Welcome to our special edition newsletter, dedicated to the important questions we asked authorities and relevant stakeholders throughout October. Despite receiving either no response or only generic replies that barely scratched the surface, we believe these questions are crucial and deserve to be brought to your attention.
First, an invitation. SIM binding requirements for messaging apps such as WhatsApp and Telegram take effect on January 1, 2027. Apps will stop working unless the registered SIM is physically present and active in the phone. MediaNama is hosting an invite-only virtual discussion on whether SIM binding is technically feasible and whether it will curb fraud. The discussion will take place on November 13, from 1:30 pm to 4:30 pm. Apply to attend here.
Here goes:
How many child abuse ads did Meta approve in India? [Aakriti Bansal]
Meta said on October 7 that it had added artificial intelligence (AI) tools to detect ads that covertly direct users to child sexual abuse material (CSAM) hosted on other platforms. A BBC Eye investigation had found Instagram running such paid ads in India three months earlier.
Meta said it “actioned” 5.3 million pieces of child sexual exploitation content on Facebook and Instagram in India between January and June 2026. That is about 16% of the 33.2 million pieces it actioned globally. The post gave no figure for CSAM-linked ads.
What we asked: We sent Meta the following questions:
- When did Meta deploy the new ad review measures, and does any human now review ads before they run in India?
- How many CSAM-linked ads did Meta find and remove in India beyond the ads the BBC reported?
- How many of the 5.3 million pieces of content were ads, and how many did Meta remove?
- Before September 2026, did Meta report CSAM found in India directly to Indian police, as the Protection of Children from Sexual Offences (POCSO) Act, 2012 requires?
- Has Meta responded to the Ministry of Electronics and Information Technology’s (MeitY) notice, and how does it respond to the first information report (FIR)?
- Does Meta consider itself covered by safe harbour under Section 79 of the Information Technology Act, 2000 (IT Act) for paid ads it approves?
What they said: No response.
Why it matters: Meta’s 98% figure counts the content it caught before users reported it. The figure does not cover content Meta never detected.
When the BBC reported one ad in July, Instagram replied that it did not violate community standards. MeitY sources later said Meta could not rely on the third-party content defence for ads it was paid to run. The National Human Rights Commission (NHRC) noted that Section 79 does not absolve platforms of their duty under POCSO to report offences to the police.
Meta now reports cases to the Indian Cybercrime Coordination Centre (I4C). Before that, it sent them through the US-based National Center for Missing & Exploited Children (NCMEC). Meta’s post does not say when it began reporting directly to Indian police.
Who blocked NoCap’s Facebook page, and why? [Anjali Tripathi]
Meta blocked the Facebook page of NoCap, a Malayalam digital news outlet, in India on September 28. NoCap received only an in-app notice. It cited “a notice from the Government of India/Law Enforcement under Section 79(3) (b) of the Information Technology Act, 2000.” The notice named no posts, no issuing authority and no reason.
NoCap’s chief editor asked the Kerala High Court (HC) on October 23 to make the authorities produce the order. The petition gives these figures:
- Views: The page averaged 6 lakh views a day. Daily views fell to 4,538 on October 4.
- Earnings: Earnings between September 28 and October 20 fell by almost 91%.
- Income source: Facebook monetisation was NoCap’s main source of income.
What we asked: We sent questions to Meta and Kerala Police. Among them:
- Which authority sent the notice that led to the restriction, and will Meta share it with the page’s owner?
- Did the notice identify specific posts, and why did Meta restrict the entire page?
- Did Kerala Police issue an intimation concerning NoCap’s page, and which officer issued it?
- Has the intimation been reviewed, as Rule 3(1)(d) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules) requires every month?
What they said: No response.
Why it matters: On October 5, the Punjab and Haryana HC set aside a Yamuna Nagar police intimation that had restricted Haryana 24 News Network’s Facebook page. The court held that the user must get a copy of the intimation when it goes to the platform.
NoCap’s petition argues that no confidentiality clause covers Section 79(3)(b). The 2009 Blocking Rules attach one only to Section 69A orders.
Who tells the public when AI attacks drain Rs 300 crore from lenders? [Azdhan]
AI-powered cyberattacks reportedly took about Rs 300 crore from smaller non-banking financial companies (NBFCs) over roughly two months. The Economic Times reported the figure, citing sources. It also reported that the attacks led to more than 150 FIRs. No regulator has published the losses.
The Indian Computer Emergency Response Team (CERT-In) and its financial-sector arm, CSIRT-Fin, issued a “Critical” advisory on October 9 to NBFCs, digital lenders and fintechs. The advisory describes how attackers steal payment gateway and partner-bank application programming interface (API) credentials. They use those credentials to bypass Know Your Customer (KYC) checks and per-transaction limits. The advisory names no affected entity and gives no loss figure. No Reserve Bank of India (RBI) notice does either.
