The Indian government’s discussions with Meta entered a third day, with officials reiterating that global technology companies operating in the country must comply with Indian laws.

The meetings follow concerns over WhatsApp’s username policy and alleged instances of child sexual abuse material (CSAM) on Instagram. According to sources, Meta apologised to the government over the issues raised. The company’s delegation, led by Chief Global Affairs Officer Joel Kaplan, has been holding discussions with government officials, while Meta’s technical team is expected to remain in India for further engagement.

Officials have also reviewed the company’s understanding of Indian IT regulations, its compliance measures and the technology being used to detect and remove harmful content.

Against this backdrop, cyber law advocate Pavan Duggal questioned the government’s decision to continue discussions instead of initiating legal proceedings if violations of Indian law have already been established.

He says talking to Meta at this stage sends the wrong message. “Rather than the government going ahead and taking the law to its logical conclusions, we are effectively making a mockery of the existing Indian cyber law,” he said.

In his view, once the legal shield is gone, the responsibility to act shifts to the government. “The onus is now on the government. The government should quickly take action.”

What “action” should look like

Asked what that action should be, Duggal didn’t hold back. “The legal action going forward will be criminal prosecution of the top management in India for offences that have taken place under the IT Act, under POCSO Act, and under the [Bharatiya Nyaya Sanhita],” he said.

He also wants financial penalties. Duggal pointed to a section of the IT Act that deals with data security failures, saying it allows damages “upto ₹5 crore per one contravention” — meaning a fresh penalty for every separate violation.

He also pointed to recent legal action against Meta in the United States over child safety issues, saying India’s legal framework currently provides for criminal prosecution under the Information Technology Act but does not allow for penalties of the same scale.

According to Duggal, the Digital Personal Data Protection Act, once it becomes operational in May 2027, will strengthen the government’s ability to impose higher monetary penalties for future violations.

He added that companies operating in India should expect stricter enforcement if they fail to comply with local regulations.

For the entire discussion, watch the accompanying video