Someone Posted My Phone Number Online: Legal Steps in India

The phone started ringing at 6:14 AM. An unknown number. The caller breathed heavily, said something filthy, and hung up. By 6:30 AM there had been four more. By 8 AM, twenty-two. The reader put the phone face-down and went to wash her face. When she came back, there was a message from a friend: "Did you see what someone posted in the locality WhatsApp group? Your number is on it. With a caption."

This is doxxing, Indian style. Sometimes a former boyfriend who could not handle a no. Sometimes a colleague after a workplace argument. Sometimes a stranger from a hate page. The mechanics are similar. A photo, a number, a caption inviting calls, and a slow-motion afternoon of strangers calling from places you have never been. The good news is that Indian law has clean, well-tested provisions to handle exactly this. The bad news is that nobody tells you about them in school.

What This Article Will Answer

If you have just discovered that your phone number is on a public site, a closed group or a screenshot doing the rounds, here is the order of questions running through your head:

1. Is the bare posting of my number even a crime?
2. Which IPC and IT Act sections does it fall under?
3. Can I get the post taken down before the FIR is even filed?
4. Should I file a cyber complaint, an FIR, or both?
5. What if it is a closed group, not a public site?
6. Does the new DPDP Act 2023 help me?
7. How do I save screenshots so they hold up in court?

We will work through these in order, ground each answer in a section or a case from the source material, and end with a clean ten-step checklist for the next twenty-four hours.

Is It Actually a Crime?

The honest answer is: it depends on the framing of the post. The bare publication of a phone number, in isolation, is not by itself a separate offence under the IPC. Where the post is criminal is in the surrounding language, the implied invitation, and the harm that follows. Indian courts have approached this practically — they look at whether the post was made with the kind of intent the IPC sections describe.

The Allahabad High Court in Jodh Singh v State of UP, 1991 Cr LJ 3226 held that for offences of insult and abuse the actual words used must be set out in the complaint. So when you save the screenshots, save the entire caption — the words around the number matter as much as the number itself.

One important rider. Section 66A of the IT Act used to broadly criminalise "grossly offensive or menacing" online communications, and would once have applied here. It was struck down by the Supreme Court in Shreya Singhal v Union of India, AIR 2015 SC 1523. Police cannot use it any more. If an officer suggests it, politely insist on the IPC sections and Section 67 of the IT Act instead.

IPC Sections That Usually Apply

Section 504 IPC — intentional insult to provoke breach of public peace. Where the post abuses you, calls you names, attacks your character, and is calculated to provoke a reaction, Section 504 is squarely attracted. The section requires two essentials: an intentional insult, and an intent or knowledge that the insult will provoke breach of peace or commission of an offence. As the Patna High Court underlined in Shiv Sundar Bharti v State of Bihar, 2017 (1) Crimes 351 (Pat), the actual abusive words must be spelled out in the complaint, otherwise the court cannot judge whether the line into "intentional insult" has been crossed. Punishment is up to two years.

Section 506 IPC — punishment for criminal intimidation. Where the post explicitly or implicitly threatens you, your reputation or your family, Section 503 is attracted, and Section 506 prescribes the punishment — up to two years for ordinary criminal intimidation, going up to seven years if the threat is of death, grievous hurt, fire-destruction of property or imputing unchastity to a woman. The Supreme Court in Manik Taneja v State of Karnataka, (2015) 7 SCC 423 clarified that mere expression of words without intention to alarm is not enough — but where the post invites strangers to call and harass, the intent to alarm is plainly visible from the post itself.

Section 509 IPC — word, gesture or act intended to insult the modesty of a woman. Where the victim is a woman, this section is the workhorse. It punishes any word, sound or gesture, or any object exhibited, with intent to insult her modesty or to intrude upon her privacy. Punishment is simple imprisonment up to three years and a fine. As the Supreme Court observed in S Khushboo v Kanniammal, AIR 2010 SC 3196, the section requires that the modesty of a particular woman or a readily identifiable group of women has been insulted. Where the post pairs the woman's number with a sexual caption, the link is obvious.

Where the offender repeats the conduct — fresh posts from new accounts after each takedown — Section 354D for stalking, both physical and digital, gets attracted. On a second occurrence, Section 354D is cognizable and non-bailable.

