Insights

Cybercrime and Domain Hosts: Where Does Liability Lie?

If someone posts defamatory or illegal content on a website, is the domain host liable? Usually not — intermediaries get safe harbour under Section 79. How to unmask an anonymous registrant, why a court order is the key, and how to get infringing content taken down.

Published 13 February 2014 · Updated 14 August 2026 · Reviewed by Selvam & Selvam

If someone publishes defamatory or illegal content on a website, can you hold the domain host liable? Usually not — but you can still get the content taken down and, often, unmask the person behind it. Here’s how liability actually works.

What domain hosts do — and their terms

Domain hosts/registrars (GoDaddy, name.com, the .IN Registry, etc.) give you space in the virtual world to run a website. Their terms of service, privacy policy and legal terms set out how much user information they’ll share, users’ obligations, and their own rights:

  • Privacy policy — user information stays confidential, disclosed only with permission — but registrars are bound by law enforcement and government authorities.
  • Termination policy — registrars can pre-screen, remove content or terminate services, even without prior notice, including to comply with court orders or defend against legal action.
  • Limitation of liability — registrars typically won’t be personally liable, will cooperate with law enforcement, and require the user to indemnify them.

Unmasking an anonymous registrant

Say someone using abcxyz.in publishes defamatory content anonymously. The first port of call is the registrar — but its privacy policy blocks disclosure absent a legal order. So you’ll typically need to send a legal notice, and ultimately obtain a court order compelling disclosure. Suspending/cancelling the domain is the host’s discretion — but with a court order, it’s bound to comply.

The loophole: a registrant may have given false contact details, making them hard to trace — and the host still won’t be liable, since the registrant agreed the information was accurate. The aggrieved party’s recourse is to ask the court to suspend/cancel the site through the registrar. As the maxim goes, ubi jus ibi remediumwhere there’s a right, there’s a remedy.

Safe harbour under Section 79

A domain host is an “intermediary” under Section 2(1)(w) of the IT Act, 2000 — but gets safe harbour under Section 79. So it’s bound to comply with disclosure/takedown orders, but the burden of the offence committed via the site isn’t charged to it.

Indian precedent on this is limited, mostly defamation cases where the aggrieved party already knew the writer. Courts have either directed hosts to provide the registrant’s identity and login/registration/IP data in a sealed cover, or to remove the defamatory content.

How to request disclosure — the practical steps

Surprisingly simple: write to the registrar/host at the contact details on its site. Some charge a nominal fee to research and courier the details. The key document is the court order requiring disclosure — and if it isn’t in English, a certified translation.

The bottom line

Enforcing these rights can feel tedious, but there’s a way out without holding hosts fully liable — their legal policies claim willingness to cooperate. Taking down defamatory, obscene or illegal content from a hosting platform is not impossible.

The takeaways

  • Hosts get safe harbour — Section 79 shields intermediaries from the underlying offence.
  • A court order is the key — it compels disclosure of the registrant and takedown.
  • False registrant details are a real hurdle — but the site can still be suspended/cancelled by order.
  • Takedown is achievable — hosts cooperate with valid legal orders.

Frequently asked questions

Is a domain host liable for illegal content on a website? Generally no — as an intermediary, it gets safe harbour under Section 79 of the IT Act, so it must comply with disclosure/takedown orders but isn’t charged with the underlying offence.

How do I find out who is behind an anonymous website? Send a legal notice and obtain a court order compelling the registrar to disclose the registrant’s identity, registration and IP data — hosts won’t disclose without a legal order.

Can I get defamatory content removed from a website? Yes — with a court order, the host is bound to remove the content or suspend/cancel the domain; courts have ordered both.

What if the registrant gave false contact details? Tracing them is harder, but you can still ask the court to have the registrar suspend or cancel the site.

Useful official resources

Related reading