Information Technology Act 2000 — Explained

On this page

1. 1. Origin and Historical Context
2. 2. Constitutional and Legal Basis
3. 3. Key Provisions and Their Analysis
4. 4. IT Amendment Act 2008 Changes Extensively
5. 5. Practical Functioning and Enforcement
6. 6. Criticism and Challenges
7. 7. Recent Developments and Future Outlook
8. 8. Vyyuha Analysis: Evolution and Constitutional Tensions

Detailed Explanation

The Information Technology Act, 2000 (IT Act 2000) stands as India's seminal legislation for the digital realm, providing a legal framework for electronic transactions, digital signatures, and addressing cybercrimes.

Its journey reflects India's rapid embrace of the digital economy and the evolving challenges of cyber security. Vyyuha's analysis reveals that the Act's evolution is a testament to the dynamic interplay between technological advancement, economic imperatives, and the protection of individual rights and national security.

1. Origin and Historical Context

The genesis of the IT Act 2000 can be traced to the global recognition of the need for legal frameworks to govern electronic commerce. The United Nations Commission on International Trade Law (UNCITRAL) adopted a Model Law on Electronic Commerce in 1996, providing a template for nations to legislate on digital transactions.

India, witnessing the burgeoning internet economy and the potential of e-commerce, sought to align its legal system with international best practices. The Act was passed by the Indian Parliament in May 2000 and came into force on October 17, 2000.

Its primary objective was to facilitate electronic governance by giving legal recognition to electronic records and digital signatures, thereby promoting paperless transactions and fostering a secure environment for online business.

2. Constitutional and Legal Basis

The IT Act 2000 operates within the broader framework of the Indian Constitution and other existing laws. Its provisions often intersect with fundamental rights and other statutes:

Article 19 (Freedom of Speech and Expression): — This article is profoundly impacted by sections dealing with content regulation, such as Section 66A (now struck down) and Section 69A. The balance between regulating harmful online content and protecting free speech has been a recurring constitutional tension, prominently addressed in landmark judgments like Shreya Singhal v. Union of India.
Article 21 (Right to Life and Personal Liberty, including Right to Privacy): — Provisions related to data protection (e.g., Section 43A, Section 72) and surveillance (e.g., Section 69) directly engage with the right to privacy. The evolution of India's data protection regime, culminating in the Digital Personal Data Protection Act, 2023, has its roots in the principles enshrined in Article 21, as interpreted by the Supreme Court in cases like Puttaswamy.
Article 14 (Right to Equality): — Challenges to the Act's provisions have sometimes invoked Article 14, arguing for arbitrary or discriminatory application, particularly concerning penalties or regulatory powers.
Indian Evidence Act, 1872 (Section 65B): — The IT Act 2000 significantly amended the Indian Evidence Act, particularly by introducing Section 65B, which provides for the admissibility of electronic records as evidence in court. This section lays down specific conditions for electronic evidence to be considered reliable and admissible, ensuring its integrity and authenticity. This is crucial for prosecuting cybercrimes.
Indian Telegraph Act, 1885: — The IT Act 2000, particularly Section 69, draws parallels with the powers of interception under the Telegraph Act. Both acts grant the government powers to intercept communications, albeit for different mediums, raising similar concerns about surveillance and privacy.

3. Key Provisions and Their Analysis

The IT Act 2000, particularly after the 2008 amendment, encompasses a wide array of provisions:

Section 43: Penalty for damage to computer, computer system, etc.

This section deals with unauthorized access, downloading, introduction of viruses, disruption, denial of service, and other forms of digital trespass. It imposes civil liability, requiring the perpetrator to pay compensation to the affected party. The compensation can be substantial, making it a powerful deterrent against various forms of cyber vandalism and data theft.

Section 43A: Compensation for failure to protect data

Introduced by the 2008 amendment, Section 43A mandates corporate bodies possessing, dealing, or handling sensitive personal data or information in a computer resource to implement reasonable security practices and procedures. Failure to do so, resulting in wrongful loss or gain, makes the corporate body liable to pay compensation to the affected person. This was a precursor to a comprehensive data protection law and laid the groundwork for organizational accountability in data handling.

