Introduction
Welcome back. In our last lesson, we established that under India's IT Act, the entity that deploys an AI system is considered the legal "originator" of the messages it sends. This pins direct responsibility on the user of the technology.
However, many AI applications don't operate in a vacuum. They are often integrated into or hosted on vast digital platforms—social media networks, search engines, and app marketplaces. This raises a critical question: what is the responsibility of the platform itself? If a user leverages an AI tool on a platform to create defamatory content, is the platform also liable?
This lesson tackles that very issue. Our goal is to define 'intermediary' and analyze the scope of safe harbour protections for AI-powered platforms under Section 79 of the IT Act, 2000. We will explore one of the most foundational—and currently, most contested—principles of internet law, and examine how the rise of generative AI is putting it under immense pressure.
1. Defining the 'Intermediary'
The entire legal framework for platform liability rests on the definition of an "intermediary." The IT Act provides a deliberately broad definition to capture the wide range of entities that facilitate online activity.
To begin, let's explore this definition and the concept of an intermediary's role.
LIABILITY OF INTERMEDIARIES IN INDIA
This document, 'LIABILITY OF INTERMEDIARIES IN INDIA' by Dr. Karnika Seth, provides a clear and concise definition of an 'intermediary' as per the IT Act. It also explains how the law has evolved.
Please read 'Chapter 1 Introduction', focusing specifically on section '1.1 Definition of Intermediary under the Information Technology Act, 2000'. Note the broad list of entities included and how the definition changed after the 2008 amendment.
As you've read, Section 2(1)(w) of the IT Act defines an intermediary as any person who, on behalf of another, "receives, stores, or transmits" an electronic record or provides any service related to it.
The 2008 amendment significantly broadened this to explicitly include:
- Telecom and network service providers
- Internet service providers (ISPs)
- Web hosting providers
- Search engines
- Online payment sites and auction sites
- Online marketplaces
- Cyber cafes
In your professional context, this means that platforms like Salesforce (as a CRM provider), the technology providers behind your chatbot implementations, and social media platforms like X or Meta are all considered intermediaries under Indian law. They are the pipes and platforms through which third-party data and communications flow.
2. The 'Safe Harbour': Section 79 of the IT Act
Recognizing that holding these platforms liable for every piece of content transmitted by users would cripple the internet, lawmakers created a conditional immunity known as a "safe harbour." This is enshrined in Section 79 of the IT Act.
The safe harbour principle states that an intermediary is not liable for any third-party information, data, or communication link made available or hosted on its platform. However, this protection is not absolute. It comes with strict conditions.
To understand these conditions, let's watch a clear, structured breakdown of Section 79.
Online classes of Cyber Law(I.T. Act 2000 Sec.79) Lecture 14th By Meghna ma'am
This video lecture from St. Wilfred's College of Law walks through the clauses of Section 79, explaining the conditions for immunity and the exceptions where liability arises.
Please watch the following segments: 00:58 - 02:10: This part explains the core principle of non-liability for third-party information. 02:10 - 05:00: Focus on the critical conditions in Section 79(2). An intermediary is protected only if its function is limited and it does not initiate the transmission, select the receiver, or modify the information. 05:34 - 07:54: This segment covers Section 79(3), which details when the safe harbour is lost, particularly the 'notice and takedown' obligation.
Let’s summarize the three-part structure of Section 79 you just learned about:
-
Section 79(1): The Grant of Immunity. This is the core safe harbour provision, stating an intermediary is not liable for third-party content.
-
Section 79(2): The 'Passive Conduit' Conditions. Immunity is only available if the intermediary's role is purely technical, automated, and passive. The platform must not:
- Initiate the transmission.
- Select the receiver of the transmission.
- Select or modify the information contained in the transmission.
This establishes the intermediary as a neutral conduit, not an active publisher. It must also observe "due diligence."
-
Section 79(3): The Exceptions to Immunity. An intermediary loses its safe harbour protection if:
- It has conspired, abetted, aided, or induced the commission of an unlawful act.
- It fails to expeditiously remove or disable access to unlawful material upon receiving "actual knowledge" or being notified by the government.
The landmark case of Shreya Singhal v. Union of India (2015) clarified that "actual knowledge" requires a court order or a notification from a government agency. Simply receiving a user complaint is not enough to trigger the legal obligation to take down content, though platforms must still have a grievance redressal mechanism as part of their due diligence.
3. 'Due Diligence' and The Intermediary Rules
The protection of Section 79 is conditional upon the intermediary observing "due diligence." This isn't just a vague ethical requirement; it's a set of specific obligations laid out in the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (often called the IT Rules, 2021).
These rules have made the safe harbour a shield that must be actively earned.
Who are Intermediaries - Analysis of Section 79, IT Act | LawWiser U-Special (Jamia Millia Islamia)
This LawWiser video explains how the concept of intermediary liability has evolved, culminating in the stringent requirements of the 2021 Rules.