What we asked: We wrote to the RBI, the Securities and Exchange Board of India (SEBI), CERT-In and CSIRT-Fin. Among the questions:
- Can the RBI confirm the Rs 300 crore estimate, and how many NBFCs have reported cyber incidents since August?
- Must NBFCs tell customers about cyber incidents that affect their funds or data? If not, will the RBI issue such a direction before the Digital Personal Data Protection (DPDP) Rules take effect?
- Has any listed NBFC disclosed these losses under Regulation 30 of the SEBI Listing Obligations and Disclosure Requirements Regulations, 2015?
- Will CERT-In publish aggregate, non-attributed data on incidents, losses and remediation status?
What they said: No response.
Why it matters: CERT-In’s 2022 directions require organisations to report a cyber incident within six hours of noticing it. The RBI’s July 2026 directions set the same deadline for NBFCs. Both require sending the report to the regulator and carry no public disclosure requirement.
Three other October cases became public through media reports or leak claims before the institutions disclosed them:
- Central Bank of India: Its Rs 13.97 crore loss surfaced through a police complaint that Hindustan Times reported.
- State Bank of India (SBI): SBI disclosed the exposure of 3,897 customers’ data to stock exchanges on October 21. A threat actor had claimed to hold the data on the dark web two days earlier.
- CoinDCX: Its chief executive called reports of a breach a false alarm on October 22. The company admitted a Rs 152 crore loss three days later.
The DPDP Rules require companies to notify affected individuals of a breach from May 13, 2027. It is unclear whether that rule covers theft of funds through payment APIs.
Why did Instagram block, restore and re-block a comedian’s reel? [Anjali Tripathi]
Instagram restricted stand-up comedian Kajol Srinivasan’s reel in India within minutes of her posting it. Instagram then restored the reel and restricted it again, according to screenshots Srinivasan shared on X on October 25. The reel was about someone using AI to summon the dead.
The first notice said an automated system implemented to comply with the IT Rules had restricted access. A second notice said the government request or legal requirement behind the restriction had expired or been reversed. None of the notices named a law or an authority.
What we asked: We sent questions to Meta and MeitY. Among them:
- Did Instagram restrict the reel following a government or law-enforcement request, and if so, which authority sent it and under which legal provision?
- Did Instagram apply the restriction automatically, and what triggered the restoration?
- Did Instagram receive a fresh request before restricting the reel again?
- Did MeitY or any other government authority issue a request concerning the reel?
What they said: No response.
Why it matters: Instagram’s notices in India cite different legal routes, and each route works differently:
- Section 69A: MeitY orders a block through a committee process under the 2009 Blocking Rules.
- Section 79(3)(b): The “appropriate Government or its agency” flags content, and the platform must act or lose its legal immunity.
Cartoonist Satish Acharya received notices citing both, with two naming Section 79(3)(b) and two naming only an automated system.
When Instagram restored a reel on Google’s Visakhapatnam data centre after 111 days, its panel said the restriction had ended on May 22. The restriction began on May 22.
What does Meta do with the prompts users type into its algorithm? [Prabhanu Kumar Das]
Meta announced on October 13 that it is rolling out Your Algorithm on Facebook. The tool lets users customise Feed and Reels recommendations by typing natural language prompts. It also lets users mark individual posts as ‘Interested’ or ‘Not interested’.
MediaNama checked an India-based account. Neither Your Algorithm nor any similar feature is available on Facebook, Instagram or Threads in India.
What we asked: We sent Meta the following questions:
- Which countries have access to the feature, and when will it reach India across Facebook, Instagram and Threads?
- How does Meta store and process the prompts and feedback, how long does it retain them, and can users view or delete their prompt history?
- Does Meta use these prompts and feedback to build user profiles for targeted advertising? If so, can users opt out?
- Does Meta use the prompts and feedback to train or fine-tune its large language models (LLMs) or other AI systems?
- Do any additional privacy safeguards apply to prompts that Meta’s AI systems process?
What they said: No response.
Why it matters: Meta said in July that it runs every public Instagram Feed and Reels post through an LLM to analyse topic and tone. It uses the results for ranking, recommendations and moderation. Its Your Algorithm announcement does not say whether user prompts feed ad targeting or model training.
When MediaNama tested the similar Dear Algo feature on Threads in February with a UK account, the feed first showed the luxury posts it asked for. It then began showing posts written in Tagalog. In September, government sources said Meta cannot be treated as a “simple intermediary” because its algorithms decide what users see.
Also read:
