Violation of Privacy in India: Section 66E IT Act Explained

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Cyber law

Violation of privacy is a criminal offence under Section 66E of the Information Technology Act, 2000, which punishes capturing, publishing or transmitting an image of a private area without consent in circumstances violating privacy, with imprisonment up to three years or a fine up to two lakh rupees. This guide explains the boundaries of the section and how to report it.

Violation of privacy, as a criminal offence created by the Information Technology Act, 2000, is Section 66E. It punishes a person who intentionally or knowingly captures, publishes or transmits the image of the private area of any person without that person's consent, in circumstances that violate privacy. The punishment is imprisonment up to three years, or a fine up to two lakh rupees, or both.

Being precise about the section is what makes it useful. Section 66E is not a general right to privacy and it is not a remedy for every unwanted photograph. It applies to the image of a "private area", which the Explanation to the section defines as the naked or undergarment-clad genitals, pubic area, buttocks or female breast of any person. It also requires that the capture occurred in circumstances in which the person could reasonably expect that they would not be captured. A photograph taken in a changing room will fall within the section; the same person photographed walking down a street generally will not. Getting this boundary right decides whether a complaint is registered, and it is the first thing a court looks at.

The definitions that decide a Section 66E case

Three words do the work: "captures", "private area" and consent. "Captures" is defined broadly to include photographing, filming, videotaping, digital video recording or any other means of capturing an image. "Private area" is limited to the parts of the body described in the Explanation, and it is a closed list rather than an open one. Consent is judged from the circumstances: a person who consents to being photographed for a private purpose has not consented to that image being transmitted to anyone else, and the section separately punishes publishing and transmitting, not only capturing. That means the person who receives an image and forwards it without consent can be as liable as the person who took it.

What Section 66E does not cover

Because the section is narrowly drawn, several common grievances fall outside it. A hidden camera in a public corridor that captures a person fully clothed is not an image of a private area, however intrusive the filming may feel. A photograph taken with consent that is later misused may be outside the section if the image itself is not of a private area. A complaint about an organisation collecting personal data, or about a stalker who follows a person but takes no such image, is not a Section 66E complaint. Those situations are not without remedy, but the remedy lies elsewhere, and framing the complaint under the wrong provision is a common cause of delay.

What consent means in practice

Consent is not a single, permanent decision. Consent to be photographed in private does not carry with it consent to publish, and consent given to one person does not travel with the image to everyone who later receives it. The section reflects this by listing capturing, publishing and transmitting as separate acts, so a person who consents to the first is not taken to have consented to the others. Consent may also be withdrawn for the future even where an image was lawfully created, because publication after withdrawal is a fresh act. Where the person depicted is a child, consent is not a defence at all, because the law does not recognise a child's consent to such material.

Other laws that can apply to the same facts

Provision	When it applies
IT Act, Section 66E	Image of a private area captured, published or transmitted without consent, in circumstances violating privacy
IT Act, Section 67 and 67A	Where the image is obscene or sexually explicit and is published or transmitted in electronic form
IT Act, Section 72	Disclosure of an electronic record by a person who obtained access to it under the Act, without the consent of the person concerned
BNS, Section 77	Voyeurism, where the conduct amounts to watching or capturing a person in a private act
BNS, Section 78	Stalking, whether by following a person or by monitoring the use of the internet, email or other electronic communication
BNS, Section 356	Defamation, where the publication damages a person's reputation
DPDP Act, 2023	Personal data processed unlawfully by a data fiduciary, where the complaint is about data rather than an image
POCSO, 2012	Where the person depicted is a child

The Bharatiya Nyaya Sanhita, 2023 applies to acts on or after 1 July 2024; conduct before that date is governed by the corresponding provisions of the Indian Penal Code. The Digital Personal Data Protection Act, 2023 is being brought into force in stages, and its substantive obligations apply to digital personal data, so a complaint about an image of a private area is usually better framed under the IT Act.

How to report a privacy violation, in order

Preserve first, delete nothing. Keep the image, the message, the profile or account, the link and the timestamps. Do not delete the conversation or the account, and do not crop the screenshot so that the sender disappears from it.
Report to the platform. Under the IT Rules, 2021 an intermediary must have a grievance officer, acknowledge a complaint within twenty-four hours and dispose of it within fifteen days, and must remove content it knows to be unlawful.
Report to the authorities. Call 1930 or file a complaint on cybercrime.gov.in.
Register the FIR. A complaint disclosing a cognizable offence is recorded as a first information report under Section 173 of the BNSS at the jurisdictional police station, which is usually the station where the complainant resides or where the image was transmitted.
If the police decline. Apply to the Magistrate under Section 175(3) of the BNSS for a direction to investigate.
Investigation and evidence. Investigators may search and seize devices; under Section 105 of the BNSS the search and seizure must be recorded through audio-video electronic means, and electronic records are admissible under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 with the prescribed certificate.

Evidence: what actually proves a Section 66E case

A Section 66E case is proved through records, and records are perishable. The complainant's screenshots establish what was seen but not who sent it, so the investigation must obtain the account, device and connection data from the service provider. Under the IT Rules, 2021 and the general law on electronic records, a platform keeps the associated data for a limited period, and the retention clock effectively starts when it is asked to preserve the record. That makes an early complaint valuable. The forensic record should capture the image in its original form, with its metadata, rather than a re-saved or edited copy, because a forwarded screenshot loses the metadata that would tie it to a device. Where the image was posted to a public feed, the platform's own logs and the timing of the takedown requests become part of the record.

