‘Consent’ in the digital space: Navigating grant and withdrawal of consent in the digital era

In a world increasingly dominated by the digital space, the law needs to keep up with the rapidly changing practices, especially on the subject of consent and its relevance on the internet.

—

THE internet has become one of the primary modes of communication. It helps us keep tabs on family and friends. The key word here is keeping tabs. While most interactions in the real world are stored only in our memories, interactions over the internet can be stored outside our brains, where others might be able to access them without our consent.

Clearly, the notion of 'consent' in digital interactions is an important concept that deserves to be unpacked legally.

While "user consent" (in terms of free, fair and informed consent with respect to internet cookies, privacy policies, terms and conditions, etc.) has been discussed aplenty, an aspect that remains to be evaluated is the concept of 'consent' in light of user-generated content.

A plethora of Indian laws such as criminal law, contract law and data protection law deal with the concept of consent.

All these laws establish a few basic tenets— that consent must be free, fair, unequivocal, voluntary and not under any influence, coercion, intoxication, unsoundness of mind or legal immaturity. The person giving the consent should be able to understand the nature and consequence of that to which they give their consent.

Although the lines often get blurred in the application of established laws on the subject due to the advent of technology, the tenets remain consistent throughout. It is through the lens of sexual, decisional and bodily autonomy that questions surrounding consent and content generated by users on the internet (Instagram, YouTube and maybe even OnlyFans) need to be evaluated (K.S. Puttaswamy (Retd) versus Union of India and Ors 2017).

"User-generated content" with free and informed consent, specifically when it contains sexually explicit images, audio and video, may raise questions as to its legality, especially, from the perspective of decency, obscenity and morality.

It is imperative to understand the legal loopholes in the existing legislation(s) regarding user-generated content and the repercussions of transmission, publication or storage of such content without the knowledge or consent of the owner.

For example, what happens to the content if consent is withdrawn after the recording or transmission of such content?

Yet another emerging aspect that must be considered is that of 'revenge porn'. Without clear demarcations around consent and its withdrawal, revenge porn cases could lead to further ambiguities in the application and interpretation of existing laws.

These are some aspects that must be evaluated on the touchstone of existing legislation and the way forward in a world dominated by the 'Internet of Things'.

It is also imperative to understand the role and scope of terms like 'consent' and 'obscenity' in the application of existing legislation, for refinement of these laws vis-à-vis these terms.

Indian Penal Code, 1860

Consent 

Lack of 'consent', as defined under the Indian Penal Code, is an essential element of the crimes of rape, sexual harassment, voyeurism, stalking and assault, which are accompanied by further legal complications due to the increased use of the internet.

Also read: Over 29 thousand online pages blocked by the Union IT Ministry in the last five years, Right to privacy as a fundamental right: Past, present and future

Despite a few unaddressed loopholes in precedents and legislations, the courts usually tend to interpret the laws in favour of the victim.

One such loophole exists in the lack of punishment where the victim and the person committing the crime both identify as women. This is largely due to the patriarchal and paternalistic nature of existing legislation.

Whether the existing penal provisions also bring under their ambit the problem of "user-generated content" further compounds the issue at hand.

The innate dominance and vast outreach (especially across borders, where domestic penal provisions, irrespective of how effective, cannot be applied) of the internet, social media websites, dating websites and virtual reality spaces, over current social interactions also add on to the problem.

Obscenity

Wide interpretations of the provisions pertaining to 'obscenity' have been tested at the altar of the judiciary. Due to lack of an objective definition of the term, the scope of 'obscenity', though reduced (through judicial precedent), confers a wide discretion on the judges evaluating the case.

Subjectivity in such cases may also attract a certain level of arbitrariness, antithetical to  constitutional principles. These provisions also do not consider the concept of 'consent' a ground for defence, especially given the unique nature of "user-generated content".

Information Technology Act, 2000

However, due to the enactment of similar provisions of obscenity within the Information Technology Act, 2000 (IT Act) and the 'special' nature of this law— such obscene material, if published on the internet (whether on social media or personally transmitted using the internet), would be punishable under the IT Act and not only under the IPC.

The provisions of the IT Act also do not consider contours of 'consent' pertaining to sexually explicit user-generated content and penalise any such publication and transmission which may be considered as "lascivious" or "appeals to the prurient interest" or has the tendency to "deprave or corrupt persons" (according to Section 292 of the Indian Penal Code, 1860).