IT Act Sections 66E and 67

Where the post pairs the phone number with private intimate images, two further sections of the Information Technology Act, 2000 apply.

Section 66E of the IT Act — punishment for violation of privacy — punishes any person who intentionally captures, publishes or transmits the image of a private area of any other person without consent, under circumstances violating that person's privacy. Punishment is up to three years and a fine up to two lakh rupees. The Explanation defines "private area" narrowly to mean naked or undergarment-clad genitals, pubic area, buttocks or female breast. So Section 66E catches posts that include sexually explicit imagery of the victim. As the source commentary records, the section was specifically enacted to address what the law calls "video voyeurism" — peeping toms, spy cameras, hidden web cameras and the MMS culture.

Section 67 of the IT Act — punishment for publishing or transmitting obscene material in electronic form — has a wider sweep. It punishes the publication or transmission of any material that is lascivious, appeals to the prurient interest, or tends to deprave and corrupt those likely to see it. First conviction is up to three years and a fine up to five lakh rupees; a second conviction goes up to five years and ten lakh. Section 67 applies whether or not the imagery falls within the narrow Section 66E definition of "private area".

Sending the Section 79 Takedown Notice

Before — or in parallel with — going to the police, send a takedown notice to the platform. This is often the fastest way to get the post offline.

Section 79 of the IT Act gives intermediaries — Facebook, Instagram, X, Telegram, Reddit, classified-ad sites, even WhatsApp for group hosting — a safe harbour from liability, but only as long as they observe due diligence. The Supreme Court in Shreya Singhal v Union of India (2015) read down Section 79(3)(b) to require platforms to expeditiously remove unlawful content once they have actual knowledge from a court order or a notification by the appropriate government or its agency.

In practice, the grievance mechanism set up by the Intermediary Rules, 2021 (under Section 79) requires every significant platform to publish a Grievance Officer with an Indian address and phone number. The grievance officer must acknowledge a complaint within twenty-four hours and act within strict timelines, typically fifteen days. For specific categories like nudity or impersonation, action is required even faster. Address the notice to the grievance officer, attach the URLs, identify the offending content, and invoke IPC Sections 504, 506 and 509 along with IT Act Sections 66E and 67 as the legal grounds.

FIR, Zero-FIR or Cyber Complaint

Three doors are open. Use as many as you can.

One. The cyber complaint at cybercrime.gov.in. Open twenty-four hours, accepts file uploads, and routes the matter to the relevant cyber cell. The national helpline 1930 is for urgent financial-fraud matters but can also flag harmful posts.

Two. The FIR at the police station. BNSS Section 173 — which has replaced CrPC Section 154 — governs FIR registration for cognizable offences. The BNSS_CrPC Correspondence Table records that BNSS Section 173 has expanded the scope by adding the words "irrespective of the area where the offence is committed", squarely codifying the zero-FIR principle. So if the offender is in another city, the police where you live cannot turn you away — they must register the FIR and forward it.

Three. If the SHO refuses to register, escalate. BNSS Section 173(4), which has replaced CrPC Section 154(3), allows you to send the substance of your information to the Superintendent of Police. The SP must investigate, or direct an investigation, where a cognizable offence is disclosed. If the SP also fails, file a private complaint before the jurisdictional Magistrate under BNSS Section 223 (old CrPC Section 200) and request investigation under BNSS Section 175(3) (old CrPC Section 156(3)). Where the post has crossed into actual threats, treating the doxxing as part of a wider pattern of online harm ensures none of the conduct slips through.

A Word on the DPDP Act 2023

The Digital Personal Data Protection Act 2023 introduced, at a principle level, the concept of consent-based processing of personal data and a Data Protection Board with the power to adjudicate breaches and award compensation. A phone number is personal data. Where a private individual has posted the number maliciously, the DPDP Act creates a regulatory layer on top of the IPC and IT Act criminal route.

The honest position, however, is that the DPDP Act regime is still being operationalised, and most online-harm victims will get a faster result through the IPC and IT Act criminal track combined with the platform takedown notice. Save the DPDP angle for the civil compensation phase, after the post is offline and the criminal complaint is on its way. Your lawyer will tell you when the regulatory route is ripe in your specific case.

