Revenue from operations rose 18% to Rs 1242.3 crore from Rs 1,051.2 crore in Q2 FY26, according to its financial statements sourced from the NSE.

The edtech firm also earned other income of Rs 92.4 crore, taking its total revenue to Rs 1,334.6 crore.

“This quarter shows the strength of our model. We delivered record revenue and a sharp improvement in profitability, while our learner base kept widening across K-12, vernacular and new categories. Our focus remains on scaling affordable, tech-led education with disciplined capital allocation,” said Alakh Pandey, founder and CEO of PhysicsWallah.

PhysicsWallah’s omnichannel playbook

PhysicsWallah is an omnichannel education platform, catering to students online through PW, CuriousJr and YouTube as well as offline via Vidyapeeth, Pathshala and other PW centers.

The online business remains a key growth driver for the company, with revenue from this vertical rising to Rs 693.5 crore, up 26% from Rs 548.7 crore in the same quarter last year.

In a shareholder letter, PhysicsWallah said NEET enrollments grew over 30% in Q2 FY27, as the demand that had been deferred following the postponement of NEET UG came through during the quarter.

Meanwhile, offline business generated a revenue of Rs 540.9 crore, marking a 9% increase from Rs 496.1 crore in Q2 FY26.

South India contributes 9% of H1 revenue

South India is emerging as the next growth leg for PhysicsWallah, with an addressable market of 15 million students across Andhra Pradesh, Telangana, Tamil Nadu, Karnataka and Kerala.

The company is expanding its online-first playbook in the region through more than 70 regional-language faculty members, free education content across over 24 YouTube channels with roughly 24 lakh subscribers, and paid regional batches.

During H1, learners on the PW app from the south rose 32% year-on-year to 4.1 lakh, while paid learners rose 14% YoY to 1.17 lakh. The edtech currently operates 63 centers in the region.

PhysicsWallah to increase stake in Utkarsh Classes

Aside from the earnings, PhysicsWallah’s board approved the company’s proposal to acquire an additional 12.25% stake in Utkarsh Classes for Rs 2.6 lakh.

The transaction, expected to be completed in three months, will increase PhysicsWallah’s shareholding in the coaching institute to 87.75% from 75.5% currently.

The edtech company had first disclosed its intention to acquire a 100% stake in Utkarsh Classes by FY28 in its November 2025 IPO filing. The move was aimed at strengthening its core education business. In FY26, Utkarsh Classes reported a turnover of Rs 169.7 crore versus Rs 169 crore and Rs 147 crore in FY25 and FY24, respectively.

Where did PhysicsWallah spend in Q2?

Total expenses increased nearly 11% to Rs 1,105.4 crore from Rs 999.6 crore in the same period a year ago. Sequentially, it declined 11% from Rs 1,242.2 crore in the previous quarter.

• Employee benefit expenses: Rose 10% year-on-year to Rs 522.4 crore in Q2 FY27 but dipped 1% QoQ from Rs 526.5 crore.
• Direct expenses: Stood at Rs 164.3 crore, up 6% from Rs 155.1 crore in the year-ago quarter.
• Other expenses: Increased 12% to Rs 237.6 crore, compared to Rs 213.1 crore a year earlier. However, it reduced sequentially by 21% from Rs 299.3 crore.

Key operational metrics

• Total paid users: 3.86 million in Q2 FY27 versus 3.62 million in Q2 FY26
• No. of unique transacting users: 3.44 million in Q2 FY27 versus 3.22 million in the same quarter a year ago.
• Average collection/revenue per user: Rs 4,280 from online and Rs 23,162 from offline business.
• No. of offline student enrolments: 0.41 million in Q2 FY27, up from 0.39 million a year earlier.
• Total offline centers: 370 versus 314 in Q2 FY26.

Also read:

• PhysicsWallah to launch personal AI tutoring services by next quarter
• PhysicsWallah makes U-turn on school, leans on AI for growth: Q4 FY26 earnings

The post PhysicsWallah clocks Rs 144 cr profit in Q2FY27, revenue up 18% appeared first on MEDIANAMA.

According to an exclusive report by Head and Tale’s Arti Singh, the RBI reportedly held a nearly two-hour meeting with banks on Wednesday and issued a “confidential advisory” dated November 3. The banker told the reporter that the regulator “gave banks a dressing down” and stressed that banks are responsible for securing these arrangements. The banker also stated that individual frauds ranged from Rs. 3 crore to Rs. 15 crore, adding that the number of cyberattack attempts worried banks more.

The confidential RBI advisory reportedly also asked NBFCs which use APIs for a security audit by CERT-In empaneled auditor. These are the independent auditing companies which are approved by the Ministry of Electronics and Information Technology (MeitY). A full list of cybersecurity organizations which are listed on CERT-In’s website can be accessed here.

CERT-In names a threat actor: CERT-In’s November 4 advisory named a threat actor, “CRAFTY FALCON”. It said attackers used Rs. 1 transfers to test fund flows before larger transactions. It also said they bypassed IP allow-listing by routing traffic through shared third-party IP pools. CERT-In recommended beneficiary cooling periods and maker-checker approval for merchant settlements. Similarly, CERT-In has issued similar notices, you can find them here and here.

The next day, after the RBI meeting on November 3, the Indian Cyber Crime Coordination Centre (I4C), which works under the Ministry of Home Affairs (MHA), issued a public advisory on AI-assisted attacks on banks, NBFCs and fintechs. Both concern the application programming interfaces (APIs) that lenders use to disburse money. 

Similarly, on the same day, CERT-In released AI Security Auditing Guidelines. Read MediaNama’s lowdown of the guidelines here. 