Section 66: Computer related offences

This section criminalizes various acts of hacking and unauthorized access, often read in conjunction with Section 43. It prescribes imprisonment up to three years or a fine up to five lakh rupees, or both, for dishonestly or fraudulently causing wrongful loss or damage to the public or any person by doing any act referred to in Section 43. This elevates civil wrongs under Section 43 to criminal offenses when malicious intent is proven.

Section 66A: Punishment for sending offensive messages through communication service, etc. (STRUCK DOWN)

This controversial section, introduced in 2008, criminalized sending 'grossly offensive,' 'menacing,' or 'false' electronic messages that cause 'annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred or ill will.

' It was widely criticized for being vague, overbroad, and having a chilling effect on free speech. In a landmark judgment, Shreya Singhal v. Union of India (2015), the Supreme Court struck down Section 66A as unconstitutional, violating Article 19(1)(a) (freedom of speech) and not falling within the reasonable restrictions under Article 19(2).

Section 67: Punishment for publishing or transmitting obscene material in electronic form

This section criminalizes the publication or transmission of obscene material in electronic form. It has provisions for increased penalties for subsequent offenses and specifically addresses child pornography (Section 67B) and sexually explicit acts (Section 67A), with stricter punishments. This provision aims to curb the spread of harmful content online.

Section 69: Power to issue directions for interception or monitoring or decryption of any information through any computer resource

This section empowers the Central or State Government to direct any agency to intercept, monitor, or decrypt any information generated, transmitted, received, or stored in any computer resource. This power can be exercised in the interest of the sovereignty or integrity of India, defense, security of the state, friendly relations with foreign states, public order, or for preventing incitement to the commission of any cognizable offense.

It is a significant power, often debated in the context of privacy and surveillance.

Section 69A: Power to issue directions for blocking for public access of any information through any computer resource

Introduced in 2008, Section 69A grants the Central Government the power to block public access to any information generated, transmitted, received, stored, or hosted in any computer resource. This power can be invoked on grounds similar to Section 69, primarily national security, public order, and preventing incitement to offenses.

The procedure for blocking is governed by the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009. This section has been used to block numerous websites and social media accounts.

Section 70: Protected System

This section allows the appropriate government to declare any computer resource as a 'protected system.' Unauthorized access to such a system is a criminal offense, carrying severe penalties. This provision is crucial for safeguarding critical information infrastructure.

Section 72: Penalty for breach of confidentiality and privacy

This section deals with the disclosure of information by a person who has secured access to any electronic record, book, register, correspondence, information, document, or other material without the consent of the person concerned, and with the intent to cause wrongful loss or gain. It carries imprisonment up to three years or a fine up to five lakh rupees, or both. This is a key provision for protecting individual privacy in the digital realm.

Section 79: Exemption from liability of intermediary in certain cases

Section 79 provides a 'safe harbor' for intermediaries (like internet service providers, social media platforms, search engines) from liability for third-party content hosted on their platforms, provided they observe due diligence and comply with government directions for content removal.

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, further elaborate on the due diligence requirements, including grievance redressal mechanisms and content moderation obligations.

This section is critical for the functioning of the internet and has been a subject of intense debate regarding platform responsibility.

Section 80: Power of police officer and other officers to enter, search, etc.

This section grants police officers (not below the rank of Deputy Superintendent of Police) and other authorized officers the power to enter any public place and search and arrest any person without a warrant, if they have reason to believe that a cybercrime has been or is about to be committed. This provision is vital for effective cybercrime investigation but also raises concerns about potential misuse and the need for safeguards.

Section 81: Act to have overriding effect

Section 81 states that the provisions of the IT Act shall have effect notwithstanding anything inconsistent therewith contained in any other law for the time being in force. This establishes the supremacy of the IT Act in matters pertaining to electronic transactions and cybercrimes, unless specifically exempted.

Section 84A: Punishment for cyber terrorism

Introduced in 2008, this section defines and criminalizes 'cyber terrorism,' which includes acts that cause or are likely to cause death or injury to persons, or damage to property, or disrupt essential services, by using computer resources with the intent to threaten the unity, integrity, security, or sovereignty of India or to strike terror in the people. It prescribes severe penalties, including life imprisonment.