What Should I Actually Do Now?

If you are reading this with a doxxing post live and your phone ringing, here is the action sequence — in order, no skips:

1. Screenshot the post. The whole post, with the URL, the user handle, the date and time visible. Save the page itself — Ctrl-S in browser saves the HTML.
2. Email the screenshots to yourself the same day, so a server-stamped copy exists outside your phone.
3. Do not delete the abusive incoming calls or messages. They are evidence that the post produced harm.
4. Send a takedown notice to the platform's grievance officer. Quote IPC 504, 506, 509 and IT Act 66E and 67. Demand expeditious removal under the Intermediary Rules.
5. File a cyber complaint at cybercrime.gov.in. Save the acknowledgment number.
6. Walk into the nearest police station and lodge an FIR under IPC 504, 506, 509 and (where relevant) IT Act 66E and 67. Quote BNSS Section 173 — including the zero-FIR principle if the offender is elsewhere.
7. If police refuse, escalate to the Superintendent of Police under BNSS Section 173(4), and then to the Magistrate under BNSS Section 223 read with Section 175(3).
8. Switch the harassed phone to "silence unknown callers" mode, but do not change the number — outgoing call records of the offender's harassment are evidence.
9. Tell one trusted person at home and one at work. The shame strangers want you to feel is not yours; it belongs to the person who posted.
10. Talk to a lawyer the same day about a civil suit for permanent injunction and damages. The court can also order the platform to suppress further re-posts.

Talking to a Lawyer

Doxxing cases move fast in the first forty-eight hours and slow down dramatically thereafter. Screenshots have to be saved correctly. The takedown notice has to cite the right rules to actually compel platform action. The FIR has to use sections that the police are familiar with — 504, 506, 509 and IT Act 67 are well-trodden ground; insisting on Section 66A would only delay registration. None of this is impossible to do alone, but it is harder when your phone is ringing every two minutes.

If you would prefer to have someone walk you through it, the team at Pinaka Legal handles this category of matter from Delhi and works with cyber cells in multiple states. The first conversation is confidential and free of cost; most of it is about getting the right notice out before the close of business that day.

Frequently Asked Questions

Is it a crime in India to post someone's phone number online without consent?

It can be, depending on the context. The bare posting of a number, framed as a casual mention, may not by itself be a criminal offence. But the moment the post invites strangers to call, abuses or insults the person, threatens her, or pairs the number with private intimate content, several IPC sections come into play — Section 504 for intentional insult to provoke breach of peace, Section 506 for criminal intimidation, Section 509 for word or gesture intended to insult the modesty of a woman, and IT Act Sections 66E and 67 where intimate images are involved.

What is the difference between someone posted my phone number online legal steps in india and a defamation case?

They are separate tracks. The doxxing route — IPC 504, 506 and 509 with IT Act provisions — focuses on the criminal nature of the post and the threats or insults that flowed from it. The defamation route under Section 499/500 of the IPC focuses on whether the post lowered the victim's reputation. Most realistic cases run both tracks in parallel — the criminal complaint to stop the conduct and the civil suit for damages and a permanent injunction. The takedown notice to the platform is a third, separate, faster lever.

What is a Section 79 takedown notice and how do I send one?

Section 79 of the IT Act gives intermediaries — Facebook, Instagram, Telegram, X, classified-ad sites — a safe harbour from liability, but only if they observe due diligence. The Supreme Court in Shreya Singhal v Union of India (2015) read down Section 79(3)(b) to require platforms to expeditiously remove unlawful content once they have actual knowledge from a court order or a notification by the appropriate government or its agency. So a takedown notice — addressed to the platform's grievance officer, identifying the URL, the unlawful content and the legal grounds — is the correct first step.

My ex posted my phone number on Facebook with a sexual caption. What sections apply?

This is a layered offence. Section 509 of the IPC applies because it punishes any word or gesture intended to insult the modesty of a woman, including by exhibiting any object intending that it be seen by her. Section 504 applies because of the intentional insult. Section 67 of the IT Act applies because it punishes the publication of lascivious or prurient material in electronic form. Where intimate images are paired with the number, Section 66E of the IT Act applies. Section 354D for stalking — both physical and digital — gets attracted on repetition.