The RBI advisory sets the following requirements, according to Arti’s report:

• Maintain a full API client inventory. The regulator has asked banks to capture business profile, services used, account and integration details, transaction limits, and key business, technical and security contacts.
• Require CERT-In audits for NBFC clients. RBI has said the audit must be completed before onboarding new NBFCs, while existing clients have until February 3, 2027.
• Conduct audits at least once a year. The regulator has reportedly asked banks to repeat the audit after any material cyber incident and to track completion and act on non-compliance.
• Risk-assess non-NBFC API clients immediately. RBI also asked banks to require a periodic audit within three months for BCs, PAs, PSPs and fintechs, sooner if risk is higher.
• Brief all API clients every three months on the current threat landscape, as per the regulator’s advisory.
• Bring API transactions under fraud-risk and monitoring frameworks. The regulator has asked banks to set thresholds and behavioural baselines per client.
• Flag material deviations. RBI has said banks must watch for volume or value spikes, transactions just below limits, odd-hour or holiday activity, bursts of new beneficiaries, mule patterns, failed log-ins and invalid API requests.
• Monitor changes in apps. The regulator has asked banks to watch for changes in user-agent, app version, OS and network attributes, with technical changes due by December 3.
• Secure banks’ own API infrastructure. The regulator has said banks must cover access management, network segmentation, patching and monitoring, as attackers may pivot through a compromised client.
• Enforce beneficiary whitelisting. RBI has also asked banks to pre-register verified end-customer accounts per client, reject unregistered payouts, and allow additions or modifications only via a separate MFA-protected channel.
• Enforce maker-checker or out-of-band confirmation. The regulator has said banks must add extra authorisation for API debit requests via a separate channel, applying it to all transactions or those above a risk-based threshold.
• Require at least one safeguard from regulated entities using API-based fund transfers. The regulator has said new integrations must comply before they go-live, while existing ones have time until December 3, 2026.
• Make debit information available quickly so clients can reconcile transactions one by one, as per the regulator’s direction.
• Allow narrow, case-by-case exceptions only for highly automated payments where neither control is practical. The regulator has said a written application and documented risk assessment are required.
• Set per-transaction and daily cumulative limits effective immediately. The regulator has asked banks to calibrate them to declare and observe business profile and risk.
• Implement intra-day or velocity limits within one month to prevent bursts of transactions. RBI has said material limit increases need a documented risk assessment.
• Treat maker-checker as a compensating safeguard for intra-day limits if commensurate with risk and documented, as the regulator has allowed.
• Enforce immediate incident reporting and recovery. It has asked banks to ensure clients promptly report any actual or suspected compromise of systems connected to API-based payments.

‘AI agentic driven cyberattacks concerns CERT-In’

CERT-In Director General Dr Sanjay Bahl, in written answers to MediaNama on November 2 and 3, described what worries the agency. He said that “delegated authority without commensurate guardrails and that AI agents are being trusted faster than they are being secured” concerns India’s nodal cyber security agency.

Note: MediaNama’s interview predates the RBI’s confidential advisory becoming public. Read the full interview here.

“What would change is the speed, scale and level of automation at which cyber activities take place. Defensive capabilities would therefore need to evolve accordingly from human-speed monitoring and manual containment to continuous, automated machine-speed defence.” – CERT-In Director General, Dr Sanjay Bahl.

MediaNama’s recent coverage related to cybersecurity issues and data breaches:

1. AU Small Finance Bank is probing a “potential data leak” on a Salesforce-hosted platform after hackers claimed a breach. The bank says its systems are unaffected.
2. CoinDCX first dismissed reports of a breach, then confirmed a loss of about Rs. 152 crore.
3. Central Bank of India alleges hackers siphoned off Rs. 13.97 crore through its financial messaging system. It says it could not trace 187 transfers.
4. SBI confirmed a suspected breach of 3,897 customer records. Later they revealed that the customers have been informed through email and/or WhatsApp.
5. CBFC reportedly exposed scripts, distribution deals and censorship records for over 500 films. The board says it found no trace of the documents.
6. Amagi Media Labs faced an extortion attempt from a hacker claiming to hold operational and network data.
7. eMudhra is exiting the SSL/TLS certificate business days after researchers exposed weak private keys in eight intermediate certificates.
8. Railway, a cloud hosting platform, asked users to replace API keys after a cyberattack potentially exposed customer secrets.
9. CERT-In disclosed that AI agents accessed live Indian systems without authorisation during research and evaluation.
10. Anthropic said its Claude model found vulnerabilities across five targets, including Chrome, Android, Windows and Linux. It has not disclosed its success rate or computing costs.

Also read:

• CERT-In flags an AI threat actor targeting BFSI payment APIs
• Interview: CERT-In chief on AI agent incidents

The post RBI meets bankers amidst rising AI cyber-attacks, mandates security audits appeared first on MEDIANAMA.

The Telecom Regulatory Authority of India (TRAI) on November 5, 2026, released recommendations on a framework for Satellite Communication Network (SCN) provider authorisation and spectrum assignment. The recommendations propose a new authorisation category for satellite network providers, who would supply network capacity to eligible telecom service providers rather than directly serve users. Alongside the proposed framework, TRAI has set out security conditions governing network control, monitoring, gateway infrastructure and the use of satellite networks for cross-border services.

Network Control Facilities Must Be Located in India: TRAI has recommended that the operation, maintenance and control facilities for an SCN provider’s satellite communication network be located in India. The requirement would also cover user terminals belonging to partnering authorised entities that connect to the provider’s network.

SCN providers must ensure that their networks are used only to deliver telecommunications services for which the partnering entity holds authorisation. They must also prevent their networks from being used for unauthorised activities, including surveillance and electronic warfare, or in a manner that could prejudice India’s sovereignty and security.

The recommendations further require SCN providers to report to the Central Government any attempt to access or use their satellite networks through a user terminal that is not registered with the partnering entity. The report must include information about the terminal and its location.

To meet this requirement, providers must undertake the technical measures necessary to identify and report such attempts. However, TRAI has not prescribed a specific technology, protocol or authentication mechanism for detecting unregistered terminals.

Government Can Direct Security Measures For Satellite Gateways: TRAI has proposed that SCN providers submit the location and technical details of each satellite earth station gateway to the Central Government or a designated agency before establishing it. The government or agency may examine the submitted information and direct the provider to take specific actions in relation to the gateway’s establishment.

The recommendations also require SCN providers to furnish information and conduct interference-monitoring tests, as well as implement mitigation measures, as directed by the government. These provisions would give the government a role in reviewing gateway infrastructure before it is set up and in requiring operational measures where necessary.

Separately, TRAI has recommended that SCN providers offer a real-time traffic monitoring facility to ensure compliance with requirements governing Indian user traffic. This includes restrictions on routing traffic through foreign gateways and on mirroring Indian traffic to foreign satellite or telecom networks.

The recommendations also state that user terminals connected to a partnering authorised entity must not communicate directly through satellites without routing via a satellite earth station gateway. These conditions form part of the technical and operating obligations proposed for SCN provider authorisation.

Direct Terminal Communication And Interference: TRAI has proposed that SCN providers prevent direct communication between two or more user terminals through one or more satellites unless the traffic passes through a satellite earth station gateway. This would apply to terminals connected to partnering authorised entities.

The recommendations also require SCN providers to furnish information and conduct interference-monitoring tests whenever the Central Government requires them to. Providers must take all necessary measures directed by the government to mitigate interference.

These conditions would place responsibility on SCN providers to ensure that satellite network traffic follows the prescribed gateway architecture and that interference can be monitored and addressed through measures mandated by the government.

Also read:

• Why Starlink reapplied for its India satellite network, and why it’s still stuck
• Is Satellite Internet a Viable Business in India? Pricing and Policy Concerns

The post TRAI recommends India-based network control, traffic monitoring for satellite providers appeared first on MEDIANAMA.

Temasek- and PayPal-backed Shiprocket, which listed on stock exchanges in August this year, had reported a loss of Rs 13.7 crore in Q1 FY27. 

Its revenue from operations surged 35% to Rs 673.6 crore in Q2 FY27, compared to Rs 500.2 crore in the year-ago period, according to regulatory filings. On a quarter-on-quarter (QoQ) basis, operating revenue rose 7% to Rs 592.1 crore.

Including other income of Rs 19.9 crore, total income stood at Rs 693.5 crore, up 35% from Rs 514.5 crore in Q2 FY26.

Where the growth came from

The core domestic shipping business generated revenue of Rs 461.4 crore, 25% more than Rs 368.3 crore it had generated in Q2 FY26. This segment has been profitable for some time now. In Q2 FY27, it raked in a profit of Rs 59.1 crore.

The emerging business, which includes cross-border shipping, marketing tech and omnichannel solutions, generated revenue of Rs 212.2 crore, up 61% from Rs 131.9 crore a year earlier. However, the emerging business’s losses widened 8% to Rs 44.9 crore, compared to Rs 41.6 crore in Q2 FY26.

In its investor presentation, the company said omnichannel grew 79% as brands used Shiprocket to replenish quick commerce dark stores. The company said its appointment-based delivery system uses pre-booked slots and provides real-time visibility into purchase orders from platforms such as Blinkit and Zepto.

Martech, now Fastrr (Ads, Checkout and Engage), grew 102% and powers TTM GMV of Rs 9,140 crore. Fewer than 10% of Shiprocket merchants use a Martech product as of September 2026.

AI adoption accelerates

Shiprocket deployed several AI products and features across the merchant journey in Q2 FY27. 

• Aitlas: tracks and improves how brands appear in AI search, a discovery channel for D2C brands.
• Hyper-personalised journeys using AI: retargeting journeys built from a single prompt.
• Features added in Fastrr Checkout: payment-link sharing and discount nudges to lift conversion.
• Shipping analytics: a revamped dashboard that uses AI to identify and fix choked shipping lanes.

The e-commerce enablement platform claims to handle over 14 billion API hits a month.

What the management said

“Indian commerce is splitting across more channels every year. A small brand today sells on its own website and on Instagram, replenishes quick commerce dark stores, and is starting to be found through AI search. For a large company, every new channel means a new team. For a small seller, it means friction. 

Shiprocket is building the infrastructure that removes this friction, so that any MSME in India can sell, ship and grow on the same footing as India’s biggest brands, every channel a switch away on one dashboard. Growing 35% with positive Adjusted EBITDA and operating cash flow shows we can build it from our own operations,” said Saahil Goel, managing director and CEO of Shiprocket.

CFO Tanmay Kumar added, “PAT turned positive this quarter on three drivers. First, scale in Core: transactions grew 31%, and Adjusted EBITDA grew faster than revenue. Second, the Emerging engine kept firing: Martech and Omnichannel, our fastest-growing lines, more than doubled Emerging contribution on 61% revenue growth. Third, a stronger balance sheet: IPO proceeds retired all our borrowings, which cut finance costs, and the surplus now earns interest income.

“We generated Rs 55.1 crore from operations in the first half, more than twice last year, and we are debt-free. Emerging now brings merchants onto the platform on its own, not only through cross-sell from Core. Around 17,300 merchants joined Shiprocket through our Emerging products this quarter, more than three times the number a year ago.”

Zooming into expenses

Revenue growth outpaced the rise in expenditure. Shiprocket’s total expenses increased 30% to Rs 692.9 crore in the September quarter of FY27 from Rs 534.8 crore in the same quarter last year. Sequentially, it rose 12% from Rs 619.5 crore.

• Cost of merchant solutions: Stood at Rs 494.9 crore in Q2 FY27, up 34% from Rs 369.3 crore in the year-ago period.
• Employee benefits expense: Rose 8% to Rs 103.9 crore from Rs 95.9 crore in Q2 FY26.
• Other expenses: Went up 29% to Rs 64.3 crore, compared with Rs 49.7 crore a year earlier. The company did not provide a breakdown of these expenses.

Key operational metrics – Q2 FY27

• Active merchants: Increased to 236,116 from 194,435 in the year-ago quarter.
• Power merchants: Declined to 10,150 from 10,333 in Q2 FY26. Power merchants are those with an average of more than 100 unique transactions per active month.
• Power merchants ARPU (average revenue per user): Rose to Rs 19.1 lakh, up from Rs 15.1 lakh a year earlier.
• End consumers served: 78 million, of which 34 million were new, and 45 million were repeat consumers.
• Customer acquisition cost: For the core business, the figure stood at Rs 3,604, while for the emerging business, it was Rs 5,399.
• New merchants who joined Shiprocket’s platform via the emerging business: Rose to 17,281, compared with 5,396 in Q2 FY26.

Also read:

• Beyond earnings: Shiprocket bets on quick commerce, AI to drive next phase of growth
• Shiprocket cuts Q1 loss to Rs 13.7 crore, revenue nears Rs 600 crore post IPO

The post Shiprocket swings to profit in Q2, revenue rises 35% to Rs 674 cr appeared first on MEDIANAMA.

Revenue from operations surged 35.7% to Rs 2,845 crore from Rs 2,096.1 crore in the July-September 2025 period, according to regulatory filings.

Sequentially, profit grew 1.8% from Rs 228.4 crore, while operating revenue increased 4.8% from Rs 2,714.2 crore.

The company also earned other income of Rs 54.5 crore, pushing its total revenue to Rs 2,899.5 crore.

Lenskart’s EBITDA jumped 46.6% year-on-year (YoY) to Rs 624 crore, with margins expanding to 21.9%.

“The structural investments we have made over the past few years – increased-house manufacturing of frames and lenses, and centralised manufacturing – are helping us sustain this margin,” the eyewear retailer said in its shareholder letter.

India business gathers pace

Lenskart’s India business generated Rs 1,668 crore, accounting for 58.6% of consolidated operating revenue, while the segment’s profit before tax stood at Rs 208.4 crore.

The company attributed the growth to a 26.5% increase in eyewear units sold and rising demand for premium lenses. Its India business recorded same-store sales growth (SSSG) of 20.8% and sales-per-store growth (SPSG) of 27.1% during the quarter.

Lenskart added 143 net new stores in India, including 94 in Tier 2+ markets, and entered 61 new cities. Its India network now spans 2,868 stores across 665 cities. The company conducted 70.3 lakh eye tests in India, up 44.1% YoY, and sold 85.5 lakh eyewear units, up 26.5% YoY.

Lenskart’s active Gold memberships reached 1.03 crore as of September 2026, with Gold subscription fees of Rs 73 crore.

The eyewear retailer is also building a manufacturing facility in Hyderabad as part of its efforts to expand in-house manufacturing capabilities and cater to growing international demand.

Frames manufactured in-house across its India, China and Thailand units rose to 36 lakh in Q2 FY27, up 71.4% from 21 lakh in the year-ago period. Lenses manufactured in-house rose 53.8% to 20 lakh in the quarter, compared with 13 lakh in Q2 FY26.

Lenskart expands international presence

During the quarter, Lenskart conducted 8.4 lakh eye tests in international markets, up 15% YoY. The number of eyewear units sold increased 29.6% in Q2 FY27 to 20.6 lakh from 15.9 lakh a year earlier.

Lenskart’s international revenue increased 36.5% to Rs 1,201.1 crore in Q2 FY27, compared with Rs 879.6 crore in the same quarter last year. Its segment profit before tax grew more than threefold to Rs 97.2 crore from Rs 31.1 crore in Q2 FY26.

Lenskart added 22 net new stores internationally during the quarter, taking its global store network to 3,624. Of these, 12 were in Southeast Asia, three in the Middle East, two in Japan and five in other markets.

The company said it will also open a Meller store on Via del Corso in Rome later this month.

AI and smart glasses

Technology remains central to Lenskart’s growth strategy. The company said remote optometry is now available in 934 stores across India, compared with 303 a year earlier.

Lenskart is also increasingly deploying AI across functions such as customer service, employee training, inventory planning and manufacturing.

Its smart glasses ‘B’, which were first rolled out in Q4 FY26, are now available in 500 stores across India and online. In October, the company unveiled its first Lenskart evolv concept store in Worli, Mumbai.

A year ago, AI at Lenskart meant choosing store locations. Today it runs through the company: it screens every hire, trains every new Lenskartian before they meet a customer, answers our customer calls with no IVR and no queue, and decides which frame goes to which store.

Thousands of store associates start the day with Saathi, our self-learning AI assistant. B, our smart glasses, is in 500 stores and online; 90% of buyers took it with a prescription. — co-founder and CEO Peyush Bansal.

Where did Lenskart spend in Q2?

Total expenses rose 31.1% to Rs 2,596.8 crore in Q2 FY27, compared with Rs 1,980.3 crore a year earlier.

• Procurement costs: With Lenskart manufacturing most of its frames and lenses in-house, procurement of raw materials remained the largest cost component, rising 31.3% to Rs 853.9 crore in Q2 FY27 from Rs 650.2 crore in Q2 FY26.
• Employee benefits expense: Stood at Rs 626.9 crore, up 24.8% from Rs 502.5 crore in Q2 FY26.
• Other expenses: Surged 40.2% to Rs 742.2 crore during the quarter, compared with Rs 529.1 crore a year ago.

“The increase came mainly from two lines: we are deliberately investing in technology, where spend on AI and cloud has increased, and slightly in logistics, as more orders ship to more PIN codes and newer towns get added to Next Day Delivery,” said Lenskart.

Key operational metrics (Q2 FY27)

• Number of eye tests: 78.7 lakh, up 40.4% YoY
• Number of eyewear units sold: 106.1 lakh, up 27.1% YoY
• Quarterly transacting customer accounts: 57.6 lakh
• Net new stores added: 165
• Number of active stores: 3,624

Also read:

• Meta Doesn’t Have 3,000 Stores; We’re Uniquely Positioned to Distribute Smart Eyewear: Lenskart CEO
• Lenskart rolls out AI glasses amid mounting privacy concerns: Q4 FY26 earnings call

The post Lenskart Q2 profit rises 2x to Rs 232 cr, revenue up 36% appeared first on MEDIANAMA.

According to the RTI reply reviewed by MediaNama, the Gujarat Police issued 5,358 takedown notices, covering 190,633 URLs, to “all intermediaries” through the Centre’s Sahyog Portal over the past two years, possibly since October 2024, when the Ministry of Home Affairs (MHA) launched the portal. However, the reply does not specify a cut-off date and states that the figures are accurate “to date”. The reply was received on October 28, 2026.

This means that, on average:

• Around 261 URLs were flagged per day, equivalent to roughly one URL every six minutes.
• Around 7.34 notices were issued per day.
• Each notice covered around 36 URLs.

For comparison, in April 2025, The Indian Express, citing another RTI reply, reported that the MHA’s Indian Cyber Crime Coordination Centre (I4C) had issued 130 content takedown notices between October 2024 and April 8, 2025. This translates to approximately 0.69 notices per day, compared with Gujarat Police’s average of 7.3 notices per day, a rate 10.6 times higher. While the figures cover different reporting periods and authorities, the comparison illustrates the scale at which Gujarat Police has used the Sahyog Portal.

The RTI reply, dated October 28, 2026, followed anternal transfer by the First Appellate Authority to the Cyber Centre of Excellence, which operates under the Office of the Inspector General of Police, Gujarat.

What was asked:

The RTI application asked the Gujarat Home Department to disclose the total number of takedown notices issued to intermediaries under Section 79(3)(b) of the Information Technology (IT) Act or Rule 3(1)(d) of the IT Rules, 2021. It also sought copies of these notices and specifically asked how many had been sent through the Sahyog Portal.

The application was filed with the Gujarat Home Department on June 17, 2026. It was transferred to the Cyber Centre of Excellence following an order by the First Appellate Authority and was finally answered on October 28, 2026.

Center’s Sahyog Portal itself doesn’t hold takedown records, reveals another RTI reply

In another RTI reply to MediaNama, the Ministry of Home Affairs’ Indian Cyber Crime Coordination Centre (I4C), which operates the portal, said it does not maintain records of notices issued through it. I4C said that these records are held by State and Union Territory police departments. Gujarat has now disclosed an aggregate figure without citing any RTI exemption.

This could mean that individual State police departments should also be able to disclose the number of takedown notices issued through the Sahyog Portal. MediaNama will file RTI applications with each State police department and publish the responses as and when they are received.

Brief context on Sahyog Portal:

The MHA’s I4C created the portal to automate notices issued under Section 79(3)(b) of the IT Act. In a submission to the Karnataka High Court, the government said the portal displays each agency’s total requests, the content taken down, and the number of closed and pending requests.

“As per screenshots attached with the Government’s response, the portal contains a dashboard which shows Central ministries/departments along with States, and the total number of requests they have sent out. It also shows them the total pieces of content that platforms have taken down, the number of requests closed and the number of requests pending. The dashboard also provides a platform-wide breakdown of requests and the status of said requests.

Besides this, agencies have the option to generate a takedown notice and simply select the Act/Section under which a piece of content is unlawful.” – MediaNama reporting on Sahyog Portal

X challenged the portal, arguing that the government uses it to bypass the safeguards under Section 69A, which governs blocking orders. The Karnataka High Court upheld the portal. The Supreme Court has since stayed all previous High Court judgments in the case.

Also read:

• RTI: Sahyog Portal to Handle Data on Non-Consensual Intimate Images, But Privacy Measures Not Shared
• X Vs Centre: DigiPub Raises Concern About No Hearings For Section 79(3)(b) Takedowns
• India’s content takedown framework: built, gone wrong

The post Exclusive: Gujarat Police flagged one URL every six minutes through Sahyog Portal, RTI reveals appeared first on MEDIANAMA.

The Indian Computer Emergency Response Team (CERT-In) released its Artificial Intelligence (AI) Security Auditing Guidelines, outlining a risk-based framework for auditing AI systems developed, procured, deployed, or operated by organisations in India on November 4. The framework also covers AI systems that process Indian data or provide AI-enabled services to Indian users. 

The guidelines set out requirements for governance, cybersecurity, data privacy, fairness, transparency, resilience and auditability, with audit obligations varying according to an AI system’s risk tier. They cover nine core audit domains and prescribe additional security requirements for generative AI, large language models (LLMs), Retrieval-Augmented Generation (RAG), agentic AI, multimodal AI and autonomous systems.

Core audit domains: The nine domains cover an AI system’s lifecycle, from design and procurement to deployment, monitoring and decommissioning.

• AI Governance and Accountability: Organisations must establish governance structures, assign responsibilities, define accountability and maintain documentation for AI systems.
• Data Lifecycle, Quality and Privacy: Audits must assess data collection, quality, integrity, privacy, access controls, retention and handling throughout the data lifecycle.
• Model Risk Management: Auditors must examine model development, validation, performance, limitations, risks and controls.
• AI Ethics, Bias and Fairness: Assessments must identify and address bias, discrimination and unfair outcomes.
• Explainability and Transparency: Organisations must document AI system capabilities, limitations and decision-making processes, including applicable explainability measures.
• Security, Adversarial Resilience and Incident Reporting: Audits must examine security controls, adversarial threats, vulnerabilities and incident response arrangements.
• Continuous Monitoring, Drift Management and Validation: Organisations must monitor AI systems for performance degradation, data or model drift, and changes that require reassessment.
• Human Oversight and Decision Accountability: Auditors must evaluate whether human oversight is appropriate to the system’s risk and whether decisions can be reviewed.
• Third-Party and AI Supply-Chain Assurance: Organisations must assess risks arising from vendors, external models, dependencies and other components of the AI supply chain.

Risk tiers determine audit intensity: AI systems are classified into four risk tiers: Low, Moderate, High and Critical. The classification considers factors such as impact severity, decision-making autonomy, data sensitivity, scale and exposure, transparency, incident response readiness, reversibility, sector criticality, adversarial exposure and auditability. The assigned tier determines the depth, frequency and independence of audits, documentation requirements, human oversight and monitoring obligations.