4. IT Amendment Act 2008 Changes Extensively

The Information Technology (Amendment) Act, 2008, was a transformative overhaul of the original Act, necessitated by the rapid evolution of cyber threats and the need for a more robust legal framework. Key changes included:

Expanded Scope of Cybercrimes: — Introduction of new offenses like cyber terrorism (Section 84A), publishing sexually explicit material (Section 67A), child pornography (Section 67B), identity theft (Section 66C), cheating by personation by using computer resource (Section 66D), and violation of privacy (Section 66E).
Data Protection: — Introduction of Section 43A, making corporate bodies liable for failing to protect sensitive personal data. This marked India's first explicit statutory recognition of data protection principles.
Intermediary Liability: — Section 79 was refined to provide a 'safe harbor' for intermediaries, contingent on their adherence to due diligence and compliance with government orders.
Blocking of Content: — Introduction of Section 69A, empowering the government to block public access to online content on specific grounds.
Interception and Monitoring: — Section 69 was introduced, formalizing the government's power to intercept, monitor, or decrypt digital information.
Cyber Appellate Tribunal (CAT): — The CAT's powers were enhanced, and its composition was modified to include more technical expertise. Appeals from the CAT now lie directly with the High Court.
Digital Signatures to Electronic Signatures: — The concept of 'digital signature' was broadened to 'electronic signature,' accommodating various authentication technologies beyond public key infrastructure.
Enhanced Penalties: — Penalties for existing cybercrimes were increased, and new offenses carried stringent punishments.
Critical Information Infrastructure: — Section 70 was introduced to protect critical information infrastructure by declaring certain computer systems as 'protected systems.'

5. Practical Functioning and Enforcement

The IT Act is enforced through a multi-pronged approach:

Police and Law Enforcement Agencies: — Specialized cybercrime cells have been established within police departments across states to investigate and prosecute cyber offenses.
Adjudicating Officers: — The Central Government appoints Adjudicating Officers (typically not below the rank of a Director to the Government of India or a Secretary to the State Government) to adjudicate civil disputes and impose penalties under the Act, particularly for contraventions under Sections 43 and 43A.
Cyber Appellate Tribunal (CAT): — Appeals against the orders of Adjudicating Officers or the Controller of Certifying Authorities lie with the CAT. The CAT is a quasi-judicial body designed to provide specialized and speedy redressal in cyber-related disputes. Its decisions can be further appealed to the High Court.
Controller of Certifying Authorities (CCA): — The CCA is the root certifying authority, licensing and regulating Certifying Authorities (CAs) who issue Digital Signature Certificates (DSCs).
CERT-In (Indian Computer Emergency Response Team): — While not directly an enforcement agency for the IT Act, CERT-In plays a crucial role in cyber security incident response, threat intelligence, and vulnerability coordination, indirectly supporting the Act's objectives.

6. Criticism and Challenges

Despite its importance, the IT Act has faced criticism:

Vagueness and Overbreadth: — Section 66A was a prime example, leading to its striking down. Even other sections, like those dealing with obscenity, have been criticized for subjective interpretation.
Chilling Effect on Free Speech: — Concerns persist regarding the potential for misuse of powers under Sections 69 and 69A, leading to self-censorship.
Implementation Challenges: — Lack of adequate technical expertise among law enforcement, insufficient infrastructure, and cross-border jurisdiction issues hinder effective enforcement.
Data Protection Gaps: — While Section 43A was a start, it was widely acknowledged that India needed a more comprehensive data protection law, which the Digital Personal Data Protection Act, 2023, now aims to address.
Intermediary Liability Debates: — The balance between holding platforms accountable and protecting their 'safe harbor' status remains a contentious issue, especially with the rise of social media and fake news.

7. Recent Developments and Future Outlook

Digital Personal Data Protection Act, 2023 (DPDP Act): — This landmark legislation has significantly altered the data protection landscape in India. While the IT Act 2000 (specifically Section 43A and Section 72) provided initial provisions for data protection and privacy, the DPDP Act 2023 is a comprehensive, rights-based framework. It repeals Section 43A of the IT Act 2000 and amends certain other provisions, making the DPDP Act the primary law for personal data protection. This marks a major shift, moving India towards a more robust and modern data governance regime, aligning with global standards. From a UPSC perspective, understanding the interplay and supersession of IT Act provisions by the DPDP Act is critical.
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021: — These rules, framed under Section 79 of the IT Act, impose stricter obligations on social media intermediaries, significant social media intermediaries, and publishers of news and current affairs content, and online curated content (OTT platforms). They mandate grievance redressal mechanisms, traceability of messages (for significant social media intermediaries), and content moderation requirements, further defining the scope of intermediary liability. This directly impacts freedom of speech and platform governance.
Cyber Security Framework: — The IT Act 2000, along with the National Cyber Security Policy 2013 and the proposed National Cyber Security Strategy, forms the backbone of India's cyber security framework. The increasing sophistication of cyber threats, including state-sponsored attacks and ransomware, necessitates continuous evolution of this legal and policy architecture. For comprehensive understanding of India's cyber security architecture, explore .

8. Vyyuha Analysis: Evolution and Constitutional Tensions

Vyyuha's analysis reveals that the Information Technology Act 2000 has undergone a profound transformation, evolving from a statute primarily focused on facilitating e-commerce to a comprehensive, albeit still developing, cyber security and digital governance legislation.

The initial intent was to provide legal certainty for electronic transactions, a pragmatic step to integrate India into the global digital economy. However, the rapid proliferation of the internet brought with it unforeseen challenges: new forms of crime, complex questions of data privacy, and the delicate balance between free expression and content regulation.

The IT Amendment Act 2008 was a critical inflection point, expanding the Act's punitive and regulatory scope significantly, introducing concepts like cyber terrorism and explicit data protection clauses.

This expansion, while necessary, inevitably led to constitutional tensions, particularly concerning Articles 19 (freedom of speech) and 21 (right to privacy). The striking down of Section 66A in Shreya Singhal v.

Union of India stands as a landmark affirmation of digital rights against state overreach. The subsequent introduction of the DPDP Act 2023 further signifies a maturation of India's legal approach to data, moving beyond the IT Act's initial, more limited provisions.

The Act, therefore, is not a static document but a living law, continually being reinterpreted and supplemented to navigate the complex ethical, social, and security dimensions of the digital age. Its ongoing relevance lies in its foundational role, even as newer, more specialized laws emerge to address specific facets of the digital ecosystem.

The intersection of IT Act with fundamental rights is detailed in . Electronic governance implications are covered in . Data localization requirements connect to . Digital payment security frameworks link to .

Surveillance laws relationship explored in .

Often confused with

Side-by-side differences the UPSC paper likes to test.

Information Technology Act 2000 vs IT Act 2000 (Original) vs. IT Amendment Act 2008

Open IT Act 2000 (Original) vs. IT Amendment Act 2008

Aspect	Information Technology Act 2000	IT Act 2000 (Original) vs. IT Amendment Act 2008
Primary Focus	Facilitating e-commerce, legal recognition of electronic records and digital signatures.	Comprehensive cyber security, combating cybercrime, data protection, content regulation, national security.
Data Protection	Limited, general provisions on confidentiality (e.g., Section 72).	Introduced Section 43A (compensation for failure to protect sensitive personal data) and Section 66E (violation of privacy).
Cybercrimes Scope	Fewer specific cybercrime definitions (e.g., hacking, damage to computer).	Expanded significantly, introducing cyber terrorism (84A), identity theft (66C), cheating by personation (66D), child pornography (67B), sexually explicit material (67A).
Intermediary Liability	Section 79 existed but was less defined, leading to ambiguity.	Section 79 refined, providing 'safe harbor' with 'due diligence' conditions, later elaborated by IT Rules 2021.
Content Regulation	Mainly Section 67 (obscenity).	Introduced Section 66A (offensive messages, later struck down) and Section 69A (blocking of public access to information).
Government Powers	Less explicit powers for surveillance and content control.	Introduced Section 69 (interception, monitoring, decryption) and Section 69A (blocking).
Digital Signatures	Focused on 'Digital Signature' based on Public Key Infrastructure.	Broadened to 'Electronic Signature' to accommodate other authentication technologies.
Penalties	Generally lower penalties for offenses.	Enhanced penalties for existing offenses and introduced stringent penalties for new cybercrimes.

