‘Disturbing public order’ accounts for 50% of takedown notices to X

According to a compilation of these notices from March 20, 2024 to November 7, 2025, which was filed by the MHA before Delhi High Court this month, 58 takedown notices were issued to X last year, including 24 for provisions related to violating public tranquility and promoting enmity — three other notices in 2024 flagged content deemed as threats to national integrity and sovereignty.

Only 14 of the 91 notices issued across the 20-month span alleged criminal activity, such as promotion of betting apps, impersonation of official handles with potential to cause financial fraud, and circulation of child sexual abuse material.

Of the entire lot, the most number of URLs (115) figured in a single notice issued on May 13, 2024, for an allegedly doctored video “spreading misinformation with the intention to influence ongoing electoral processes”.

Amid the Lok Sabha polls during April and May 2024, a total of 761 URLs were flagged in takedown notices to X. Of these, nine notices flagging 198 URLs specifically referred to violation of provisions of the Representation of People’s Act.

In its affidavit filed before the Delhi High Court through MHA’s Indian Cyber Crime Coordination Centre (I4C), the Ministry claimed that X Corp has been “objecting the unlawful content raised in the notices and authority to notify for removal of such content under Section 79(3)(b) of the IT Act”.

X Corp’s challenge to the Sahyog portal’s legitimacy is pending before the Karnataka High Court. Sahyog portal too issues takedown orders under the same provision –IT Act section 79 (3)(b) — under which the I4C has been issuing takedown notices to X Corp so far.

X Corp has maintained that the process for takedown or blocking orders has to be issued under Section 69A of the IT Act, which has been commonly used to issue online censorship directives but is limited to national security and public order-related offences.

X Corp has argued that takedown orders issued under section 79(3)(b) of the IT Act widens the net to take down or block content without a judicial process while providing a safe harbour clause for social media intermediaries.

The Indian Express analysed the 91 notices and found clear spikes around the time of the Lok Sabha polls in 2024 and Operation Sindoor a year later. Consider these:

Notices for takedown of URLs

Targeting leaders, public figures

* Nine notices flagging 21 URLs were issued for taking down allegedly manipulated content linked to Prime Minister Narendra Modi, including two related to digitally manipulated images of him and industrialist Gautam Adani.

* In a total of six notices, MHA directed the takedown of 91 URLs for alleged manipulated content featuring Union Home Minister Amit Shah. In one of them, issued on December 18, 2024 and directing the takedown of 28 URLs, including those posted by Congress leader Jairam Ramesh and party spokesperson Supriya Shrinate, X Corp pushed back, highlighting that 26 of the links do not violate provisions of forgery as cited by MHA.

In two other notices directing the takedown of three URLs, MHA flagged “fake and AI-generated content” targeting Jay Shah, chairman of ICC and “son of Union home minister Amit Shah”.

* In a total of three notices, including two with alleged fake content targeting the Prime Minister and one aimed at MoS (Home) Bandi Sanjay Kumar, the MHA cited defamation to direct the takedown of 14 URLs.

* Two notices, both issued in July 2024, ordered the takedown of 12 URLs for demeaning/ defaming the “Minister of Finance and Corporate Affairs”. A July 9, 2024 notice objected to “defamatory statements which is potentially misleading regarding the GST/ Income Tax System and derogatory remarks with the intention to demean not only the Minister of Finance and Corporate Affairs but also demeaning the Government of India through such deep fake post”.

* A November 2024 notice was linked to the CBC documentary on the Nijjar killing in Canada. It flagged one URL for “tarnishing” the image of public figures, including the Prime Minister and Home Minister, as well as MHA, and undermining “the global standing of India”.

Influencing poll process

* Nine notices, all issued in May 2024, sought the takedown of 198 poll-related URLs. Among the 115 URLs flagged in the May 13, 2024 notice, were many affiliated to Opposition parties.

* In one notice of May 27, 2024, seeking removal of seven URLs, including of a post by AAP’s Uttar Pradesh handle, X Corp objected. For the URL posted by AAP, X Corp requested I4C to reevaluate its decision since the “post does not violate the laws cited in the Notice”.

Criminal activities

* In three notices issued in April this year, the MHA sought the takedown of 37 URLs promoting betting, including links related to the Mahadev app.

* Only one notice from December 17, 2024, flagged child sexual abuse material content posted by 16 accounts.

* Ten notices flagged 40 URLs for their potential involvement in financial fraud by impersonation. One notice with one URL referred to “malicious Twitter post targeting PM” and allegedly spreading “false and misleading information about alleged financial scams in India, aimed at defaming PM and causing unrest”.

* I4C also flagged other instances of impersonation including a “misleading account” with the handle “PMOVaranasi”, which was “not an authentic government account”. It also referred to another account allegedly “linked to the banned U.S.-based group Sikhs for Justice (SFJ)”, which “impersonates former RAW chief Samant Goel…for spreading pro-Khalistani content and anti-India propaganda”.

Operation Sindoor

* Five notices seeking takedown or removal of 56 URLs reasoned that the content posed a threat to India’s “integrity, sovereignty and security”.

* On April 28 this year, days after the Pahalgam attack, the MHA cautioned against violation of section 13 of UAPA (unlawful activities) — a first among the I4C notices from Sahyog to X Corp — while flagging a URL that it “is alleged to be spreading threatening messages directed at the Indian nation, which may incite unrest and pose a serious risk to national security”.

* Following Operation Sindoor in May, the MHA issued two notices to X, seeking removal of three URLs for posting content allegedly “critical of the Indian Army”. One of these notices also citing violation of UAPA and a cyber terrorism offence (section 66F of the IT Act) by “spreading false information about the India-Pakistan conflict with the intent to mislead the Indian public”.

* In April and May 2025, I4C issued a total of 14 notices to X for takedown of 78 links.