• Low risk: These systems have limited security, safety, operational or data risks. Their outputs are primarily advisory or assistive, with limited autonomy and no material impact on critical business processes. Audit requirements are comparatively streamlined.
• Moderate risk: These systems influence business processes, service delivery or user interactions, with defined human oversight. A failure or compromise may cause recoverable operational, financial, data or service impact. The guidelines provide for annual independent audits by CERT-In-empanelled auditors.
• High risk: These systems may have significant effects on operations, users, sensitive data or sectoral services. They require more rigorous and independent assessment, enhanced governance and stronger monitoring. The guidelines call for periodic independent audits, which may be conducted every six months where warranted.
• Critical risk: These systems may pose severe or systemic risks, including significant consequences for critical infrastructure or safety. They require the highest level of audit scrutiny, including CERT-In-empanelled audits and continuous monitoring.

Risk-tier escalation may apply where the system’s use, impact or exposure changes, or where the assessment identifies factors warranting a higher classification.

Human oversight and the right to review AI decisions: The required level of human involvement varies according to the AI system’s risk and autonomy. Three oversight models are identified:

• Human-in-the-Loop (HITL): A human must approve or intervene in a decision before the AI system completes the relevant action.
• Human-on-the-Loop (HOTL): A human supervises the AI system and can intervene, override, or stop its actions.
• Human-over-the-Loop (HOVL): Human oversight takes place through monitoring, governance and periodic review, rather than direct intervention in every decision.

Auditors must assess whether the oversight model is appropriate to the system’s risk. This includes checking whether human reviewers have sufficient authority, competence, information and access to intervene effectively.

Contestability and decision review: Individuals affected by AI-assisted decisions must be able to seek review through contestability mechanisms, where applicable. Organisations must establish processes for human review, escalation and reconsideration. Auditors are expected to examine whether such mechanisms are documented and operational, and whether decisions can be reviewed by an authorised person.

Audit reporting, remediation and timelines: Audit findings are classified as Critical, High, Moderate or Low/Observation. Organisations must document findings, assign responsibility for remediation and track their closure.

The specified remediation timelines include:

• Moderate findings: Organisations must submit a remediation plan within 30 business days and implement it within 60 days.
• Low findings: Remediation must be completed within three months.
• Critical, High and Moderate findings: Organisations must prepare Corrective Action Plans (CAPs).
• Critical and High findings: Progress must be reported monthly.
• Moderate findings: Progress must be reported quarterly.
• Low findings: Progress must be reported annually.

A re-audit is required where an audit opinion is unsatisfactory, or where two or more Critical findings arise within three months. A re-audit may also be required sooner when directed by a regulator.

Audit requirements across the AI lifecycle: The audit methodology covers AI system design, procurement, data collection, development, training, validation, deployment, operation, retraining, monitoring and decommissioning.

The audit process includes engagement initiation, risk assessment, scoping, audit planning, evidence collection, technical testing, finding classification, reporting, remediation and follow-up verification. Organisations must identify the AI systems within their technical and organisational boundaries, classify them using the risk-tiering methodology and determine the applicable audit domains and evidence requirements.

Auditors must use the Core Audit Domains as the baseline and apply additional requirements for specialised AI systems wherever relevant. Applicable CERT-In requirements, sector-specific cybersecurity obligations, contractual requirements and other external obligations must be identified during scoping and incorporated into the audit criteria.

AI-assisted audit procedures may be used for evidence analysis, control mapping, technical testing and report preparation. However, such use must be subject to approved scope, confidentiality controls, tool validation, traceable evidence, and competent human review. AI-generated outputs cannot replace sufficient evidence or the auditor’s independent judgement.

Additional security requirements for advanced AI: Supplementary requirements apply to Generative AI, LLMs, RAG, Agentic AI, Multimodal AI, Multi-Agent AI and Autonomous or Cyber-Physical AI. These address risks that conventional cybersecurity controls may not adequately cover.

For generative AI and LLMs, auditors must consider prompt injection, sensitive-information disclosure, data and model poisoning, misinformation, hallucinations, and improper output handling. The guidelines also address deepfakes and require explicit consent in relevant contexts, alongside measures such as C2PA content provenance.

For RAG systems, assessments must examine the security of retrieval pipelines, vector databases, embeddings, access controls, and connected data sources. Agentic AI systems require scrutiny of tool use, excessive agency, least-privilege access, persistent memory, and unsafe autonomous actions.

Multimodal and multi-agent systems introduce additional risks involving cross-modal attacks, inter-agent communication, and the handling of data across different modalities. These architectures require appropriate security testing, including reassessment after material changes to the system.

Incident reporting and security obligations: Organisations must maintain processes to detect, respond to, and report AI-related security incidents, in accordance with applicable CERT-In requirements.

For reportable AI security incidents, the framework specifies a six-hour reporting timeline to CERT-In. Organisations must also maintain relevant logs for 180 days, in line with the prescribed requirements. [ Read our interview with CERT-In chief regarding this.]

Incident response must be incorporated into AI security controls, including procedures for containment, investigation, recovery and post-incident review. Higher-risk systems must also maintain appropriate business continuity and resilience arrangements.

Also read:

• AI agents accessed Indian organisations’ systems without authorisation, CERT-In reveals
• Interview: CERT-In chief on AI agent incidents, prompt injection and who must report them

The post Lowdown: CERT-In’s AI Security Auditing Guidelines set out tiered framework, human oversight & incident reporting appeared first on MEDIANAMA.

The Karnataka High Court has dismissed a request to quash criminal proceedings against five men accused of using a woman’s Instagram photograph in connection with an obscene video. The video, along with her Instagram ID and contact details, was allegedly circulated in WhatsApp groups.

In its order, the court held that a photograph posted on social media “for ordinary and legitimate purposes cannot be treated as consent to its use in obscene material or to the circulation of such material among others”.

