Quick Answer
OTT platforms operating in India are governed by Part III of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, which mandates content classification, parental controls, grievance redressal, and a three-tier self-regulatory structure. The Broadcasting Services (Regulation) Bill, 2023 pending enactment will bring OTT platforms under a unified broadcasting framework with expanded penalties and programme code obligations. Platforms must also prepare for Digital Personal Data Protection Act enforcement and deepfake removal obligations under the MeitY 2024 advisory.
OTT compliance in India is no longer a background obligation. The regulatory environment has accelerated across three simultaneous tracks: the IT Rules, 2021 framework is live and enforceable, the Broadcasting Bill, 2023 is advancing through Parliament, and DPDP Act enforcement is on a defined timeline. For OTT platform founders, compliance heads, and content studios, the question is not whether to build a compliance system, it is whether that system is comprehensive enough to hold.
This guide covers the full legal landscape: what IT Rules, 2021 require today, what the Broadcasting Bill, 2023 will add tomorrow, how the Digital Personal Data Protection Act, 2023 applies to streaming platforms, and what platform obligations exist around deepfakes and synthetic media. We have also included a practical compliance checklist and FAQ section drawn from the questions Altacit Global receives most frequently from OTT operators and digital media companies.
Current Framework: IT Rules 2021, Part III
Part III of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 applies specifically to online curated content providers the regulatory term for what the market calls OTT platforms. These obligations are operational today.
Who Is Covered?
A publisher of online curated content is any entity that operates a curated catalogue of audio-visual content over the internet and makes that content available on demand. The Rules apply regardless of the platform’s size, subscriber count, or country of incorporation what matters is whether the service is accessible in India.
This captures both domestic platforms and international services with an Indian user base. There is no minimum subscriber threshold that triggers compliance. A platform with 500 subscribers in India is covered under the same framework as one with 50 million.
Content Classification: Mandatory Before Publication
Every piece of content published on an OTT platform must be classified into one of five age-based categories before it is made available to users:
Category | Audience |
U (Universal) | Suitable for all ages |
U/A 7+ | Parental guidance advised for children under 7 |
U/A 13+ | Parental guidance advised for children under 13 |
U/A 16+ | Parental guidance advised for children under 16 |
A (Adult) | Restricted to adults aged 18 and above |
Classification must be based on content descriptors covering themes, language, nudity, sex, violence, and substance use. This is a mandatory pre-publication step, not a post-publication label.
Parental Control: Mandatory for U/A 13+ and Above
IT Rules, 2021 require OTT platforms to implement a parental control mechanism for all content rated U/A 13+ and above. This mechanism must enable parents or guardians to restrict access to higher-rated content.
The platform must make the feature accessible, functional, and clearly communicated to users. Burying a parental control option in an obscure settings menu does not satisfy the obligation.
Content Descriptor: Visible Before Playback
A content descriptor must appear before the content begins playing. This descriptor tells the viewer why the content carries the rating it does for example, indicating that a title is rated A because it contains strong violence and explicit language.
The descriptor must be displayed prominently, not embedded in small text within a terms page.
Grievance Redressal Officer (GRO)
Every OTT platform must appoint a Grievance Redressal Officer (GRO) who is resident in India. The GRO must acknowledge user complaints within 24 hours and resolve them within 15 days of receipt.
The name and contact details of the GRO must be published on the platform. This is a structural requirement, not merely an internal process. Platforms that route user complaints through a generic international support ticket system are non-compliant.
Tier I: Platform-Level Self-Regulation
The first tier of OTT regulation under IT Rules, 2021 sits with the platform itself. The platform must establish internal content standards aligned with the Rules, apply the classification system consistently, maintain a functioning grievance mechanism, and publish its content policies.
Tier II: Self-Regulatory Body (SRB)
Platforms are expected to be members of a recognized self-regulatory body (SRB). The SRB handles grievances that remain unresolved at Tier I, within 15 days of referral. An SRB must be headed by a retired judge of the Supreme Court or High Court or an eminent person from the relevant field, and it must register with the Ministry of Information and Broadcasting (MIB).
As of 2025, the SRB structure is still developing. Platforms should monitor MIB notifications and ensure their membership status is documented.
Tier III: Ministry of Information and Broadcasting (MIB) + Grievance Appellate Committee (GAC)
The Ministry of Information and Broadcasting serves as the apex oversight body. Above the MIB’s departmental review sits the Grievance Appellate Committee (GAC), established in 2023 as a government-level appellate forum.
