It’s strange to think that a law meant to protect websites from getting sued over user posts would one day drag encrypted chat apps into court. But that’s exactly where India’s intermediary liability story has landed.
The starting point was Section 79 of the IT Act, 2000. A safe harbour clause. Platforms weren’t liable for what people posted as long as they didn’t actively pick and choose content and acted when told something was illegal. For a long time, that was enough. Facebook, Twitter, the usual suspects—all happy.
Then 2021 happened. The government rolled out new Intermediary Rules and things got specific. Yes, everyone had to appoint grievance officers and act faster. But the real curveball was aimed squarely at messaging apps. Rule 4(2) said that a “significant social media intermediary” must be able to trace the first person who sent a message, if a court or authority asked. Not the content. Just who started the chain.
WhatsApp and Telegram, both popular encrypted messaging services, froze.They can’t read your texts, so they can’t trace originators without building some kind of permanent digital fingerprint for every single message. That’s not a tweak; that’s breaking the whole model. WhatsApp took the government to court, waving the Supreme Court’s Puttaswamy privacy ruling like a shield. Their argument is dead simple: if you force us to identify first senders, you turn a private messenger into a surveillance machine. Everyone gets watched, not just the bad actors.
Delhi’s reply is visceral. Lynchings and riots have been triggered by wild rumours racing through WhatsApp. Traceability, the government says, is about stopping bloodshed, not reading love letters. They don’t want the message; they want the sender. So far, the judges haven’t decided, and the legal limbo drags on.
Meanwhile, newer laws like the Digital Personal Data Protection Act, 2023, and the telecom overhaul in 2023 are quietly stacking the deck. More government interception powers, more compliance obligations. Encryption might end up squeezed out, not through a direct ban, but by making it legally impossible to offer without risking the platform’s safe harbour.
For companies, it’s a brutal choice. Break their privacy promise and haemorrhage trust, or stand firm and maybe lose legal protection in a market of hundreds of millions. It’s no longer a policy debate; it’s a survival question.
What began as a rule to make social media more accountable has evolved into a heavyweight fight over the future of private speech. The outcome won’t just settle a compliance headache. It will tell Indians whether their encrypted chats are a private room or a glass house
This article has been researched and prepared by Devansh Dhama, Legal Research Intern at LegalRath.