Sextortion and Image-Based Blackmail in India: Laws, Evidence, and What to Do First

Sextortion and image-based blackmail in India are prosecuted as a combination of privacy violation, obscenity and extortion — principally Sections 66E, 67 and 67A of the Information Technology Act, 2000 together with Sections 308 (extortion) and 351 (criminal intimidation) of the Bharatiya Nyaya Sanhita, 2023 — and the correct first step is not negotiation or payment but immediate preservation of evidence and a confidential report to the cyber cell. This guide explains the sections that actually apply, how to report without making the images more public, how platform takedown now works on a 3-hour (court/government direction) / 2-hour (user grievance for intimate imagery) clock, and how electronic evidence must be handled so it survives in court.

Which laws cover sextortion and image-based abuse?

Sextortion in Kerala almost never involves a single section. FIRs are structured in layers because the conduct has three distinct elements — the image, the threat, and the demand — each with its own provision:

The image layer — the IT Act:

• Section 66E — violation of privacy. Intentionally capturing, publishing or transmitting the image of a private area of any person without consent, in circumstances violating privacy. Punishment: up to three years or fine up to two lakh rupees or both. This is the provision drafted specifically for intimate-image abuse and is the closest fit where an image is captured or shared without consent.
• Section 67 — publishing or transmitting obscene material in electronic form. First conviction up to three years and fine up to five lakh rupees; subsequent conviction up to five years and fine up to ten lakh rupees.
• Section 67A — publishing or transmitting material containing a sexually explicit act. First conviction up to five years and fine up to ten lakh rupees; subsequent conviction up to seven years. Where the blackmailer threatens to publish or has published an explicit image or video, Sections 67 and 67A are the standard charges.
• Section 67B — child sexual abuse material. Where the victim is under 18, Section 67B (creating, collecting, browsing, downloading or facilitating sexually explicit material depicting children) applies: first conviction up to five years and fine up to ten lakh rupees, subsequent conviction up to seven years and fine up to ten lakh rupees. It operates alongside the Protection of Children from Sexual Offences Act, 2012.

The threat and demand layer — the BNS:

• Section 308 BNS (formerly Sections 383 to 389 IPC) — extortion. Putting a person in fear of injury to dishonestly induce delivery of money or valuable security. Sextortion demands — pay or your images will be sent to your contacts — fit this definition directly. Punishment: up to seven years, or fine, or both; up to ten years and fine if the fear is of death or grievous hurt.
• Section 351 BNS (formerly Section 506 IPC) — criminal intimidation. Threatening to cause injury to reputation or to publish defamatory or harmful material. Every threat to circulate an intimate image to family, employer or social media contacts is charged here as well.
• Section 77 BNS (formerly Section 354C IPC) — voyeurism, and Section 78 BNS (formerly Section 354D IPC) — stalking, including electronic stalking and monitoring of a woman’s use of the internet or electronic communication. These apply where the offender obtained or collected intimate images by watching, recording or persistently pursuing the victim online.

Where the offender created a fake profile to establish contact, an additional charge of Section 66D of the IT Act (cheating by personation using a computer resource) is commonly added.

What should you do in the first hour?

Shame and panic are the mechanisms the offence exploits. Acting on a short, private checklist breaks that mechanism and preserves the options that disappear if you delay:

1. Stop communicating and do not pay. Payment does not delete images held by the offender; it confirms the blackmail works. Screenshot the final demand and then cease contact — do not delete the chat, do not block before preserving.
2. Preserve the evidence exactly as it is. Keep the chat in the original app, keep the images or videos the offender sent (including any sample they used as proof), note the phone numbers, profile URLs, UPI IDs and payment accounts mentioned, and keep the original device. Under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 the original device and its hash are what make an electronic record admissible later.
3. Do not delete images from your own phone in the belief this helps. Your copy may be the only provable record of what was threatened. Let the investigation handle deletion after seizure.
4. Report confidentially. File at cybercrime.gov.in — the portal has a specific category for cyber crime against women and children and allows reporting with identity disclosure confined to law enforcement — or call 1930, or go to the district Cyber Police Station. In Kerala, each police district has a Cyber Police Station, and FIRs under Section 173 BNSS can be registered at any station (Zero FIR) irrespective of where the offender is located.
5. Tell one trusted person. Isolation is what makes sextortion effective. A family member, counsellor or advocate who knows the facts can handle communication with the police and the platform so you do not have to carry it alone.

A note on what not to do: do not attempt to negotiate the offender down, do not agree to a video call to prove compliance, and do not install any app the offender asks you to install.

How does reporting stay confidential?

Two sets of provisions protect victims who report intimate-image offences:

• Identity protection. Section 72 of the BNS (formerly Section 228A IPC) punishes disclosure of the identity of a victim of offences under ss.64–71 only. Police standing orders in Kerala require cyber cells to record intimate-image complaints without public display of the complainant’s name, and the Cyber Crime Portal is designed so that the complainant’s identity is visible only to the investigating unit, not to the public.
• IT Act privacy. Section 66E itself is built around consent and privacy — the prosecution must not itself violate the privacy it is meant to protect. Courts routinely direct that intimate images seized as case property be kept in sealed cover and not reproduced in charge sheets circulated beyond the court.

