The 3-Hour Takedown and the AI Cop-Out: Navigating India’s Draconian IT Rules and New DPDP Mandates

If you were holding your breath for a comprehensive, bespoke Artificial Intelligence Act in India, you can finally exhale. The Ministry of Electronics and Information Technology (MeitY) has made its position unequivocally clear: there will be no standalone AI legislation. Instead, the government is officially taking a "patchwork" approach, forcefully squeezing generative AI, deepfakes, and algorithmic scraping into the existing confines of the Digital Personal Data Protection (DPDP) Act, 2023, the Copyright Act, 1957, and a deeply concerning 2026 amendment to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules.

For tech practitioners, corporate counsel, and litigators, the era of regulatory "wait and see" is over. The government is weaponizing existing frameworks to rein in Big Tech, and the compliance burden on your clients just grew exponentially.

The 3-Hour Safe Harbour Guillotine

The most alarming development for anyone advising digital platforms is the 2026 amendment to the IT Rules. In a bid to tackle synthetically generated information and deepfakes, the government has slashed the takedown timeline for intermediaries from 72 hours down to an unforgiving 3 hours upon receipt of a grievance.

Let’s be direct: this is a constitutional nightmare and a logistical impossibility for most intermediaries.

"Slashing the takedown window to 3 hours effectively forces platforms to automate their content moderation, replacing judicial or quasi-judicial application of mind with blunt algorithmic censorship."

Under Section 79 of the Information Technology Act, 2000, intermediaries enjoy safe harbour only if they observe "due diligence." By shrinking the takedown window to 180 minutes, the government is practically guaranteeing that platforms will shoot first and ask questions later to avoid losing their immunity. How does a grievance officer verify if a video is a malicious deepfake or a legitimate political satire (protected under Article 19(1)(a) of the Constitution) in three hours? They won't. They will just delete it.

Practice Note for Lawyers: If you represent social media platforms, hosting services, or even large community forums, you must urgently overhaul their Grievance Appellate mechanisms. Your clients need automated, algorithmic triage systems paired with hyper-responsive legal teams. Furthermore, expect a wave of writ petitions challenging this under the Shreya Singhal v. Union of India precedent, arguing that such timelines create an unconstitutional chilling effect on free speech.

Shoehorning AI into the Copyright Act

MeitY Secretary S. Krishnan recently stated that the existing Intellectual Property framework covers a "fair amount" of AI-related issues. From a legal standpoint, this is wildly optimistic at best, and intellectually lazy at worst.

The government is essentially leaving the heavy lifting to the judiciary. When a Generative AI model scrapes millions of copyrighted Indian works, is it protected under the "fair dealing" exception of Section 52(1)(a) of the Copyright Act? Who is the author of a purely AI-generated artwork? Is it the prompter, the software creator, or no one, given that Section 2(d)(vi) defines the author of a computer-generated work as the "person who causes the work to be created"?

By refusing to legislate on AI, the government guarantees years of messy, protracted litigation in the High Courts. IP lawyers should prepare for massive infringement class-action suits against LLM developers, relying on traditional infringement principles because statutory clarity is nowhere in sight.

The DPDP Rules Are Here: The End of "I Agree"

Compounding the tech compliance headache, the Centre has finally notified the administrative rules for the DPDP Act. The grace period is over. The newly detailed rules surrounding consent mechanisms are set to completely disrupt how digital businesses operate in India.

Under the new framework, consent must be free, specific, informed, unconditional, and unambiguous (read in conjunction with Sections 5 and 6 of the DPDP Act). The days of burying data extraction clauses in a 50-page Terms of Service document are dead.

Here is what changes for your corporate clients immediately:

• Plain-Language & Itemised Notices: Data Fiduciaries must provide itemised data descriptions. If a food delivery app wants access to a user's microphone, the notice must explicitly state why, separate from the request for location data.
• The Unconditional Trap: You can no longer deny a service to a user just because they refuse to consent to data processing that isn't strictly necessary for that service (Section 6(1)).
• Asymmetry of Withdrawal: The most heavily litigated issue will likely be the new mandate that withdrawing consent must be as easy as giving it. If a user can consent with one click, they must be able to revoke with one click. If your client requires them to call customer service or send an email to revoke consent, they are in breach.
• Evidentiary Burden: Under Section 6(10), if a dispute arises, the burden of proving that valid notice was given and lawful consent was obtained lies entirely on the Data Fiduciary.

The Bottom Line

The Indian government has chosen its path: aggressive executive rules over nuanced legislative debate. The combination of the 3-hour takedown rule and the heavy-handed DPDP compliance framework means tech companies are operating in a highly punitive environment.

For the Indian legal fraternity, this is a call to arms. We are moving from an era of advisory practice into an era of fierce tech litigation. Advising a startup or a tech giant now requires a holistic understanding of how the IT Rules, the DPDP Act, and traditional IP laws intersect. Update your templates, brief your clients on the DPDP evidentiary burden, and get ready to argue the constitutional limits of intermediary liability all over again.