A user or content creator who is dissatisfied with a platform’s or SRB’s response can appeal to the GAC. The GAC has the authority to direct platforms to act on upheld complaints. This appellate path gives the regulatory framework enforcement teeth at the government level.
Broadcasting Services (Regulation) Bill, 2023: What OTT Platforms Must Prepare For
The Broadcasting Services (Regulation) Bill, 2023 is pending enactment. It will replace the current Cable Television Networks (Regulation) Act, 1995 and bring OTT platforms into a consolidated broadcasting framework alongside television and radio broadcasters. Platforms should treat the Bill’s requirements as preparation work, not future concerns.
OTT Platforms Brought Under Unified Broadcasting Framework
The Bill defines broadcasting services broadly enough to include OTT platforms. Once enacted, OTT platforms will operate alongside traditional broadcasters under a single regulatory structure overseen by the Broadcasting Regulatory Authority of India (BRAI) the regulator proposed under the Bill.
This unification has significant structural implications. OTT platforms will be subject to registration requirements, content codes, and regulatory oversight that previously applied only to television broadcasters.
Programme Code and Advertisement Code: Apply to OTT
The Bill applies a Programme Code and an Advertisement Code to OTT platforms. The Programme Code sets standards for content across categories including decency, national security, and protection of minors. The Advertisement Code governs advertising practices, including prohibited categories and messaging standards.
These codes are currently enforced for television. Under the Broadcasting Bill, 2023, the same standards will apply to content and advertising published on OTT platforms, with regulatory authority sitting with BRAI.
OTT Network Operators Defined
The Bill introduces the concept of OTT network operators entities that operate the technical infrastructure over which OTT content is delivered. This creates a distinct regulatory category separate from content publishers.
Platforms that both operate infrastructure and publish content may find they are regulated in two capacities simultaneously. Compliance heads should assess their platform’s structural position before the Bill is enacted.
Enhanced Penalties
The Broadcasting Services (Regulation) Bill, 2023 significantly increases the penalties for non-compliance compared to the existing Cable Television Networks (Regulation) Act, 1995. Violations can attract financial penalties, suspension of broadcasting rights, and criminal liability in serious cases.
The scale of penalties under the Bill reinforces why building compliance infrastructure now before enactment is the commercially rational position.
DPDP Act Compliance for OTT Platforms
The Digital Personal Data Protection Act, 2023 applies directly to OTT platforms. Every OTT service collects personal data from its users: names, contact details, payment information, viewing history, and device identifiers. Under the DPDP Act, 2023, this data collection requires a lawful basis, typically informed consent, and carries obligations for data security, breach notification, and user rights.
The most commercially significant obligation for OTT platforms is the requirement for verifiable parental consent before processing the personal data of children defined under the DPDP Act, 2023 as individuals under 18 years of age. Platforms with family or children’s content verticals must implement age verification and consent mechanisms that satisfy this standard.
DPDP Act enforcement is expected to reach full operational intensity under Phase III compliance, with a timeline pointing toward May 2027 for certain obligations, including those relating to children’s data. OTT platforms should not treat May 2027 as a start date. Building consent architecture, data processing records, and breach response protocols takes time, and the Data Protection Board will have enforcement authority before that final phase deadline.
For a detailed breakdown of DPDP compliance obligations applicable to digital platforms, see our DPDP Compliance Guide for Digital Businesses.
Deepfakes and Synthetic Media: Platform Obligations
The MeitY 2024 advisory on deepfakes establishes a 24-hour removal obligation for OTT platforms and digital intermediaries. When a platform receives a valid complaint identifying deepfake or synthetic media content, the platform must take it down within 24 hours.
This applies alongside the IT Rules, 2021 obligations for unlawful content takedowns. In practice, it means OTT platforms need a deepfake-specific triage process within their content moderation function. A general grievance mechanism that operates on a 15-day resolution cycle does not satisfy a 24-hour deepfake removal obligation.
Platforms that carry user-generated content, or that license content from third-party studios, face additional exposure. The advisory does not distinguish between content the platform produced and content it hosts. The 24-hour clock runs from the point of a valid complaint, regardless of origin.
AI-generated content raises adjacent issues under the Copyright Act, 1957. Where AI tools are used in production, ownership of the resulting work depends on the extent and nature of human creative involvement.
Building OTT Compliance Systems: Checklist
Altacit Global advises OTT platforms to structure their compliance against the following checklist. Each item maps to a live or forthcoming legal obligation.
IT Rules, 2021: Operational Compliance
- Appoint a resident Grievance Redressal Officer (GRO) and publish their name and contact details on the platform.
