DPDP Rules status: compliance window active. Read the update

Skip to content
Platforms & Internet · Reported legal challenge

First Originator Traceability

Rule 4(2) of the IT Rules 2021 requires large messaging platforms to be able to identify the first sender of a message when legally ordered by a court or government authority under specified circumstances.

Educational only · not legal adviceReviewed by Sandesh Kokate, Editor

Short answer

Law (Rule 4(2), IT Rules 2021): a large messaging platform must be able to name the first person in India who sent a message. It must do this only when a court or the Competent Authority orders it.

Who it applies to

The rule applies to a significant social media intermediary that mainly provides messaging. A platform is "significant" when it has more than fifty lakh (5 million) registered users in India (Rule 2(1)(v); S.O. 942(E)). Smaller apps are not covered by Rule 4(2).

When an order can be made

Only two kinds of order can trigger the duty (Rule 4(2)):

  • a judicial order from a court with jurisdiction; or
  • an order under Section 69 of the IT Act by the Competent Authority, made under the 2009 interception and decryption rules.

The order must come with a copy of the message in electronic form.

Which offences

An order can be made only to prevent, detect, investigate, prosecute or punish offences about:

  • the sovereignty and integrity of India, or the security of the State;
  • friendly relations with foreign States, or public order;
  • incitement to any of those offences; or
  • rape, sexually explicit material or child sexual abuse material.

The order can be made only for the offences the proviso lists. The proviso also refers to offences "punishable with imprisonment for a term of not less than five years". We quote it as written and do not say how far that phrase reaches.

Official text — First proviso to Rule 4(2), IT Rules 2021 (consolidated to 10 February 2026)
Provided that an order shall only be passed for the purposes of prevention, detection, investigation, prosecution or punishment of an offence related to the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, or public order, or of incitement to an offence relating to the above or in relation with rape, sexually explicit material or child sexual abuse material, punishable with imprisonment for a term of not less than five years:

Limits on the order

  • No order may be made if less intrusive means can identify the sender.
  • The platform does not have to disclose the content of any message. It also does not have to share other data about the sender or about its other users.
  • If the first sender is outside India, the first person in India to share it counts as the first originator.

What it means for you

Law: if you run a messaging app above the threshold, you must be able to answer a valid order. Good practice: write down who checks each order, and that it names a listed offence.

What's still open

Court status: primary order not found by us. WhatsApp's challenge in the Delhi High Court is reported, not confirmed. We have not opened a court record or order for it.

Official text — Rule 4(2), IT Rules 2021 (consolidated to 10 February 2026)
(2) A significant social media intermediary providing services primarily in the nature of messaging shall enable the identification of the first originator of the information on its computer resource as may be required by a judicial order passed by a court of competent jurisdiction or an order passed under section 69 by the Competent Authority as per the Information Technology (Procedure and Safeguards for interception, monitoring and decryption of information) Rules, 2009, which shall be supported with a copy of such information in electronic form: Provided that an order shall only be passed for the purposes of prevention, detection, investigation, prosecution or punishment of an offence related to the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, or public order, or of incitement to an offence relating to the above or in relation with rape, sexually explicit material or child sexual abuse material, punishable with imprisonment for a term of not less than five years: Provided further that no order shall be passed in cases where other less intrusive means are effective in identifying the originator of the information: Provided also that in complying with an order for identification of the first originator, no significant social media intermediary shall be required to disclose the contents of any electronic message, any other information related to the first originator, or any information related to its other users: Provided also that where the first originator of any information on the computer resource of an intermediary is located outside the territory of India, the first originator of that information within the territory of India shall be deemed to be the first originator of the information for the purpose of this clause.
Source
MeitY — IT Rules, 2021 (as amended to 10 February 2026)

Rule 4(2) sits in the consolidated IT Rules, 2021 as amended to 10 February 2026.

In force — checked 2026-10-06. Opened the IT Rules, 2021, consolidated to 10 February 2026.

Quick self-check

Am I a Data Fiduciary?

If you also handle user data as an intermediary, check whether DPDP obligations apply to you alongside these platform rules.

Run it now
← Back to Platforms & Internet hub