If the platform will not act

The grievance officer is not the last word. Under the IT Rules, 2021 an intermediary must acknowledge a complaint within twenty-four hours and dispose of it within fifteen days, and it must remove content it knows to be unlawful. If the platform does not act, the complainant should record the complaint reference and the response, then place the matter before the authorities. Section 79 gives an intermediary its safe harbour only if it observes the Rules and does not itself initiate or modify the unlawful transmission, so a platform that ignores a clear notice about an image of a private area weakens its own protection. A court order or a police request can compel removal and preservation of records where the platform has not acted voluntarily.

What decides the outcome

Four things drive the result. The first is whether the image is of a private area as the Explanation defines it, and whether the circumstances were such that privacy could reasonably be expected. The second is consent, including consent to publication as distinct from consent to capture. The third is forensic linkage: who took the image, whose device holds it, and who transmitted it. The fourth is timing, because the value of an image in evidence depends on whether it was preserved intact and on how quickly the service provider was asked to retain the associated records.

Alongside those four questions, the court looks at the relationship between the parties. Where the complainant and the accused were in a relationship that ended, or where there is a history of dispute, the defence will probe whether the complaint is an annexe to a personal conflict. That does not defeat a genuine case, but it means the prosecution must be able to place the image, the transmission and the lack of consent on the record independently of the complainant's account.

Civil remedies alongside the criminal complaint

A criminal complaint and a civil claim are not alternatives; they can run together. Section 43 of the IT Act allows a person whose computer resource has been accessed without permission to claim compensation, and the same facts can support a claim for damages and an injunction restraining further circulation. Where an image remains online, injunctive relief aimed at identified platforms or persons can be sought alongside the criminal process. A civil claim can also pursue the person who transmitted the image, not only the person who captured it, because liability under the Act attaches to each act. The two tracks serve different purposes: the criminal case addresses punishment, and the civil case addresses the harm and the removal of the material.

Common mistakes

Complainants often delete the very conversation that proves transmission, or share the image with friends to ask for advice, which spreads the harm and creates new recipients who may themselves be liable. Some report only to the platform and treat that as the end of the matter. Some wait weeks, by which time service providers may no longer hold the connection records. Accused persons sometimes hand over phones without a written seizure memo, or delete the application before counsel has seen the device.

It is worth separating two questions that complainants often run together. The first is whether a crime has been committed, which under Section 66E depends on the image, the consent and the circumstances. The second is whether the image can be taken down, which depends on the platform and the IT Rules, 2021. A person may have a strong takedown case and a weak criminal case, or the reverse, and the two are pursued through different machinery.

When to involve a lawyer

A privacy complaint under Section 66E turns on small details, and a lawyer helps you frame it so that the correct section is applied, preserve the record correctly, and move the investigation along. If you are accused, early advice matters because the offence is proved largely through devices and records, and the steps taken in the first days shape the evidence that follows. Our cyber crime lawyer in Kolkata handles Section 66E and related technology offences, and if you need to reach us quickly you can use the contact page.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What is Section 66E of the IT Act?

Section 66E of the Information Technology Act, 2000 punishes a person who intentionally or knowingly captures, publishes or transmits the image of the private area of any person without consent, in circumstances that violate privacy. The punishment is imprisonment up to three years, or a fine up to two lakh rupees, or both.

What counts as a private area under Section 66E?

The Explanation to Section 66E defines a private area as the naked or undergarment-clad genitals, pubic area, buttocks or female breast of any person. It is a closed list, so a photograph of a fully clothed person, however intrusive it feels, generally falls outside the section and must be addressed under another provision.

Does Section 66E cover forwarding someone else's image?

Yes. The section punishes publishing and transmitting, not only capturing. A person who receives an image of a private area and forwards it without the consent of the person depicted can be as liable as the person who took the photograph, and each further transmission can amount to a separate act under the section.

What is the punishment for violation of privacy in India?

Under Section 66E the punishment is imprisonment which may extend to three years, or a fine which may extend to two lakh rupees, or both. Where the image is also obscene or sexually explicit, Sections 67 and 67A of the IT Act can be charged, and those provisions carry heavier penalties.

Can a photograph taken in a public place be a privacy violation?

Usually not under Section 66E, because the section requires both an image of a private area and circumstances in which privacy could reasonably be expected. That said, other provisions may apply, such as the voyeurism and stalking offences under the Bharatiya Nyaya Sanhita, 2023, depending on how the image was obtained.

How do I report a Section 66E violation in India?

Preserve the image, the sender's details, the link and the timestamps, then report to the platform's grievance officer under the IT Rules, 2021 and to the authorities on cybercrime.gov.in or by calling 1930. Register a first information report under Section 173 of the BNSS at the jurisdictional police station, and apply to the Magistrate under Section 175(3) if the police decline.

What does the DPDP Act, 2023 change for privacy complaints?

The Digital Personal Data Protection Act, 2023 regulates the processing of digital personal data by data fiduciaries and provides its own penalties for breaches. It is being brought into force in stages and addresses data rather than images, so a complaint about an image of a private area is usually better framed under Section 66E of the IT Act.

What should I do first if a private image of me is circulating?

Preserve the evidence before doing anything else. Keep the image, the message, the profile and the timestamps, and do not delete the conversation or the account. Then report to the platform, report on cybercrime.gov.in or 1930, and register a first information report. Seeking a lawyer early helps frame the complaint correctly.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact