Online Doxxing: Remove Google Result With Your Photo

One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.

Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.

TL;DR: If a search result is exposing your personal details or photograph, you have three separate routes that can run together: a takedown demand to the platform hosting the document, a grievance escalation against the search engine, and a criminal complaint against the people actually circulating your photo. The takedown route usually moves faster, but it needs to be done in the right format and to the right authority, and it needs a paper trail.

Three years ago, Sneha Kulkarni finished an online certificate course on a Bengaluru edtech platform and forgot about it. The PDF arrived by email: her full name, her photograph, the course title, the enrolment number. She saved it, printed one copy for a file, and moved on.

In early March 2025, she searched her own name for an unrelated reason. The certificate sat at the top of the results. First link. Open to anyone, no login, no barrier. She mentioned it to an online group she was part of. Within days, two people from that group were passing her photograph around, and the rest of the group now had her face, her full name and her college. She asked them to stop. They didn't.

Her first attempts went nowhere. Google's own removal form was filled and submitted; the listing stayed up. Two emails to the platform that issued the certificate got no meaningful reply. By then she had spent close to three weeks on it.

She then approached the Chamber of Advocate Sudhir Rao. Advocate Sudhir Rao's work in cyber crime and online identity matters shaped the approach from the first legal notice onward, and that is exactly where her earlier individual efforts had fallen short. The strategy moved on three tracks at once: the platform's obligations as an intermediary, a written complaint to the cyber crime cell, and a takedown demand routed through the correct grievance channel rather than a general contact form.

Key Facts of the Case

• A public PDF hosted by an education platform carried the client's full name, photograph and enrolment details.
• The document was indexed by a search engine and appeared as the first result for her name.
• No consent was given for the document to be publicly indexed, and no privacy setting was ever offered.
• Two individuals known to her only online began circulating the photograph within a group.
• Her own attempts at a search engine removal request and direct emails to the platform produced no result.
• The document was hosted by a third party, not by the search engine, which is the single most important fact in takedown matters.
• The harm was ongoing, which matters for both urgency and for how a complaint is drafted.
• The client approached the Chamber of Advocate Sudhir Rao after roughly three weeks of failed self-help.

The Direct Legal Answer

Yes, there is a way to get this removed. But the answer splits into three separate questions, and mixing them up is why most people get stuck.

Can I get the Google search result removed permanently?

You can get the URL de indexed and removed, yes, but the request has to be framed correctly or it goes into the same bin as everyone else's. Google's personal information removal policy covers a defined list of things — government ID numbers, bank details, contact information, signatures, and images of ID documents. A course certificate carrying your name and photograph does not automatically fall inside that list, which is why Sneha's first form went nowhere. What makes it removable is not the photograph itself but the combination: a name, a photograph, an enrolment number and an institution, all publicly indexed without any consent for public display, and being actively used to identify and harass her. The other route against a search engine is a court order. Where a URL is defamatory, or where it is being used to stalk or identify someone, a court can direct de-indexing of specific URLs. Indian courts have passed such orders in individual matters. There is no binding Supreme Court judgment laying down a general right to be forgotten in India, so outcomes turn on the judge, the facts, and how narrowly the request is drafted.

Can I get the underlying document taken down?

This is the faster and more durable route, and it is the one people ignore. The search engine only index what someone else published. Remove the source and the index entry usually follows. The platform that issued Sneha's certificate was the publisher of that PDF, which puts it squarely inside the obligations that apply to a data fiduciary and to an intermediary.

A platform cannot publish your photograph on an open URL and then say it was your own enrolment that put it there. Consent to a course is not consent to public indexing. That distinction is the whole case, and it is what a written notice has to say in plain words.

Can I do anything about the people circulating the photograph?

Yes, and separately. The platform is one set of obligations; the two individuals in that group are another. Circulating someone's photograph to humiliate or identify them, after being asked to stop, can attract criminal provisions — depending on what exactly was said and done, and whether there was any sexual content, the sections charged will differ. Where there is no sexual element at all, the case is usually built as criminal intimidation, or as a privacy offence under the information technology law, rather than as an obscenity offence. Which one it becomes depends on the messages, so keep them.

What the Law Says

Three legal frameworks overlap here, and each one covers a slightly different part of the problem.

