Is face search legal in India?

India regulates face search through three bodies of law that do not yet fully overlap. The Digital Personal Data Protection Act 2023 (DPDP Act) governs how a company may process personal data, and most of its duties take effect in 2027. The Information Technology Act 2000 and the rules under it govern intermediaries and define the offences for misusing someone's images. The Bharatiya Nyaya Sanhita 2023 (BNS), which replaced the Indian Penal Code in 2024, covers stalking and voyeurism. Behind all three stands the Supreme Court's 2017 ruling that privacy is a fundamental right. This page extends the overview on is face search legal with the Indian detail as of November 2026.

Is privacy a fundamental right in India?

Yes. On 24 August 2017, in Justice K.S. Puttaswamy v. Union of India, a nine-judge bench of the Supreme Court held unanimously that the right to privacy is a fundamental right protected under Article 21 and Part III of the Constitution, overruling earlier decisions that had said otherwise. The judgment recognised informational privacy and the individual's control over personal data, and it is the reason the DPDP Act exists. It binds the state directly; private companies are reached through the statutes below.

What does the DPDP Act 2023 change?

The DPDP Act is India's first comprehensive data protection law. It requires a data fiduciary, the company deciding how personal data is processed, to have consent or a listed legitimate use, to give notice, to delete data when its purpose is served, and to report breaches, and it gives data principals rights of access, correction, erasure and grievance redress, enforced by a Data Protection Board with penalties up to INR 250 crore per breach.

• Phased commencement. The DPDP Rules 2025 were notified in November 2025. The provisions setting up the Data Protection Board took effect at once, consent manager registration follows twelve months later in November 2026, and the remaining duties on data fiduciaries, including notice, consent, erasure and breach reporting, apply from May 2027.
• No special category for biometrics. Unlike the GDPR, the Act does not single out biometric data. A face template is personal data like any other, which means consent or a legitimate use is needed but no heightened condition applies.
• The public data exclusion. Section 3(c)(ii) says the Act does not apply to personal data that the data principal has made, or caused to be made, publicly available. Commentators read this as covering a photo you posted to a public profile, and note that the Rules do little to narrow it. It is the provision most relevant to face search in India: an engine indexing photos people published themselves may sit outside the Act altogether, while photos published by others do not. How the Board reads it will only become clear once the Act is fully in force.
• Children. Processing a child's data needs verifiable parental consent, and tracking or targeted advertising to children is prohibited.

Which IT Act offences cover misuse of your photos?

How fast must platforms remove impersonation and morphed images?

The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 gave every intermediary a duty to remove, within 24 hours of a complaint, content that shows a person in a state of nudity or sexual act without consent or that impersonates them, including artificially morphed images. The Information Technology Amendment Rules 2026, notified on 10 February 2026 and in force from 20 February 2026, shortened the clocks: content flagged by a court or an authorised government officer must come down within three hours instead of thirty-six, non-consensual intimate and impersonation content within two hours, and grievances must be resolved within seven days instead of fifteen. The same amendment requires synthetically generated content to be labelled and large platforms to detect and mark AI-generated material. Commentators disagree on which sub-rule carries the two-hour duty, so cite the gazette text in a complaint rather than a rule number. Practical steps for using these routes are on fake profile and intimate image abuse.

What do the BNS stalking and voyeurism sections say?

The Bharatiya Nyaya Sanhita 2023 carried the Indian Penal Code's offences forward with new numbers. Section 77 (formerly IPC 354C) punishes voyeurism: watching or capturing the image of a woman engaged in a private act where she would reasonably expect privacy, and disseminating such an image. Section 78 (formerly IPC 354D) punishes stalking, which expressly includes monitoring a woman's use of the internet, email or any other form of electronic communication. Using a face search to track someone's accounts and movements against her wishes is the conduct section 78 describes. Commentaries differ on whether the stalking offence is bailable in its new form, so check the BNS schedule.

Where do you report a fake profile, a matrimonial scam or extortion?

Report the account inside the platform first, then file a complaint on the National Cybercrime Reporting Portal at cybercrime.gov.in, which takes reports of fake profiles, morphed images, sextortion and fraud and routes them to the state police. For money lost to a scam, call the helpline 1930 as soon as possible; it is dedicated to financial cyber fraud and works with banks to freeze transfers. The Indian Cybercrime Coordination Centre's advisory of 31 October 2025 on matrimonial fraud describes profiles posing as NRIs, defence personnel or employees of well-known companies, and recommends a reverse image search on their photos before trusting them; the matrimonial profile check page shows how to do that with a face search.

Searching your own face versus someone else's

How does this apply to FaceSearch?

FaceSearch searches only publicly accessible pages and returns the pages where a similar face appears, with no names and no identity claims. Your upload is stripped of metadata, used only for your search and never used to build a face database, so your own biometric data does not enter any index through us. Anyone in India can be excluded from results for free by email through remove my photos, and the privacy by design page sets out what we store and for how long. Our acceptable use rules prohibit stalking, impersonation, searches for anyone under 18 and any employment, tenancy, credit or insurance use, whether or not Indian law yet requires it. We will update this page as the DPDP Act's remaining provisions commence in 2027.