A Legal Obligation, Quietly Skipped
Since India's synthetic-media amendments to the IT Rules took effect on February 20, 2026, X's India transparency page has not published a single monthly compliance report. The last one covered the period from January 26 to February 25, 2026. Every month since, the page has simply gone silent — even as WhatsApp, operating under the identical legal obligation, has filed on schedule every month, including a report published August 1, 2026 covering June 2026, in which it disclosed banning roughly 51 lakh accounts in India that month alone.
This is not a courtesy either company chooses to extend. Rule 4(1)(d) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 requires every "significant social media intermediary" — any platform with more than 50 lakh registered Indian users — to publish a monthly report detailing complaints received, action taken, and content removed through proactive monitoring. X's own transparency page acknowledges the duty in the same breath it is failing to meet: "Pursuant to Rule 4(1)(d) ... X publishes a monthly report regarding our processing of reports from users in India." It just hasn't, for five consecutive reporting cycles.
Why the Rule Exists
The obligation is not bureaucratic box-ticking. The February 2026 amendments — notified by the Ministry of Electronics and Information Technology as G.S.R. 120(E) — brought "synthetically generated information," including deepfakes, inside the IT Rules' due-diligence framework for the first time, and sharply compressed response times: content flagged under a court or government order must now come down within three hours, down from 36. Platforms offering tools to create synthetic media must label and embed permanent, tamper-resistant metadata in the output. Given how quickly a convincing fake can spread — and how much harder it becomes to contain once it does — a public monthly accounting of how a platform is actually handling complaints and takedowns during this transition is a reasonable thing for a regulator to ask for. Opacity from the platform most exposed to viral synthetic content is precisely the wrong signal to send five months into a new regime built around speed and verifiability.
The Penalty That Never Bites
Where the rule breaks down is not in its design but in its enforcement. Rule 7 of the 2021 Rules is unambiguous about the stakes: an intermediary that fails to observe the Rules loses the safe-harbour exemption that Section 79(1) of the Information Technology Act, 2000 grants for third-party content. Lose that shield, and a platform becomes directly liable for what its users post — a categorically different legal exposure.
That is, on paper, a severe deterrent. In practice, it has apparently never been used. A parliamentary standing committee reviewing intermediary compliance found that despite the government forwarding more than 1.41 lakh URLs to platforms for removal and documented cases of delayed compliance, "no action has been initiated against any intermediary for non-compliance so far." When pressed, the Ministry of Home Affairs described its response to lapses as engagement with a platform's nodal officer rather than any formal penalty. The committee itself flagged this as a gap and recommended MeitY move toward periodic audits and calibrated financial or legal penalties.
X's five-month reporting lapse is a live test of exactly that gap. If Rule 7 meant what it says, a significant social media intermediary skipping a mandatory monthly disclosure for five straight months — through the exact period a new deepfake regime took effect — would be a clear trigger for scrutiny. Nothing in the public record suggests that has happened.
A Rule Worth Keeping, an Enforcement Model Worth Fixing
The temptation, from a pro-innovation standpoint, is to treat any lapsed platform obligation as evidence the rule itself is excessive. That's not the right read here. Monthly transparency reporting is low-cost, does not require platforms to change what content they carry, and gives researchers, journalists, and regulators the only public window into how automated takedown tools and grievance processes actually function at scale. WhatsApp's ability to file the same report every month, even while banning millions of accounts, undercuts any claim that the obligation is unworkable.
What's genuinely counterproductive is a compliance architecture where the only stated penalty is the legal equivalent of a nuclear option — total loss of safe harbour — that regulators visibly will not invoke against a major platform for a plain, sustained, undisputed lapse. An unenforced maximum penalty is not conservative regulation; it is an invitation to treat the reporting duty as optional for any company willing to absorb reputational risk rather than build the compliance function. If MeitY wants monthly reporting to mean something, the fix is not louder rhetoric about safe harbour — it is exactly what the parliamentary panel recommended: scheduled audits and a graduated penalty ladder that gets used, publicly, the first time a covered platform misses a filing by more than a month. Predictable, proportionate consequences that actually land will do more to keep the deepfake-era transparency regime credible than a nominally severe rule that has sat dormant since 2021.