The Never-Ending Story of India’s Relationship With the Internet

Key Takeaways

• India shut down the internet 84 times in 2024, more than any other democracy on earth, and the rules enabling it keep getting stricter, not looser.
• A three-hour takedown deadline sounds like a content moderation policy. In practice, it's a mandate for automated, no-review censorship at scale.
• Aadhaar was sold as a welfare ID. It's now a biometric surveillance infrastructure being opened up to private companies, and other countries are copying the blueprint.
• When the world's largest democracy normalizes these tools, every other government gets a little more permission to reach for them too.

India is the world's largest democracy. It also leads the world in government-imposed internet shutdowns, a distinction that should give everyone pause. In 2024, the country recorded 84 internet shutdowns, a record for any democracy, second only to Myanmar’s 85. In 2023, the number was 116. In 2025, it dropped to 65, the lowest number since 2017. The trend is moving in the right direction, but the destination is still nowhere near acceptable, and no other functioning democracy comes close.

Freedom House scores India 51 out of 100 on internet freedom, landing it in the "partly free" category. That phrase sounds almost polite, but what it actually means is that ordinary people are losing access to information, journalists are being pressured, and the platforms you use every day are making decisions based on government compliance rather than your rights.

There's a version of India's story the government likes to tell: 1.4 billion people, a world-leading payment system, ambitious digital infrastructure, hundreds of millions brought online for the first time. That story is real. The tragedy is that the other story is also real, and the two exist side by side, one financing and legitimizing the other.

Shutting Down the Signal

India's most direct tool for controlling information isn't a rule or a court order. It's the off switch.

When protests broke out in Manipur in 2023, authorities cut internet access across the state for weeks. During the farmers' protests, connectivity was suspended in parts of Rajasthan and Haryana. After the April 2025 Pahalgam terrorist attack, shutdowns swept across Jammu and Kashmir, and people were arrested for what they had written online. A professor was jailed for commentary on the India-Pakistan conflict. Independent Indian media outlets appeared on the same takedown lists as Pakistani state propaganda.

The pattern is consistent: something politically inconvenient happens, and the internet goes out. The official justification is always security, the prevention of misinformation, and public order. What actually gets prevented is the world seeing what's happening. Journalists can't publish. Organizers can't coordinate. Families can't reach each other.

New Rules, Anyone?

The shutdowns are blunt. The regulatory architecture being built around them is anything but.

The 2021 (updated 2023) Information Technology Rules (Intermediary Guidelines and Digital Media Ethics Code) set the foundation. Among other things, they required messaging platforms like WhatsApp or Messenger to be able to identify the "first originator" of any message. Basically, the government wants to know who said what, whenever it decides to ask.

WhatsApp took them to court over it, arguing that traceability breaks end-to-end encryption, fundamentally and unavoidably. The government's response? No fundamental right is absolute.

Read that again. In the world's largest democracy, no fundamental right is absolute. Said about privacy. About the right to a private conversation. The Electronic Frontier Foundation urged India to scrap the requirement entirely, warning it would compromise the security model billions of people worldwide rely on. India disagreed, insisting it's only after the bad actors. Where have we heard that before?

Then they took it one step further. In February 2026, the Indian government and its  Ministry of Electronics and Information Technology quietly dropped gazette notification G.S.R. 120(E), cutting down content takedown timelines from 36 hours to 3. Basically, if the government deems a piece of content violates the law, they will notify the platform it’s on. The platform, be it Meta, X, YouTube, or anyone else, then has 3 hours to respond and take it down. For non-consensual intimate imagery and deepfakes, it’s 2 hours.

Three hours doesn't allow for human review. It doesn't allow for judgment, or context, or the basic question of whether a takedown order is actually lawful. It mandates automation. An algorithm gets the order and removes the content before anyone with a mind has had a chance to look at it. When speed is the only metric, accuracy doesn't stand a chance. Political criticism disappears alongside actual violations, because they look the same to a machine operating on a countdown.

Then came March 2026, with new rules requiring platforms to comply with any directive, advisory, or guideline issued by MeitY, the Ministry of Electronics and Information Technology, as a condition of keeping their legal immunity from liability for user content. No parliamentary vote. No court order. A ministry memo could now cost a platform its safe harbor. The Internet Freedom Foundation called it "digital authoritarianism." It wasn't withdrawn.

This is what regulatory erosion looks like. Not a single dramatic moment you can point to. A steady accumulation of rules, each one tightening the space for free expression a little more, until looking back, you wonder how it got so far.

The All-Knowing Database

Beneath all of this sits Aadhaar, the world's largest biometric identity system. Over 1.38 billion enrollments, each linking fingerprints, iris scans, and facial data to a single 12-digit government number. It started as an ID for receiving government subsidies. It's now practically required to open a bank account, receive welfare benefits, access healthcare, and participate in civic life. It started as voluntary. It is no longer voluntary in any meaningful sense.

Biometric data is a different beast compared to other personal data, and the difference matters enormously. Your password can be changed. A credit card can be canceled. An email address may be abandoned. Your iris, on the other hand, can’t be reissued.

Biometric data is a different beast from other personal data, and the difference matters enormously. Passwords can be changed. Credit cards canceled. Your iris can't be reissued. If this database is compromised, the people in it have no recourse, not now, not in twenty years. That's not hypothetical: in 2024, a hacker posted on a dark web forum that they held 815M Indian records, including Aadhaar and passport data, names, phone numbers, and addresses.

Then the government made it worse. In 2025, private companies were given access to the Aadhaar infrastructure. One of the first participants was HyperVerge, a facial recognition firm that analyzes behavioral data. Scholars have coined the term "surveillance capitalism" to describe how companies monetize human behavior. India has found a way to hand private actors that capability at a scale no company could have built on its own, using infrastructure that was originally built to serve citizens.

This model is spreading. The Philippines, Morocco, and Ethiopia are building national digital identity systems modeled on Aadhaar. Whatever gaps exist in India's version are being exported with it.

Everyone’s Problem

Internet freedom is one of those things people agree is important, then treat as someone else's problem in practice. If you're not in India, it's tempting to read this as a distant story about a country with complicated politics. It's not.

When the world's largest democracy normalizes internet shutdowns during protests, it sends a message to other governments that it’s acceptable democratic behavior. When platforms build automated three-hour removal systems to stay operational in India, those systems take root globally. The next government that wants instant, no-review content removal doesn't have to argue that it's technically possible. It already is.

Internet freedom is worth fighting for because it isn't a niche civil issue. It's the infrastructure of everything else: journalism, organizing, education, dissent, the ability to tell people what's happening to you. All of it runs on open networks. When those networks close, it's never the powerful who lose first.