn't tampered with). Using tools like the Wayback Machine to archive a URL can also provide a permanent, third-party record that the content existed.

---

Templates / script

Template 1: Takedown Request to Platform Grievance Officer

Subject: URGENT: Complaint under Rule 3(2)(b) of IT Rules 2021 - Removal of NCII

Body: Dear Grievance Officer,

I am writing to report a violation of Rule 3(2)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

The following content [Insert Link] contains non-consensual intimate imagery/morphed sexually explicit content of [Me/Person Name].

Under the law, you are required to acknowledge this complaint within 24 hours and remove access to the content within 24 hours of receipt of this complaint.

Details:

• URL of content: [Link]
• Username of uploader: [Handle]
• Date/Time of discovery: [Date]

Attached are screenshots for your reference. Please provide a complaint reference number immediately.

Regards, [Your Name]

---

Template 2: Script for the Police Station (If they refuse FIR)

You: "Sir, I want to file an FIR regarding online harassment and voyeurism under Section 77 and Section 79 of the BNS."

Officer: "It’s just a comment/photo. Block them and move on."

You: "Sir, this is a cognizable offence. According to the Lalita Kumari (2014) judgment by the Supreme Court, you are legally bound to register an FIR when a cognizable offence is reported. If there is a jurisdiction issue, please file a Zero FIR under Section 173 of the BNSS and transfer it to the relevant station. I have the evidence ready with a Section 63 BSA certificate."

---

Template 3: Cyber Crime Portal "Incident Description"

When filing on cybercrime.gov.in, keep it clinical.

"On [Date] at [Time], I observed that the user [Handle/Phone Number] on [Platform] uploaded/shared [describe content: e.g., a morphed private photo] without consent. This content is being circulated in [Group Name/Link]. This act violates Section 66E and 67A of the IT Act and Section 77 of the BNS. I have preserved screenshots and the URL. I request an immediate takedown and investigation into the IP address of the uploader."

---

FAQs

1. Can I report a "leak" anonymously?

Yes. On the National Cyber Crime Reporting Portal, there is a specific option to "Report Anonymously" for crimes categorized as "Women/Child Related Crime." You don't have to provide your name or address to get the content flagged for takedown, though providing details helps if you want a full investigation and arrest.

2. What if the harasser is using a fake profile or a "burner" account?

Report it anyway. The police can issue a notice to the platform (Instagram, X, etc.) under Section 94 of the BNSS to produce the IP logs, registration email, and phone number associated with that "fake" account. Digital footprints are harder to erase than most "trolls" realize.

3. Does it cost money to file these complaints?

No. Filing a complaint on the Cyber Crime portal or registering an FIR at a police station is absolutely free. If any official asks for a "processing fee" or "convenience charge," they are asking for a bribe. You can report such demands to the State Vigilance Commission or Anti-Corruption Bureau.

4. How long does it take for a photo to be removed?

If you report it correctly to the platform's Grievance Officer citing the IT Rules 2021, they are legally mandated to remove NCII within 24 hours. For other types of harassment (bullying, stalking), the timeline is usually 15 days, but NCII is fast-tracked by law.

5. Will the police inform my parents?

If you are a minor (under 18), the police are generally required to involve a guardian under the Juvenile Justice Act and POCSO protocols. If you are an adult (18+), you have a right to privacy. However, in "outrage of modesty" cases, the police may ask for a secondary contact. You can request to speak with a Women’s Help Desk officer (available at most stations) to discuss your privacy concerns.

6. What if the content is a "Deepfake"?

Deepfakes are treated the same as NCII. Under the IT Rules 2021, platforms must remove "content in the nature of impersonation... including artificially replicated or manipulated images." In your complaint, explicitly mention that the image is "AI-generated or manipulated without consent."

7. Can I sue for compensation?

Yes. Apart from the criminal case, you can file a civil suit for damages for defamation or violation of privacy. Additionally, many states have "Victim Compensation Schemes" where the District Legal Services Authority (DLSA) can provide financial aid for legal and mental health support. Check nalsa.gov.in for your local DLSA contact.