Can I file a cyber complaint if my phone number was posted in a private WhatsApp group?

Yes. The publication does not have to be to the whole world. The Allahabad High Court in Jodh Singh v State of UP (1991) held that even a complaint to a closed audience can amount to an offence if the actual words used are insulting and clothed with the requisite intent. A WhatsApp group of strangers, a Telegram channel, a closed Reddit thread or a paid-classifieds site are all "public" enough for Sections 504, 506 and 509 of the IPC. The screenshots from the group are admissible electronic evidence under Section 65B of the Evidence Act.

Cyber complaint or FIR — which one should I file first when my number is posted online?

File both. The cyber complaint at cybercrime.gov.in is the fastest channel — it accepts file uploads and routes the matter to the cyber cell. The FIR under BNSS Section 173 (which replaced CrPC Section 154) is the formal step that triggers the police investigation. Where the post has already led to abusive calls and threats, walk into the police station first — speed matters more than the portal. The takedown notice to the platform is a third, parallel step and should be sent on the same day.

What if the police refuse to take my complaint about phone number posted online?

You have a clear next step. BNSS Section 173(4) — the new procedural provision that replaced CrPC Section 154(3) — allows you to send the substance of your information to the Superintendent of Police by post or email. The SP must either investigate himself or direct an investigation if a cognizable offence is disclosed. If the SP also fails, file a private complaint before the jurisdictional Magistrate under BNSS Section 223 (old CrPC Section 200) and request investigation under BNSS Section 175(3) (old CrPC Section 156(3)).

What is a zero-FIR and when do I need it?

Zero-FIR is the principle that a police station must register the FIR even if the offence happened outside its territorial jurisdiction. The BNSS_CrPC Correspondence Table records that BNSS Section 173 has expanded the scope by adding the words "irrespective of the area where the offence is committed", squarely codifying zero-FIR. So if the offender is in another city, the police where you live cannot turn you away — they must register the FIR and forward it to the police station of jurisdiction.

Does the DPDP Act 2023 cover this kind of doxxing?

At a principle level, yes. The Digital Personal Data Protection Act 2023 introduces the concept of consent-based processing of personal data and creates a Data Protection Board with the power to award compensation. A phone number is personal data. Where a private individual has posted the number maliciously, the DPDP Act adds a regulatory layer on top of the IPC and IT Act criminal route. But the IPC and IT Act remedies remain the workhorse — the DPDP regime is still being operationalised, and the criminal track is faster for an immediate stop.

How do I save the screenshots so they are admissible in court?

Screenshot the offending post with the URL, the user handle, the date and time visible. Save the post page itself — Ctrl-S in browser preserves the HTML. Email the screenshots to yourself the same day. Section 65B of the Indian Evidence Act, as confirmed by the Supreme Court in Anvar P V v P K Basheer (2015), requires a certificate identifying the device, the working condition of the device, and that the printout is a true copy. Your lawyer will draft the certificate; do not delete the original from your phone.

Can I get the post taken down before the FIR is filed?

Yes. The takedown notice to the platform is independent of the FIR. Send a written grievance to the platform's grievance officer, attach the URLs of the offending posts and identify the legal grounds — IPC 504, 506, 509, IT Act 66E, 67 — and request expeditious removal. Under the Intermediary Rules, the grievance officer is required to acknowledge within twenty-four hours and act within strict timelines. If the platform does not respond, the FIR and a court order under Section 79 of the IT Act force compliance.

What punishment does the law prescribe for posting someone's number online with abuse?

Section 504 of the IPC carries up to two years for intentional insult to provoke breach of peace. Section 506 of the IPC carries up to two years for ordinary criminal intimidation, going up to seven years if the threat is grave. Section 509 carries up to three years and a fine for word or gesture insulting modesty of a woman. Section 66E of the IT Act carries up to three years for image-based privacy violation. Section 67 carries up to three years on first conviction and up to five years on a second.

Written by the Pinaka Legal Editorial Team. For queries, call +91 8595704798 or email info@pinakalegal.com. For more articles on Indian law, visit the Pinaka Legal Blog.