None of this requires you to make the images more public. The investigation needs to see the material once, under controlled handling, so it can be hashed, certified and used to seek takedown. Delaying the report out of fear that the police will circulate the images misunderstands the procedure and costs the narrow window in which platform takedown is most effective.

How quickly must platforms remove intimate images now?

The timeline has been shortened twice and is now among the strictest in Indian law. Under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as amended by the Amendment Rules notified on 10 February 2026 and in force from 20 February 2026:

• Two-hour user-grievance removal for non-consensual nudity and morphed images. On a complaint by the individual (or someone on their behalf) under Rule 3(2)(b), the intermediary must remove or disable access to content exposing that individual’s private area, showing nudity or a sexual act, or impersonating them, including morphed imagery, within two hours (down from 24 hours before the 2026 amendment).
• Three-hour takedown on court or government direction for any unlawful content. On actual knowledge via a court order or authorised government notification under Rule 3(1)(d), any unlawful content — including extortionate messages and synthetically generated impersonation — must be removed within three hours (down from 36 hours).
• Grievance redressal in two hours for sensitive complaints. A grievance relating to non-consensual intimate imagery must be acknowledged and acted on within two hours of receipt by the platform’s Grievance Officer under Rule 3(2)(b) (down from 24 hours). General grievances must be resolved within seven days.

For content that qualifies as synthetically generated information (SGI) — for example, a morphed or AI-generated intimate image — the 2026 amendment adds labelling and provenance duties. Intermediaries that offer SGI generation tools must deploy technical measures to prevent creation or sharing of prohibited SGI (which expressly includes non-consensual intimate imagery) and must prominently label lawful SGI; significant social media intermediaries must also require users to declare whether content is SGI. Failure to take reasonable steps against prohibited SGI is treated as a failure of due diligence, which can cost the platform its safe harbour under Section 79 of the IT Act.

In practice, file the platform grievance in parallel with the police complaint, citing Rule 3(1)(d) (3-hour court/government-direction track) and Rule 3(2)(b) (2-hour user-grievance track for nudity/morphed/impersonation) and attaching the specific URLs. Do not rely on a generic report button alone — a written grievance to the published Grievance Officer with URLs and timestamps starts the 2-hour grievance clock in a provable way.

What evidence does a Kerala court actually need?

Every intimate image, chat and call record in a sextortion case is an electronic record, and its admissibility is governed by Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which replaced Section 65B of the Indian Evidence Act from 1 July 2024:

• Section 63(4) requires a certificate identifying the electronic record, describing the manner in which it was produced, and confirming that the device was operating properly, with a hash value of the record enclosed.
• The BSA now requires the certificate to be signed by both the person in charge of the device or activity and an expert (an Examiner of Electronic Evidence under Section 79A of the IT Act), in the form prescribed in the Schedule.
• The Supreme Court in Anvar P.V. v. P.K. Basheer (2014) 10 SCC 473 and Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) 7 SCC 1 held that the certificate is a mandatory condition for admissibility of secondary electronic evidence — a printout or forwarded copy without it is liable to be excluded. The court can, however, accept a delayed certificate and can summon the certifier.

What this means for a complainant:

• Keep the original phone or device. A screenshot forwarded to another phone is a copy of a copy — harder to certify than the original chat on the original device.
• Do not edit, crop or annotate the original screenshots before handing them over; give the investigation the clean originals and keep annotated copies separately.
• Allow the police to seize or image the device lawfully so the hash can be taken. A private screen recording made after the fact is weaker evidence than a forensically imaged original.
• Preserve CDR-relevant details — the offender’s numbers, profile handles and UPI IDs — because provider records will be summoned under Section 94 BNSS to corroborate the chat.

Can a sextortion case be compromised or quashed?

Sextortion is not a compoundable private dispute. Section 77A of the IT Act permits compounding only for offences punishable with up to three years where the statute allows it, and expressly excludes offences affecting the socio-economic conditions of the country and offences committed against a woman or a child — which covers the typical sextortion fact pattern under Sections 66E, 67 and 77A’s own bars. Attempted private settlements where the complainant is paid to withdraw are not recognised as compounding, and a High Court asked to quash under Section 528 BNSS (formerly Section 482 CrPC) applies a stricter test in sexual and extortion offences than in property disputes. The practical route for a complainant who genuinely wishes to close the matter is to place the facts before the court and let the court decide, not to sign a private compromise deed. An overview of quashing before the Kerala High Court is at the guides on IT Act offences and High Court litigation.

Primary sources

• Information Technology Act, 2000 — India Code (Sections 66C, 66D, 66E, 67, 67A, 67B, 72, 79)
• Bharatiya Nyaya Sanhita, 2023 — India Code (Sections 72, 77, 78, 308, 351)
• Bharatiya Sakshya Adhiniyam, 2023 — India Code (Section 63, replacing Section 65B Evidence Act)
• Bharatiya Nagarik Suraksha Sanhita, 2023 — India Code (Sections 94, 173, 528)
• IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as updated 6 April 2023 and amended 10 February 2026 — MeitY (Rules 3(1)(d), 3(2), 4 for SGI)
• Anvar P.V. v. P.K. Basheer (2014) 10 SCC 473 and Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) 7 SCC 1 on Section 65B/63 certificates
• National Cyber Crime Reporting Portal — cybercrime.gov.in (women and children reporting category)