The IT Act 2000, in its original form, was primarily an enabling legislation for e-commerce, providing legal sanctity to digital transactions. The IT Amendment Act 2008, however, marked a paradigm shift, transforming the Act into a comprehensive framework for cyber security and crime prevention.

It significantly broadened the definitions of cybercrimes, introduced explicit provisions for data protection and intermediary liability, and granted the government extensive powers for content regulation and surveillance.

This amendment was a response to the evolving digital threat landscape and the need for a more robust legal deterrent against online malicious activities, making it far more impactful from a regulatory and punitive standpoint.

Why it is tested: Crucial for understanding the evolution of cyber laws in India, the government's response to emerging digital challenges, and the constitutional implications of expanded state powers. Essential for GS-II (Polity, Fundamental Rights) and GS-III (Internal Security, Cyber Laws).

Information Technology Act 2000 vs IT Act 2000 (Data Protection Provisions) vs. Digital Personal Data Protection Act 2023

Open IT Act 2000 (Data Protection Provisions) vs. Digital Personal Data Protection Act 2023

Aspect	Information Technology Act 2000	IT Act 2000 (Data Protection Provisions) vs. Digital Personal Data Protection Act 2023
Scope	Limited to 'sensitive personal data or information' handled by 'corporate bodies' (Section 43A) and general breach of confidentiality (Section 72).	Comprehensive, covers all 'personal data' processed by 'data fiduciaries' (entities determining purpose/means of processing) in India, and extraterritorial application for certain processing.
Legal Basis	Statutory liability for negligence (Section 43A) and criminal offense for unauthorized disclosure (Section 72).	Rights-based framework, establishing rights of 'data principals' and obligations of 'data fiduciaries'.
Key Principles	Focused on 'reasonable security practices and procedures'.	Based on consent, purpose limitation, data minimization, accuracy, storage limitation, reasonable security safeguards, and accountability.
Enforcement Body	Adjudicating Officer for Section 43A, courts for Section 72.	Data Protection Board of India.
Penalties	Compensation for affected person (Section 43A), imprisonment/fine (Section 72).	Significant monetary penalties for non-compliance, up to Rs. 250 crore per instance.
Consent	Implied in some contexts, not explicitly defined for data processing.	Explicit and informed consent is a cornerstone, with specific conditions for valid consent.
Data Principal Rights	No explicit rights for individuals over their data.	Introduces rights like right to access, correction, erasure, grievance redressal, and nomination.
Supersession	Section 43A repealed by DPDP Act 2023.	DPDP Act 2023 largely supersedes IT Act's data protection provisions, becoming the primary law.

While the IT Act 2000 (specifically Section 43A) made an initial attempt to address data protection by holding corporate bodies liable for negligence, its scope was limited. The Digital Personal Data Protection Act 2023 represents a paradigm shift, establishing a comprehensive, rights-based framework for personal data.

It moves beyond mere compensation for data breaches to define explicit rights for individuals (data principals) and stringent obligations for entities processing data (data fiduciaries). The DPDP Act's principles of consent, purpose limitation, and accountability, along with its dedicated enforcement body and substantial penalties, make it a far more robust and modern legislation, effectively taking over the primary role of data protection from the IT Act.

Why it is tested: Crucial for understanding the evolution of data protection in India, the interplay between different laws, and the constitutional right to privacy. Essential for GS-II (Polity, Fundamental Rights) and GS-III (Internal Security, Cyber Laws, Governance).

Questions students ask

8 answered on this topic.

What are the main objectives of Information Technology Act 2000?

The primary objectives of the Information Technology Act 2000 are multifaceted. Firstly, it aims to provide legal recognition for electronic transactions, facilitating e-commerce and e-governance by giving legal validity to electronic records and digital signatures.

Secondly, it seeks to create a secure legal environment for electronic communication and data storage. Thirdly, it defines and prescribes penalties for various cybercrimes, thereby deterring malicious activities in the digital space.

Lastly, it establishes a regulatory framework for Certifying Authorities and a mechanism for dispute resolution through Adjudicating Officers and the Cyber Appellate Tribunal, ensuring trust and confidence in the digital ecosystem.

Which sections of IT Act 2000 deal with cyber crimes?

