Legal
What we check against
Every law, rule, regulator guidance note and industry code our reports assess a website against — and exactly what we look for under each. Where something is guidance or self-regulation rather than law, we say so.
Last updated: 13 September 2026
How to read this list
Not everything below is an Act of Parliament. Some entries are rules or directions with the force of law, some are regulator guidance, and one — the ASCI code — is industry self-regulation. We label each one, because the consequence of ignoring them differs. To be plain about a common misunderstanding: India has no enacted AI Act. What binds a website today on AI and synthetic content is the IT Amendment Rules, 2026, read with the MeitY guidelines, which are advisory.
Register last reviewed: 16 September 2026.
Personal data
Digital Personal Data Protection Act, 2023 and the DPDP Rules
Act 22 of 2023
Act of Parliament
- • Consent notice: itemised purposes, plain language, the right to withdraw as easily as to give
- • Purpose limitation, data minimisation and a published retention position
- • Data principal rights — access, correction, erasure, nomination, grievance
- • Children's data and the bar on tracking or targeted advertising at children
- • Processor terms under s.8(2), breach readiness and a named contact
Information Technology Act, 2000 and the SPDI Rules, 2011
s.43A, s.72A, s.79; SPDI Rules 2011
Act of Parliament
- • Mandatory privacy policy contents for sensitive personal data
- • Reasonable security practices, disclosure and transfer conditions
- • A named grievance officer with contact details published
Platform duties
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
Notified 25 February 2021
Rules / directions with force of law
- • Terms of use and the list of prohibited content, published and periodically notified to users
- • Grievance Officer name, contact and disposal timelines
- • Takedown handling and record-keeping for intermediaries
AI and synthetic media
IT Amendment Rules, 2026 — synthetically generated information
G.S.R. 120(E) dated 10 February 2026, in force 20 February 2026
Rules / directions with force of law
- • Whether the site offers any tool that creates, alters, publishes or shares synthetic audio or visual content
- • Visible labels on synthetic visuals, prefixed disclosure on synthetic audio, embedded provenance metadata with a unique identifier
- • No feature that strips a label, watermark or metadata
- • Updated timelines on the terms and grievance pages: 3 hours for court or government orders, 2 hours for nudity, morphing and impersonation complaints, 7 days for general grievances, user notification every 3 months
MeitY India AI Governance Guidelines and the generative-AI advisory
Guidelines 5 November 2025; advisory 15 March 2024, as revised
Regulator guidance — not binding
- • Whether AI features — chatbots, generated imagery, scoring, voice — are disclosed to users
- • What data the AI feature receives and which provider processes it
- • Whether AI output shown to the public is labelled
Security
CERT-In Directions, 2022
Direction No. 20(3)/2022-CERT-In
Rules / directions with force of law
- • Six-hour incident reporting readiness
- • Log retention for 180 days within India
- • Clock synchronisation to NIC or NPL time servers
Commerce and advertising
Consumer Protection Act, 2019 and the E-Commerce Rules, 2020
Act 35 of 2019; E-Commerce Rules 2020
Act of Parliament
- • Seller and company identity, registered address and contact
- • Cancellation, return and refund terms stated before payment
- • Consumer grievance officer and response timelines
- • Advertisements consistent with the actual goods or services
CCPA dark patterns and endorsement guidelines
Guidelines for Prevention and Regulation of Dark Patterns, 2023; Guidelines for Prevention of Misleading Advertisements and Endorsements, 2022
Rules / directions with force of law
- • The thirteen listed dark patterns — false urgency, basket sneaking, confirm shaming, forced action, drip pricing, disguised advertisement and the rest
- • Due diligence behind endorsements and disclosure of material connections
- • Claims capable of substantiation
ASCI Code for Self-Regulation of Advertising Content in India and its guidelines
ASCI Code, Chapters I–IV; Guidelines for Disclaimers; Influencer Advertising in Digital Media; Advertising using Virtual Influencers; Greenwashing; Online Real Money Gaming
Industry self-regulation — not statute
- • Objective claims — 'No.1', 'best', 'guaranteed', percentages — capable of substantiation, with the basis stated
- • Disclaimers legible, in the same medium, and not contradicting the main claim
- • Influencer, affiliate and paid content disclosed upfront and hard to miss
- • Virtual or AI-generated endorsers disclosed as not human
- • Environmental claims evidenced and qualified; real-money gaming and harmful-product rules
- • Fairness in competition — no unsupported disparagement
Legal Metrology (Packaged Commodities) Rules, 2011
Rule 6 declarations for goods sold online
Rules / directions with force of law
- • Mandatory declarations on product listings where physical goods are sold
- • Net quantity, retail sale price inclusive of taxes, and consumer care details
Business identity
Company and tax identity disclosure
Rule 26, Companies (Incorporation) Rules, 2014; GST registration display requirements
Rules / directions with force of law
- • Legal name, CIN, registered office, telephone and email published on the site
- • GSTIN shown and printed on every invoice
Sector specific
Sector and state rules
RBI, SEBI, IRDAI, TRAI/DND, health, education, gaming and state legislation
Rules / directions with force of law
- • Payment aggregator, data localisation and digital lending expectations for finance
- • Telemedicine and health data handling, education and children's services
- • Gaming and lottery restrictions that differ state by state
- • Unsolicited commercial communication and DND obligations
- • Shops and Establishments and other state-level disclosures
Accessibility
Rights of Persons with Disabilities Act, 2016 with GIGW and WCAG expectations
Act 49 of 2016; GIGW 3.0; WCAG 2.1 AA
Act of Parliament
- • Text alternatives, contrast, keyboard operation and form labelling
- • An accessibility statement and a route to report barriers
When the law changes
When a new Act, rule or guideline is notified, we update this register, the report engine and our own published documents together, so what we assess and what we promise stay in step. Read our legal disclaimer for the limits of an automated report.
See where your own site stands
A full audit reads your live pages against every entry above and tells you what to fix first.