On 14 October 2026, a Supreme Court bench of Chief Justice Surya Kant and Justice Joymalya Bagchi quashed a Ghaziabad Crime Branch notice to X. The notice sought login and logout IP addresses, location data, device details and contact information for the account of journalist Abhishek Upadhyay. It covered 1 June to 22 August 2026. The ground was a road-rage FIR over an incident on 18 August, as MediaNama reports.
The order is short, but it does something Indian law has not clearly done before. It sets a working proportionality test for police requests to platforms.
The case for police access
The strongest argument for broad access is practical. Investigators often need to place a suspect, link devices and establish contact with witnesses, and platform records are sometimes the only evidence. Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023 lets a court or a police station's officer in charge require anyone to produce a document or thing that is "necessary or desirable" for an investigation, as reproduced by Courtbook. That is a deliberately wide standard, and it has to be wide enough to work against real crime. A rule that forced police to prove every record's relevance in advance would stall ordinary cases.
Why this notice failed
The notice did not fit its stated purpose. According to MediaNama, the bench observed that the notice sought information for a period that "largely is prior to the date of the alleged road-rage incident". It also found the Commissioner of Police's explanation, that the data was needed to trace and arrest Upadhyay, to be "in contradiction with the contents of the notice".
The arithmetic supports that reading. The window runs 83 days, from 1 June to 22 August. Of those, 78 days (about 94%) came before the 18 August incident. The notice itself is dated 22 August, four days after the incident. Nothing about a single road-rage event explains why a suspect's device history from two and a half months earlier was needed. It is also the period in which, MediaNama reports, Upadhyay published his reporting on alleged misappropriation of donations at the Ram Janmabhoomi Temple in Ayodhya.
Upadhyay argued the data could expose his sources and map his contacts and movements. He has denied the allegations in the FIR and says the incident was staged in response to his reporting. The Court did not need to decide who is right on the facts. It resolved the matter on the fit between the data requested and the offence alleged.
What the Court actually laid down
As MediaNama reports the order, the bench held three things:
- No confidential or personal information of the petitioner may be obtained for the period before the alleged offence.
- Post-FIR requests for digital information need safeguards for personal data and must meet proportionality, including a showing that alternative measures are inadequate. The police had not made one.
- Anything already obtained under the notice, or otherwise, "shall not be utilised against the petitioner."
The second holding is the important one. It draws on the proportionality framework from the Supreme Court's privacy jurisprudence. The nine-judge bench recognised privacy as a fundamental right in 2017, and the 2018 Aadhaar judgment in Justice K.S. Puttaswamy v. Union of India refers back to that holding. Turning it into a concrete question for investigators (why this data, why this period, why not something less intrusive) makes it usable on the ground.
The order also says these restrictions stay in force until comprehensive guidelines exist. It lets Upadhyay approach a competent court to seek mandatory guidelines on collecting personal and digital data during investigations. The Court has not written those guidelines itself. It left that task open.
How the case got here
The outcome followed weeks of scrutiny. As LiveLaw reported on the 7 September hearing, the bench asked the Ghaziabad Police Commissioner to file an affidavit on what information was needed from X. It also directed that none of it be made public. Justice Bagchi asked why the police needed the accused's "digital footsteps" in a road-rage case, and the CJI raised concerns about limits and guidelines for digital footprint inquiries. The Commissioner's explanation did not survive that questioning.
Why this serves an open internet
The ruling matters beyond one journalist for three reasons.
First, it puts the burden on the requester. Platforms receive a large volume of government requests and can rarely contest one in the Supreme Court, as X's user effectively did here. A test of necessity, proportionality and inadequate alternatives gives platform legal teams a standard to apply to every request.
Second, it protects reporting. A journalist's IP logs and contacts are a map of their sources. Allowing a pretext FIR to open that map would chill the sourcing that accountability journalism depends on, which is a speech harm even if no article is ever suspended.
Third, it is a targeted remedy. The Court did not restrict police access to platform data generally, and it did not strike down Section 94. It rejected one overbroad request and told police to justify the rest. That is proportionate regulation of state power, and it leaves investigators their tools.
The open question is durability. An order that says safeguards apply "until guidelines are framed" is only as strong as the next bench's reading of it, and the order has been reported only through MediaNama and the order text it links, available here. Parliament or the Home Ministry could codify a request standard, including a defined look-back limit tied to the offence date, notice to the affected user where it does not jeopardise the case, and a record of why less intrusive options failed. Until that happens, police and platforms will have to work from the principle this order states: data requests must be tied to the offence under investigation.