On 19 October 2026, Maharashtra Cyber Police served X Corp with a notice under Section 94 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023. It concerns accounts that posted criticism of Amruta Fadnavis, wife of Chief Minister Devendra Fadnavis. MediaNama reports that the notice rests on FIR 82/2026, registered at the Nodal Cyber Police Station in Navi Mumbai, and cites BNS Sections 352 and 353 and IT Act Section 67. It asks for registration details, names, emails and mobile numbers, login IPs with timestamps, device identifiers, location and IP-derived data, post metadata, linked accounts, and "any other information" that helps identify the operator. It also asks X to preserve all records.
The strongest case for the police
Investigators have a real problem. Online abuse is often anonymous, and a platform is frequently the only party that can say who is behind an account. Some of the posts MediaNama reviewed contained sexist and communal language, including references to "love jihad". Harassment of women in public life is a genuine harm, and a police force that could never identify an account holder would be unable to investigate threats, stalking or targeted abuse. Section 94 is also an ordinary tool. It lets a court or a police station's officer in charge require production of a document, electronic item or other thing needed for an investigation, as commentary on the BNSS text sets out. PRS Legislative Research notes that the BNSS carried over most CrPC provisions while adding language on electronic devices likely to hold digital evidence.
None of that is in dispute. The question is whether this notice is scoped to the harm.
Where the notice overreaches
The notice asks for far more than a name. Identifying an account holder needs, at most, the registered identifiers and the login records for the flagged posts. This notice also seeks location data, device identifiers, linked accounts and a catch-all category. Taken together, those would map a person's movements and associations well beyond the posts in question. MediaNama's author makes the same point: identifying who wrote the posts does not explain why investigators need every category listed.
The legal footing is also thin. Section 94 contains no standard of necessity, no limit on the categories of data and no requirement to notify the user. Compliance is by production alone. The statute leaves proportionality entirely to the officer issuing the notice, and the officer in question is working for a government whose head's family is the subject of the speech.
The cited offences matter too. MediaNama describes BNS 352 as intentional insult meant to provoke a breach of the peace, and BNS 353 as covering certain statements, false information or rumours. It describes IT Act Section 67 as covering obscene electronic material. Criticism of a politician's spouse, even harsh or crude criticism, does not obviously fit all of these provisions. When the offence is doubtful, expansive data collection becomes the punishment, because the user learns that criticising a powerful family can expose their location and contacts.
What the courts have already said
The constitutional standard is settled. In Justice K.S. Puttaswamy (Retd.) v. Union of India, the Supreme Court's 2017 privacy judgment, intrusions on privacy must have a basis in law, serve a legitimate state aim, and be proportionate to that aim. A notice that demands every available identifier fits poorly with that test unless the police explain why each category is needed.
High courts are already applying this reasoning to Section 94 notices to X. On 7 August 2026, the Telangana High Court in P. Rajagopal v. State of Telangana set aside a Section 94 notice to X to the extent it treated the petitioner as involved in Crime No. 404 of 2026. The FIR did not mention him at all. The Court found no basis for the notice and barred coercive steps without due process. That case turned on a missing nexus to the FIR, and the Maharashtra notice may well have one. It shows, though, that these notices are being challenged and are sometimes found to lack basis.
A proportionate way forward
A pro-speech position does not mean shielding abusers. It means tying the data to the offence and giving the user a chance to object. Four reforms would do that without disabling legitimate investigations:
- Tiered scoping. Start with subscriber identifiers and IP logs for the specific posts. Location, device and linked-account data should need a separate, reasoned request.
- Written necessity. Each notice should state why each category is needed for the FIR's offences, which is what proportionality requires.
- Judicial sign-off for sensitive categories. Where the speech targets a public official or the official's family, a magistrate should review the request before it goes to the platform.
- User notice and transparency. Platforms should tell affected users where the law allows, and governments should publish aggregate request counts.
Platforms can also help by pushing back, as X's counterparts have done elsewhere, and by demanding that notices identify the FIR, the offence and the legal basis for each category.
The broader risk is chilling effect. If criticism of the powerful reliably triggers requests for location and device data, anonymous dissent will disappear, and with it a long-standing check on those in power. Section 94 was written to collect documents. It should not become a routine way to unmask critics, and the courts have given Parliament and the police enough guidance to narrow it.