Several key sections of the IT Act 2000, particularly after the 2008 amendment, deal with cybercrimes. Prominent among these are Section 43 (penalty for damage to computer systems, unauthorized access), Section 66 (computer-related offenses like hacking, data theft with malicious intent), Section 66C (identity theft), Section 66D (cheating by personation), Section 66E (violation of privacy), Section 67 (publishing or transmitting obscene material), Section 67A (publishing sexually explicit acts), Section 67B (child pornography), and Section 84A (cyber terrorism).

These sections define specific offenses and prescribe corresponding penalties, ranging from fines to imprisonment.

Why was Section 66A of IT Act declared unconstitutional?

Section 66A of the IT Act was declared unconstitutional by the Supreme Court in the landmark Shreya Singhal v. Union of India case (2015) primarily because it violated Article 19(1)(a) of the Indian Constitution, which guarantees freedom of speech and expression.

The court found the language of Section 66A to be vague and overbroad, criminalizing online content that could cause 'annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred or ill will.

' These terms were not clearly defined, leading to arbitrary application and a chilling effect on legitimate online discourse. The court ruled that it did not fall within the reasonable restrictions permitted under Article 19(2).

How does IT Act 2000 regulate electronic evidence?

The IT Act 2000 significantly amended the Indian Evidence Act, 1872, by introducing Section 65B, which specifically deals with the admissibility of electronic records as evidence. This section provides that any information contained in an electronic record, which is printed on a paper, stored, recorded, or copied in optical or magnetic media produced by a computer, shall be deemed to be a document and shall be admissible in any proceedings, without further proof or production of the original, if certain conditions are satisfied.

These conditions primarily ensure the integrity and authenticity of the electronic record, such as the computer being in proper working order and the information being regularly fed into it. This provision is crucial for prosecuting cybercrimes.

What is the role of Cyber Appellate Tribunal under IT Act?

The Cyber Appellate Tribunal (CAT) was established under the IT Act 2000 to hear appeals against the orders of the Adjudicating Officers and the Controller of Certifying Authorities. Its primary role was to provide a specialized and speedy mechanism for resolving disputes related to cyber law, electronic transactions, and digital signatures.

The CAT was designed to have expertise in both legal and technical aspects of cyber law. However, with the enactment of the Finance Act, 2017, the functions of the CAT were transferred to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT), making TDSAT the appellate body for IT Act matters.

Appeals from TDSAT lie with the High Court.

How does IT Act 2000 protect personal data?

Initially, the IT Act 2000 protected personal data primarily through Section 43A and Section 72. Section 43A, introduced in 2008, made corporate bodies liable to pay compensation if they failed to implement reasonable security practices and procedures while handling sensitive personal data, leading to wrongful loss.

Section 72 criminalized the breach of confidentiality and privacy by unauthorized disclosure of electronic records. However, with the enactment of the Digital Personal Data Protection Act, 2023, Section 43A has been repealed, and the DPDP Act now serves as the comprehensive legal framework for personal data protection in India, largely superseding the IT Act's role in this domain.

Section 72, however, remains relevant for unauthorized disclosure of information.

What are the penalties for hacking under IT Act 2000?

The IT Act 2000 addresses hacking primarily through Section 43 and Section 66. Section 43 deals with civil liability for unauthorized access, downloading, introduction of viruses, disruption, and other forms of digital trespass, making the perpetrator liable to pay compensation.

If these acts are committed 'dishonestly or fraudulently' with the intent to cause wrongful loss or damage, they become criminal offenses under Section 66. The punishment under Section 66 can include imprisonment for a term which may extend to three years, or with a fine which may extend to five lakh rupees, or with both.

The severity of the penalty depends on the nature and extent of the damage or loss caused.

What is intermediary liability under IT Act?

Intermediary liability under the IT Act 2000 refers to the legal responsibility of online platforms (like internet service providers, social media companies, search engines, e-commerce sites) for third-party content hosted or transmitted through their services.

Section 79 provides a 'safe harbor' for intermediaries, exempting them from liability for third-party content, provided they observe 'due diligence' and comply with government directions for content removal.

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, further elaborate on these due diligence requirements, mandating grievance redressal mechanisms, content moderation, and cooperation with law enforcement, thereby shaping the extent of their responsibility.