Please watch the segment from 02:57 to 06:02. Pay attention to the shift from a passive takedown regime to a proactive set of duties that intermediaries must fulfill to 'earn' their immunity.
As the video highlighted, compliance is now central to maintaining safe harbour. Key due diligence obligations under the IT Rules, 2021 include:
- Publishing rules, regulations, privacy policy, and user agreement.
- Informing users not to host, display, or share prohibited content (e.g., defamatory, obscene, invasive of privacy).
- Establishing a robust grievance redressal mechanism.
- Appointing designated officers (e.g., Chief Compliance Officer, Nodal Contact Person, Resident Grievance Officer).
- Enabling the identification of the "first originator" of information on messaging services (a highly contentious requirement).
Failure to comply with these rules can result in an intermediary losing its safe harbour protection, making it potentially liable for user-generated content.
Test your understanding!
A user creates a deepfake video defaming a public figure and uploads it to a major video-sharing platform. The victim obtains a court order declaring the video unlawful and serves it to the platform's legal department. The platform fails to remove the video for a week.
- What is the legal status of the video-sharing platform under the IT Act?
- Initially, is the platform liable for the user's deepfake video? Why or why not, citing the relevant section.
- How does the platform's failure to act on the court order affect its legal protection?
Show answer
- The video-sharing platform is an intermediary under Section 2(1)(w) of the IT Act, as it is a service provider that stores and transmits electronic records (the video) on behalf of a user.
- Initially, the platform is not liable. Under Section 79(1), it is protected by the safe harbour provision because the deepfake is third-party content. The platform did not initiate the upload, select who would see it, or modify its content, thus meeting the conditions of Section 79(2).
- The platform loses its safe harbour protection. By receiving a court order, it has gained "actual knowledge" of the unlawful content. Its failure to expeditiously remove the video is a violation of the condition under Section 79(3)(b). Consequently, it can now be held liable for the circulation of the defamatory content on its service.
4. Generative AI: The Ultimate Challenge to Safe Harbour
The entire safe harbour framework is built on the premise that the platform is a neutral host for third-party content. Generative AI threatens this fundamental premise. When a platform's own AI model creates text, images, or code, is that content truly from a "third party"? Or is the platform now a publisher or co-creator?
This is the central question reshaping intermediary liability worldwide.
Platforms in the dock: The changing rules of internet liability
The article 'Platforms in the dock: The changing rules of internet liability' from The Leaflet brilliantly analyzes how generative AI is disrupting the traditional safe harbour doctrine.
Please read the following two sections: Start with the section titled 'Under India’s legal framework...' to see how Section 79 operates in practice. Then, read the section 'How generative AI is upsetting the old safe-harbor calculus.' Focus on the core argument: when an AI authors the output, it is no longer merely hosting third-party content. Note the example of the OpenAI defamation case.
The article you just read raises the critical distinction:
- Hosting Content: A user writes a defamatory blog post and publishes it on a blogging platform. The platform is a host.
- Generating Content: A user prompts an AI chatbot, and the chatbot "hallucinates" a defamatory statement about a person. The words originate not from the user, but from the platform's model.
In the second scenario, the platform's claim to be a passive, neutral conduit under Section 79(2) becomes weak. By generating the content itself, the platform arguably "initiates" or "selects/modifies" the information, even if it does so automatically.
As the article notes, OpenAI chose not to use its equivalent safe harbour defense (Section 230 in the US) in a defamation case, implicitly acknowledging that the defense might not apply to AI-generated hallucinations. This signals a major shift. An entity that "manufactures the content output via its algorithms" looks much more like a publisher, with a publisher's attendant liabilities, than a neutral intermediary.
While Indian courts have yet to rule definitively on this, the logic suggests that the more actively an AI platform generates, curates, or recommends content, the further it moves away from the protection of the Section 79 safe harbour.
Conclusion
In this lesson, we explored the critical framework of intermediary liability in India, a cornerstone of digital law that is now facing its greatest challenge.
Key Takeaways:
- An 'intermediary' is broadly defined under the IT Act to include platforms like social media sites, search engines, and service providers that handle third-party data.
- Section 79 provides a conditional 'safe harbour,' shielding intermediaries from liability for third-party content, provided they act as a passive conduit and exercise due diligence.
- This immunity is not absolute. It is lost if the intermediary conspires in an unlawful act or fails to take down content upon receiving 'actual knowledge' (i.e., a court or government order).
- Generative AI fundamentally challenges this model. By creating content, AI platforms risk moving from the role of a passive host to an active publisher, potentially stripping them of their safe harbour protection.
Preview of the Next Lesson:
We've seen how an intermediary can lose its safe harbour. But what happens next? What are the actual penalties and liabilities for offenses committed under the IT Act? In our next lesson, we will analyze the liability for AI-related harm or malfunction under the IT Act's penalty and adjudication sections, examining the consequences when things go wrong.