- Implement the five-category content classification system (U, U/A 7+, U/A 13+, U/A 16+, A) across the full content catalogue.
- Display content descriptors before playback for all classified content.
- Activate parental control mechanisms for U/A 13+ and above content.
- Establish a 15-day grievance resolution process with 24-hour acknowledgment.
- Confirm SRB membership status and maintain documentation.
Broadcasting Bill, 2023: Preparation
- Map content catalogue against the Programme Code standards.
- Review advertising inventory against the Advertisement Code.
- Assess whether the platform operates as an OTT network operator under the Bill’s definitions and prepare for dual-capacity registration.
- Model penalty exposure under the enhanced penalty framework.
DPDP Act, 2023: Data Compliance
- Audit all personal data processing activities and identify the lawful basis for each.
- Implement age verification and verifiable parental consent mechanisms for users under 18.
- Establish a data breach detection and notification protocol.
- Document all data processing records in a format compatible with Data Protection Board requirements.
Deepfakes and Synthetic Media
- Build a 24-hour deepfake removal process within the content moderation function.
- Train moderation staff on the MeitY 2024 advisory requirements.
- Establish a documented log of deepfake complaints and resolution timestamps.
Cross-Cutting
- Review all content licensing agreements for copyright chain-of-title completeness. For content studios, see our guide to Copyright Law for Content Creators in India.
- Assess compliance obligations for music used in OTT content against PPL and IPRS licensing requirements.
- Review the Legal Framework for Media and Entertainment Companies in India to confirm no additional sector-specific obligations apply to your platform structure.
Build Your OTT Compliance Framework Before the Deadlines Arrive
OTT regulation in India is not at a standstill. IT Rules, 2021 obligations are enforceable today. The Broadcasting Services (Regulation) Bill, 2023 is advancing. DPDP Act enforcement is on a defined timeline. Deepfake obligations are live under the MeitY 2024 advisory.
Platforms that build compliance infrastructure reactively responding to regulatory action after it arrives face penalty exposure, reputational risk, and operational disruption. Those that build proactively create a defensible position and reduce commercial risk across every content licensing and investor conversation.
Altacit Global works with OTT platform founders, compliance heads, digital media companies, and content studios to structure complete compliance frameworks across all of these tracks. Our team advises on IT Rules, 2021 implementation, Broadcasting Bill preparation, DPDP Act readiness, content licensing chain-of-title, and deepfake policy frameworks. We operate across our offices in Chennai, Bangalore, Hyderabad, and Kochi.
To assess your platform’s current compliance position and build a framework that holds across the full regulatory landscape, contact our team at info@altacit.com.
Frequently Asked Questions: OTT Compliance India
Q1: Does a small OTT platform with under 1,000 subscribers need to comply with IT Rules, 2021?
Yes. IT Rules, 2021 Part III does not set a minimum subscriber threshold. Any platform that curates and publishes audio-visual content on demand and is accessible in India is covered. A platform with 500 subscribers carries the same GRO, content classification, and grievance mechanism obligations as one with 50 million. Size determines operational complexity, not regulatory coverage.
Q2: What is the Grievance Appellate Committee (GAC)?
The Grievance Appellate Committee was established in 2023 as a government-level appellate body for digital content complaints, including those involving OTT platforms. A user or content creator who is dissatisfied with how a platform or SRB has handled a grievance can appeal to the GAC. The GAC has the authority to direct platforms to take corrective action on upheld complaints. This makes the GAC a significant enforcement pressure point for OTT platforms operating in India.
Q3: Does the Broadcasting Bill, 2023 apply to podcast platforms?
The Broadcasting Services (Regulation) Bill, 2023 defines broadcasting services in terms of audio and audio-visual content delivered over electronic networks. Whether podcast platforms fall within scope depends on how the Bill’s definitions are interpreted at the time of enactment. Platforms delivering both audio and video content including video podcast formats face a stronger argument for inclusion. Altacit Global recommends that podcast platforms with an Indian user base monitor the Bill’s progression and obtain a formal assessment of their position before enactment.
Q4: When must OTT platforms be fully DPDP Act compliant, particularly for children's data?
The Digital Personal Data Protection Act, 2023 is being implemented in phases. Full enforcement, including the obligations specific to children’s data and verifiable parental consent, is expected to be operationally active by May 2027 under the Phase III timeline. However, the Data Protection Board will have authority to act before that final deadline, and earlier phases are bringing incremental obligations into force. Platforms should not treat May 2027 as a start date. Altacit Global recommends beginning consent architecture and data processing documentation now.