Justice Suraj Govindaraj passed the order on October 12, 2026. LiveLaw reported it on November 4.

The reasoning in the case appears to be at odds with how India’s data protection law treats a photograph of this kind. Under the Digital Personal Data Protection Act, 2023 (DPDP Act), personal data that a person has made publicly available herself does not fall within the Act’s ambit. Therefore, photographs posted by individuals on Instagram would fall outside its protection. However, the court only examined the use of the photograph, so the question of its public availability did not arise.

What was the case about?

• The complaint: In March 2020, a college lecturer in Dakshina Kannada complained that her Instagram ID and a photograph from her account were being used to circulate an obscene video in WhatsApp groups created by a group called “Bad Boys”. She said she began receiving messages on her Instagram account after the video was circulated.
• The charges: Police registered a case under Section 66C (identity theft) and Section 67 (publishing or transmitting obscene material) of the Information Technology Act, 2000. They filed a charge sheet on July 17, 2024. The case is pending before a magistrate’s court in Puttur.
• The defence: The petitioners’ counsel argued that the woman in the Instagram photograph and the person in the video were different, and therefore the offences had not been made out.

What did the court say about consent?

The court held:

“The use of a publicly available photograph does not, by itself, authorise another person to misuse it, create an obscene or indecent video by associating it with the photograph, or circulate the resulting material along with the woman’s identity and contact details.”

It added that the effect of such conduct “cannot be assessed merely by observing that the original photograph was available on Instagram“, because “the issue is the alleged misuse of that photograph, the association of her identity with the obscene video, and the subsequent circulation of the material and her contact details”.

The alleged conduct, if established, would “adversely affect her dignity and privacy as a woman”, the order said.

How did the court interpret identity theft?

Section 66C punishes the fraudulent or dishonest use of another person’s “electronic signature, password or any other unique identification feature”.

The court applied this provision by observing: “In the present case, it is the identification or the facial identification of the person which has been used, as also, the Instagram handle of the respondent No.2 has been shared in the various WhatsApp groups with a video showing the same facial features as respondent No.2.”

The order clarifies that its observations are confined to the petition seeking to quash the proceedings. The trial court must decide the case on the basis of the evidence, “uninfluenced by any observation made herein”.

What did the forensic evidence show?

The State Forensic Science Laboratory found that the facial features of the woman in the images and screenshots were “similar”, based on visual observation. It also recorded that it “does not have tools/facility to compare visual content” and that examining whether the files had been edited was “beyond the scope” of its audio-video section.

The government pleader told the court that the laboratory “did not have the facility to verify” the material.

The court said that determining whether the person in the video was the complainant was “a disputed question of fact” that the trial court would have to decide. It held that the forensic reports, recovered files and WhatsApp records together provided sufficient grounds for the prosecution to proceed.

What does India’s data protection law say?

Section 3(c)(ii) of the DPDP Act states that the Act does not apply to personal data that is “made or caused to be made publicly available” by the person to whom it relates or by someone legally required to publish it.

The Act’s illustration refers to a person who, “while blogging her views, has publicly made available her personal data on social media”.

Therefore, this exclusion depends on who makes the data publicly available. A photograph that the woman posted herself would fall outside the Act. If she had not posted the photograph herself or caused it to be made publicly available, it would be considered under the Act.

The language of the Act does not specifically address screenshots or the resharing of publicly available photographs. If the exclusion applies, the person depicted in the photograph would be left without remedies under this Act. Section 3 is due to come into force in May 2027, along with most of the Act.

This leaves such cases within the ambit of criminal law, whose provisions do not specifically account for photographs that are reused or reshared. Section 67 only examines whether the material is obscene; it does not address whether the person depicted in it consented to its use.

Also read:

• Policy issues that the Bandana Girl incident raises
• Exclusive: Amid protests, MeitY widens labelling for social media beyond synthetic content

The post Posting a photo publicly is not consent for its misuse, Karnataka HC says in WhatsApp video case appeared first on MEDIANAMA.

After X clarified to the Delhi High Court that the notices were sent by an impostor and that it had filed a complaint with the Delhi Police, Justice Amit Mahajan disposed of the petitions.

What X told the court:

Appearing before Justice Amit Mahajan, X’s counsel said the platform had not acted on the notices. “We received the notice. In terms of transparency, we told them that we have received this. We didn’t take action,” the counsel said.

“It turns out this was somebody playing an impostor, somebody impersonating Delhi Police who has sent this… We are not actioning this request because it’s an illegal request. It’s not from Delhi Police. We filed a complaint last night with Delhi Police.” — X’s counsel

X’s counsel asked the court to also note that X had approached the Delhi Police to investigate the impersonation. An advocate representing the Delhi Police also attended the hearing but did not make any submissions.

What IFF and SFLC.in argued:

Senior Advocate Akhil Sibal appeared for both organisations and told the court that they had doubted the authenticity of the notices and had written to the authorities seeking confirmation. “But if it is genuine, My Lords, it’s most troubling,” he said.

He read out X’s message to the petitioners, dated November 3, which stated: “In the interest of transparency, we are writing to inform you that X has received requests from the Delhi Police regarding your X account.”

The attached “Receipt of illegal content report” named the Special Commissioner of Police (Crime), Delhi Police, as the sender. Sibal said SFLC.in had emailed the address mentioned in the notice to ask whether it was genuine, but the email “bounced back”. Read more about it here.

He also said that the legal notice sent in the name of the Rashtriya Swayamsevak Sangh (RSS) did not contain any lawyer’s details or a signature. The notices accused the organisations of defaming the RSS under Section 356 of the Bharatiya Nyaya Sanhita (BNS), which covers criminal defamation. Sibal told the court that defamation is “non-cognizable” and rhetorically asked how the police could send such a notice.

Sibal told the court that the Delhi Police had not said anything in the matter. Before the hearing, as noted by MediaNama, IFF and SFLC.in said they had filed the writ petition before the Delhi High Court because the Delhi Police had not responded to their queries.

