Supreme Court Disposes PIL on Doxxing and Deepfakes; Directs Union Ministries to Implement Remedial Measures

The Specific Harms: Doxxing and Deepfakes

Doxxing involves the malicious research and public disclosure of private information—home addresses, phone numbers, family details, workplace information—typically to enable harassment, stalking, or violence. It operates on social media platforms and forums where anonymity emboldens perpetrators. Deepfakes use artificial intelligence to create or manipulate video and audio content, making individuals appear to say or do things they never did. Both tactics target individuals based on their political views, professional positions, or social activism.

These harms differ from traditional privacy violations in a critical way: they do not require state action. A private actor with basic technical skills can doxx someone by aggregating publicly available information. Deepfakes require more technical sophistication but are increasingly accessible through open-source AI tools. The Court's PIL order implicitly recognizes that the Puttaswamy framework, designed to constrain state power, must be complemented by affirmative state obligations to prevent and remedy private-sector digital abuse.

The timing of the order is significant. A Rajya Sabha member had petitioned the Supreme Court in July 2026, challenging the Delhi Police's use of facial recognition and biometric surveillance during public protests. That petition raised questions about the proportionality of surveillance technologies. The doxxing and deepfakes PIL, disposed in August 2026, shows the Court grappling with a broader digital privacy landscape where both state surveillance and private harassment demand judicial attention.

Ministerial Directives and Coordination Gaps

The Supreme Court's order directs multiple Union Ministries to implement remedial measures, though the PIL order does not specify which ministries or what exact measures are required. This approach suggests the Court is using its PIL disposal power to catalyze executive action rather than impose a detailed regulatory scheme. Several ministries likely fall within the scope of the directive.

The Ministry of Electronics and Information Technology (MeitY) oversees digital infrastructure, cybersecurity, and online safety. It would reasonably be expected to coordinate with internet service providers and social media platforms on mechanisms to report and remove doxxing content and deepfakes. The Ministry of Home Affairs manages law enforcement and would need to develop protocols for investigating digital harassment and synthetic media crimes. The Ministry of Information and Broadcasting might address media literacy and public awareness about deepfakes. The Department of Telecommunications could work with telecom providers on data security standards.

The Court's decision to direct multiple ministries reflects an understanding that digital privacy threats are cross-cutting. No single agency controls the internet ecosystem. Platforms host content, telecom providers carry data, law enforcement investigates crimes, and the judiciary adjudicates disputes. Coordination among these actors is essential but has historically been weak in India.

Existing Legal Framework and Its Limitations

India's Digital Personal Data Protection Act, notified in November 2025, establishes baseline data protection principles. It grants individuals the right to request deletion of personal data and mandates that data handlers obtain consent before processing personal information. A Supreme Court ruling in July 2026 clarified that telecom providers cannot share metadata without explicit consent and that citizens possess the right to request complete digital erasure of their data within seven days. Tech companies were granted a 90-day compliance window to update their privacy policies.

However, the DPDP Act includes broad exceptions for state data processing under national security justifications, potentially limiting its protective scope. More importantly, the Act focuses on consensual data processing by commercial entities. It does not directly address malicious doxxing by private actors or the creation and distribution of deepfakes. Criminal law—particularly provisions of the Indian Penal Code addressing defamation, harassment, and impersonation—provides some recourse, but these provisions were drafted before deepfakes became technically feasible and before doxxing became a coordinated tactic.

The August 2026 Supreme Court order seeking the Centre's response to challenges against the DPDP Act suggests ongoing tension between the right to information, protected under Article 19(1)(a), and the right to privacy. Journalists and investigators rely on access to personal data to expose wrongdoing. The DPDP Act's erasure provisions could complicate investigative journalism if applied rigidly. The Court emphasized the need to harmonize the RTI Act and DPDP Act, acknowledging both fundamental rights.

Constitutional Challenges and State Surveillance Gaps

While the doxxing and deepfakes PIL addresses private-sector harms, the broader digital privacy landscape in India remains complicated by state surveillance activities. As of September 2026, India extensively utilizes AI surveillance through projects like Safe City and NATGRID, including facial recognition technology. These programs operate despite the absence of specific laws regulating police use of such technology.

The Puttaswamy judgment mandates proportionality for any state infringement on privacy, yet regulatory gaps persist. Constitutional challenges remain the primary legal recourse against potential privacy infringements by state AI surveillance. The Pegasus spyware case exemplified how national security justifications can complicate accountability for state surveillance.

The Supreme Court's PIL order on doxxing and deepfakes does not directly address state surveillance, but it signals the Court's willingness to use PIL proceedings to push for comprehensive digital privacy protections. By requiring ministerial coordination on private-sector harms, the Court may be establishing a precedent for future orders addressing state surveillance gaps.

What Comes Next

The PIL disposal order does not establish a final hearing date or specify compliance deadlines. The affected ministries must now develop and implement remedial measures. These might include amendments to criminal law to address deepfakes specifically, platform accountability mechanisms requiring rapid removal of doxxing content, data security standards for telecom providers, and coordination protocols among law enforcement agencies investigating digital harassment.

The Supreme Court's approach reflects a pragmatic understanding of judicial limits. Rather than drafting detailed regulations—a task better suited to the executive and legislature—the Court has identified the problem and directed the responsible agencies to act. Whether ministerial coordination will produce effective remedies remains to be seen. The order's success depends on political will, resource allocation, and the ability of different agencies to work across bureaucratic silos. For individuals facing doxxing and deepfakes, the August 2026 order signals that courts recognize their harm as worthy of constitutional protection and governmental action.