Section 292, IPC does not consider 'consent' of persons involved, especially if the material so published is considered "obscene". There, however, does exist a specific provision that penalises capturing, publishing, or transmitting content of a private area of 'any' person without their consent.

Firstly, due to the gender-neutral wording of the provision, it can be used to adequately cover instances of publication or transmission of such content, if it is done without the consent of the person involved.

Section 66E and 67A of the IT Act have been instituted to govern cases where, with or without the consent of the person involved, such content have been captured, published or transmitted.

Websites and social media platforms can claim immunity from liability under most circumstances, if due diligence is taken by such websites.

In recent years, the requirements of 'due diligence' have been expanded and an additional burden has been placed on social media intermediaries. When this is applied in tandem with the legal expectation of 'reasonableness' that social media intermediaries need to regulate and remove any objectionable material when it is brought to their notice, puts the intermediaries under a huge burden of 'accountability'.

What becomes interesting to note is the position in law, that even with the consent of the person so involved, the person who publishes or transmits such content can be held liable. This means that people who voluntarily transmit such content can also be penalised.

In the era of user-generated content on social media websites such as Instagram, Twitter and Only Fans, and with the discourse around the internet heavily relying on 'user-consent', this poses a problem, going forward.

Another interesting conundrum that compounds the existing issue is, that while watching pornographic material in the privacy of a person's home is considered legal, the publication and transmission of such material is illegal.

This is also a confusing legal position, in light of the department of telecommunications' Orders, about the repeated blocking of such websites.

In this paternalistic legal system, the aspects of privacy, sexual, decisional and bodily autonomy are slowly eroding from the context of the internet, specifically.

Withdrawal of consent

Another aspect that needs to be unpacked is that while consent for capturing such content may have been given initially (assuming that there was a prior relationship between the parties), a termination in such a relationship would, de facto, also lead to the withdrawal of earlier consent for capture or storage of such content.

It has been held repeatedly that withdrawal of consent effectively nullifies the earlier consent in the ambit of physical and sexual relationships and not respecting this withdrawal of consent would attract penal provisions.

Also read: Why India needs a robust content deletion procedure to repress revenge pornography, Cyber security versus right to privacy: Some global concerns

Applying the same logic to internet-specific sexual relationships, even if consent was once given for capturing such sexually explicit content, termination of the relationship should also lead to the withdrawal of consent to store such sexually explicit content.

This is important to prevent cases of revenge-porn cases. Assuming there was legal and valid consent during the relationship; firstly, any transmission (even with consent) would be considered illegal. Secondly, after the termination of the relationship, even storage should de facto become illegal, attracting the relevant Sections of the IPC and the IT Act.

This legal dilemma has been interpreted by certain high courts with a victim-centric approach and the judiciary has sent a very strong message to the perpetrators of revenge pornography. The Courts have come down with a hard message on such perpetrators and penalised them under the IPC and IT Act, after reading the two statutes broadly and in tacit compliance.

Conclusion

To sum up, legally speaking, there are four different aspects of sexually explicit content— capturing, storage or retention, transmission and publication.

Firstly, capturing such content takes the notion of consent into account. Capturing sexually explicit content of an individual without their consent is punishable under the IT Act, regardless of the gender of the victim. Under the IPC, only if the perpetrators are male can they be punished.

Secondly, there is absence of legislation on the storage and retention of such content with or without consent, either on local device storage or online in the 'cloud'. If an individual had given consent at the time the content was captured or shared, but has later withdrawn the consent, as long as another person in possession of the content does not share it, they cannot be penalised for merely continuing to store it.

Thirdly, persons that transmit or publish such content can be penalised and prosecuted under both the IPC and the IT Act, regardless of consent. The transmission or publication of such content tends to take away the privacy of individuals in consensual relationships, especially when such relationships heavily rely on internet platforms, and also erodes the sexual, bodily, and decisional autonomy in cases of self-user-generated content.

These issues gain an urgent edge in light of the fact that more and more minors are becoming part of the internet community and are using it for all sorts of purposes.

There arises a need to revisit the existing legislations to take into consideration 'consent' to promote different dimensions of personal autonomy, and specifically protect privacy as a fundamental right within the digital space.

The freedom of speech and expression extends to the internet and enjoys constitutional protection and it can be easily argued that such content forms a part and parcel of 'expression'.