After X stated that the notices were, in fact, fake and had been sent by an impostor, Sibal told the court that X’s statement could be recorded and the petitions disposed of. The court recorded X’s statement and closed the petitions. According to IFF, the court gave both organisations the liberty to approach it afresh if any action was taken.

Online impersonation and the free speech problem: 

While the use of email identities that appear to belong to the Delhi Police is threatening and bizarre, this impersonation issue also raises concerns about the misuse of copyright tools on intermediary social media platforms. Some entities impersonate creators by either claiming that content uploaded by the original creator belongs to them or falsely claiming ownership of someone else’s content.

The Delhi High Court is examining the copyright tools of intermediaries. MediaNama has also documented instances of fake copyright notices issued to content creators, particularly concerning critical speech, political speech, and speech about billionaire Anant Ambani.

Also read

• Police Seek X Takedowns Against IFF, SFLC.in, GeoblockedIndia
• IFF & SFLC moves Delhi HC over disputed Delhi Police takedown notices
• Reddit blocks posts in India under a government order

The post Impostor sent fake Delhi Police takedown notices against IFF, SFLC.in, X tells Delhi HC appeared first on MEDIANAMA.

California Governor Gavin Newsom signed Assembly Bill 1709 (AB 1709) in September 2026. The law, scheduled to take effect on January 1, 2027, prohibits platforms from offering personalised feeds and autoplay features to users under 16, even with parental consent.

Platforms must take reasonable measures to prevent minors from accessing these features and delete accounts of under-16 users who continue receiving them. Violations could attract penalties of up to $50,000 per affected user.

All three companies argue that the law interferes with editorial decisions protected by the First Amendment and conflicts with Section 230 of the Communications Decency Act, which protects online platforms from certain liabilities involving third-party content. They have asked federal courts to block its enforcement.

What Google argues

Google and YouTube argue that California’s law takes decision-making power away from parents and interferes with YouTube’s ability to recommend content appropriate for younger users.

“Assembly Bill 1709 (“AB 1709” or “the Act”) wrests control of what kids watch from their parents and gives it to the State,” the companies said in their lawsuit.

Google argues that personalised recommendations are editorial decisions protected under the First Amendment. It says these recommendations help children find relevant videos among billions of uploads and that removing them could increase their exposure to inappropriate content.

The lawsuit also argues that Section 230 protects platforms’ decisions about which third-party videos to recommend and how to display them.

“[M]atching users with content is publishing conduct, even when the user has not requested the content,” Google said, citing a federal appeals court ruling.

Google further argues that autoplay allows educational videos and other related content to play in sequence. It notes that YouTube already disables autoplay by default for users under 18 and allows parents to turn it off entirely for children under 13.

The company contends that California cannot justify an outright ban when parents already have tools to control their children’s viewing experiences.

What Meta argues

Meta argues that the law allows California to interfere with its editorial decisions on Facebook, Instagram and Threads, including how it recommends and displays user-generated content.

“AB 1709 is California’s latest attempt to flout that fundamental principle and appoint the State as the editor, curator, and controller of online speech,” Meta said in its lawsuit.

The company argues that the First Amendment protects platforms’ decisions about organising and distributing third-party content, just as it protects editorial choices made by traditional publishers.

Meta also challenges the law under Section 230, arguing that recommendations, autoplay and decisions to remove user accounts are protected publishing activities.

It further argues that the restrictions are excessively broad because they apply to all users under 16, regardless of how much time they spend online or their individual circumstances.

Meta says it plans to introduce a default cumulative two-hour time limit for minors using Facebook and Instagram. Parents or guardians will be able to override the limit. The company also plans to offer options to turn off personalised feeds and autoplay.

What TikTok argues

TikTok argues that the law threatens its For You feed, which uses algorithms to select and arrange videos for individual users. It says these decisions constitute protected expression under the First Amendment.

“TikTok thus creates a ‘distinctive expressive product’ every time it delivers a curated collection of videos to a user,” the company said in its lawsuit, citing a 2024 Supreme Court ruling.

TikTok argues that California has not established a sufficient legal justification for restricting these features or shown that the restrictions are necessary to protect children.

“Here, the State cannot link the challenged provisions of the Act to substantial or compelling governmental interests,” the lawsuit states.

The company also argues that the law restricts more expression than necessary and disregards existing safeguards, including its Family Pairing feature, which allows parents to manage screen time, privacy settings and content restrictions.

TikTok points out that it is already challenging California’s Senate Bill 976, which restricts personalised feeds for users under 18 without parental consent. Unlike that law, AB 1709 prohibits the targeted features for users under 16 even when parents approve.

TikTok’s appeal in its legal challenge to the earlier law is pending before the US Court of Appeals for the Ninth Circuit.

Why are digital rights organisations concerned?

The Electronic Frontier Foundation (EFF) has warned that enforcing the restrictions could require platforms to collect more personal information to determine users’ ages, affecting adults as well as children.

“AB 1709 compels platforms to collect even more information from every user, invading everyone’s privacy and frustrating our ability to remain anonymous online,” EFF Associate Director of State Affairs Rindala Alajaji said.

The organisation also argues that restricting teenagers’ access to social media could limit their ability to access information, participate in public discussions and organise social movements.

The lawsuits come amid growing scrutiny of social media’s impact on children. In August 2026, Meta agreed to a settlement of up to $18 billion to resolve child-safety claims brought by 29 US states.

Governments elsewhere have also introduced restrictions. Australia banned social media access for users under 16 in December 2025, while France’s top court struck down a similar law over freedom of expression concerns.

Bonta’s office said it is reviewing the lawsuits and remains committed to “defending California’s commonsense laws to protect kids online.”

Read more:

• US Court Blocks Notification and Reporting Provisions in California Social Media Addiction Law
• US states sue TikTok for harming teenagers’ mental health and lying about safety provisions

The post Meta, Google and TikTok sue California over ban on personalised feeds and autoplay for under-16s appeared first on MEDIANAMA.