Nivedita Bhardwaj Comments on VPN Compliance and National Security Concerns in Storyboard18 Feature
Nivedita Bhardwaj shared her insights in a recent article published by Storyboard18, examining the legal and regulatory implications arising from the complaint involving ExpressVPN.
The complaint references potential non-compliance with CERT-In directions issued under the Information Technology Act framework, particularly in relation to data retention, user identification, and incident reporting obligations. Commenting on the broader trend, Nivedita noted that VPN providers are increasingly being positioned as non-compliant on two primary counts: first, for promoting or enabling geo-unblocking that may induce copyright infringement; and second, for failing to adhere to cybersecurity compliance mandates.
She emphasised that while the dispute may appear commercially driven, its implications extend well beyond market competition. “Although the dispute is commercially rooted, it also engages broader cybersecurity and national security considerations, as VPN misuse can impede lawful interception, facilitate access to restricted online resources, and weaken regulatory oversight of digital infrastructure,” she observed.
Nivedita further highlighted the potential shift in liability standards if courts accept the theory of active inducement. In such a scenario, rights holders could gain stronger grounds to proceed directly against VPN providers, thereby narrowing the scope of safe-harbour protections traditionally available to intermediaries. This development could significantly reshape the compliance and litigation landscape for technology service providers operating in India.
The evolving legal scrutiny around VPN marketing and operations underscores the increasing convergence of intellectual property enforcement, intermediary liability, and cybersecurity regulation within India’s digital governance framework.
By entering the email address you agree to our Privacy Policy.