1. The Information Technology Act and the 2021 Intermediary Rules

A platform hosting user or third-party content is an intermediary under the IT Act and enjoys a safe harbour only if it follows the due diligence conditions. The Intermediary Guidelines and Digital Media Ethics Code Rules, 2021 require a published grievance officer, acknowledgement of a complaint within 24 hours, and disposal within 15 days. For certain categories — non-consensual intimate imagery among them — the outer limit for removal is 36 hours.

That 36-hour clock does not apply to every photograph. A plain certificate PDF is not in that category, which is why notice drafting matters more than speed here. Where the platform refuses, the next step is an order from a court or a direction from the appropriate government authority, which triggers removal duties that the platform cannot argue around.

2. The Digital Personal Data Protection Act, 2023

The DPDP Act creates a right to correction and erasure of personal data, and a right to grievance redressal. Its operative provisions are being brought into force in stages and the rules are still being operationalised, so how much traction you get from it right now depends on the timing. On the facts of a certificate published without consent for public display, this is the principled route: the data was collected for one purpose and used for another.

3. The criminal law

Depending on the facts, a complaint can be built around provisions of the Bharatiya Nyaya Sanhita, 2023 covering criminal intimidation, stalking, or defamation, and around the privacy and obscenity provisions of the IT Act. Section 66E of the IT Act deals with capturing or publishing the image of a private area without consent; Section 67 deals with publishing obscene material. Those apply where the content is sexual in nature. Where it is not, do not force the facts into those sections — a badly chosen section is a complaint that gets closed.

If two or more people act together, common intention and criminal conspiracy provisions in the BNS can be added. Whether they should be is a judgement call on evidence, not on anger.

Remember that electronic evidence needs to be preserved properly if it is ever to be used in court. Screenshots on a phone are not enough on their own. The certification requirement for electronic records, formerly under Section 65B of the Evidence Act and now carried into the Bharatiya Sakshya Adhiniyam, 2023, is a technical trap that loses otherwise good cases.

What Actually Gets Done, In Order

Here is the sequence that works.

• Preserve first. Full-page screenshots with the URL bar visible, the date and time, and the device clock. Archive the live URL. Do not delete the messages asking them to stop — those messages are evidence of knowledge and of the harm.
• Identify the publisher. WHOIS, the platform's own pages, the domain registrar. A notice sent to the wrong entity buys you nothing.
• Send a properly framed takedown notice to the platform's grievance officer, by email, quoting the grievance officer's name and the URL. Not a general contact form. Not a support ticket.
• File the search engine removal request for the specific URLs, with a short factual justification tied to the harm, not just "please remove this".
• File a written complaint with the cyber crime cell covering the individuals circulating the photograph, attaching the preserved evidence.
• Escalate to court only if the first three fail. A narrow de-indexing order is easier to obtain than a broad one, and courts are more willing to grant it.

How Long It Takes, and What It Costs

The platform's grievance officer has 24 hours to acknowledge and 15 days to dispose. In practice, a well-drafted notice from a lawyer moves faster than a personal one, because it names the obligation and the consequence. Search engine removal requests have no statutory deadline. A court application takes longer than most people expect, and hearings get adjourned.

The honest position: if the publisher removes the document in the first two weeks, the index entry often disappears on its own within days after that. If the publisher refuses, you are looking at weeks to months, not days.

What to Send the Chamber

If you are in this position, send three things and nothing more to start with:

• the URL of the page or document, and a screenshot of the search result showing it ranked for your name;
• a two-line note — when you first found it, and who you think put it up or is circulating it;
• any reply you have already received from the platform or the search engine, even a rejection.

Do not send your full ID documents by email. If we need them, we will ask in a specific form.

On some facts there may be very little to argue. If the document was published by you, with your consent, on a public profile you control, the removal request is likely to fail and you should be told that before you spend money on notices. Where the publisher has a genuine legal basis to host the record — a public register, a court record, a regulatory filing — the takedown route is weak and the de-indexing route is weaker. You are better off knowing that in the first conversation.

You can write in through the contact page or book a consultation. One paragraph of facts is enough to tell you whether you have a route at all.

Frequently Asked Questions

Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.