Exploring the Role of AI in Social Media Regulation: A Comparative Analysis of Selected South Asian Countries and the Actions of Major Technology Platforms

Abstract

This article examines the extent to which private technology companies bear responsibility for respecting human rights, particularly freedom of expression, when governing social media content through artificial intelligence (AI), and how that responsibility relates to the legal obligations of States. It focuses on the rule-of-law complexities created by the interaction between territorially based public regulation and transnational platform governance. Through a comparative analysis of domestic law and platform practice, the article assesses how AI-mediated content moderation affects online expression. The revised analysis is limited to India, Bangladesh, Pakistan and Afghanistan as selected comparative cases; it distinguishes State duties from the corporate responsibility to respect human rights, and treats AI-mediated moderation as including automated detection, classification, recommendation, down-ranking, removal and account restrictions. It proposes a seven-element human-rights test for AI-mediated moderation: legality, legitimate aim, necessity, proportionality, transparency, procedural fairness and effective remedy.

1. Introduction

‘Affirming that the same rights that people have offline must also be protected online. Decides Internet can be an important tool for development and exercising human rights, in accordance with its programme of work.’

—UN Human Rights Council (2012)

Access to social media engages the right to freedom of expression, although neither access nor expression is absolute. Social media services can also be used for conduct that falls within domestic cybercrime or terrorism offences, as well as for broader forms of terrorist use of ICT that do not necessarily constitute cybercrime. AI adds a further regulatory dimension because both platforms and public authorities may use automated systems for detection, classification, prioritisation, investigation or enforcement. These uses raise questions about how national security, sovereignty and territorial integrity can be protected while respecting individual rights. The legal problem is therefore not that responsibility belongs exclusively to either States or technology companies, but that State obligations and private-platform responsibilities arise from different legal and governance frameworks. For example,

‘Calls upon all States to ensure that the same rights that individuals have offline, including the rights to freedom of expression, of peaceful assembly and of association, are also fully protected online, in accordance with human rights law, particularly by refraining from Internet shutdowns and content restrictions on the Internet that violate international human rights law, by ending attacks by States and taking steps to end attacks by non-State actors against journalists and other media workers covering demonstrations and protests and by ending government shutdowns of media outlets for attempting to report on such protests, and condemns unequivocally and calls for an end to all attacks and violence by State and non-State actors against journalists and media workers, including through attacks on, or the forced closure of, their offices and media outlets, in both conflict and non-conflict situations, in particular for journalists and media outlets covering or attempting to cover demonstrations and protests.’

—UN General Assembly (2018)

Technology companies exercise substantial practical control over online expression through content and account restrictions, ranking, recommendation and other forms of AI-mediated moderation. This raises the question of how private-platform responsibility to respect human rights relates to the legal jurisdiction and duties of States. The article first examines the regulatory and accountability gap between platform governance and national jurisdiction. It then analyses relevant international-law standards and platform-governance principles, followed by a comparison of domestic legal frameworks in the four selected South Asian jurisdictions. Finally, it evaluates AI-mediated social media regulation against rule-of-law and international human-rights standards and compares the regulatory and accountability gap across State and platform governance.

The principal research question is: How should the legal obligations of States and the human-rights responsibilities of social media platforms be distinguished and coordinated when AI-mediated content moderation affects freedom of expression in India, Bangladesh, Pakistan and Afghanistan? Three subsidiary questions guide the analysis: (1) What legal and institutional features create the regulatory and accountability gap between State-based public law and private platform governance; (2) how do the four selected jurisdictions converge and diverge in their treatment of online expression, intermediary responsibility, security-related content and AI-enabled regulation; and (3) what minimum substantive and procedural safeguards should govern AI-mediated moderation by public authorities and private platforms?

The research gap is twofold. South Asian legal scholarship frequently treats cybercrime, cyberterrorism, intermediary liability and social media regulation as adjacent subjects without isolating the distinctive legal effects of algorithmic moderation; conversely, global scholarship on automated moderation and platform governance does not always test those systems against South Asian domestic legal architectures. The article’s original contribution is to connect these fields through a common comparative framework while distinguishing State legal obligations, the corporate responsibility to respect human rights, platform contractual governance and broader ethical responsibility.

2. Research Method and Comparative Scope

This research employs a doctrinal-critical methodology. Rather than merely describing applicable law, it analyses the content, structure and operation of relevant legal frameworks and evaluates the gap between formal rules and their practical application.

The analysis is grounded primarily in legal sources, including domestic legislation, international instruments, UN resolutions and relevant judicial or quasi-judicial decisions. These materials establish the formal legal parameters governing freedom of expression, privacy, cybercrime, counter-terrorism, intermediary responsibility and digital regulation.

The doctrinal analysis is supplemented by peer-reviewed scholarship and selected institutional and governmental reports. These secondary sources are used to situate the legal analysis, identify implementation problems and provide context for platform practices and the operation of domestic regulatory systems.

The methodology therefore combines doctrinal interpretation with critical comparative analysis. Its purpose is to identify points of convergence and divergence across the four jurisdictions and to assess how legal rules interact with AI-mediated platform governance in practice.

India, Bangladesh, Pakistan and Afghanistan are selected purposively rather than as statistically representative of South Asia as a whole. India provides a comparatively developed intermediary due-diligence framework; Bangladesh illustrates rapid legislative replacement and emerging AI-specific cyber provisions; Pakistan illustrates increasingly institutionalised social media regulation; and Afghanistan is retained as a deliberately divergent case because the current de facto governance environment raises different questions concerning legal continuity, media freedom and the practical availability of remedies. Sri Lanka, Nepal, Bhutan and the Maldives are excluded to preserve a focused doctrinal comparison; the revised title therefore refers expressly to ‘Selected South Asian Countries’.

The four jurisdictions are compared against the same variables: constitutional protection of expression and privacy; permissible grounds for restriction; intermediary or platform liability and due diligence; regulation of terrorist, extremist or otherwise unlawful online content; AI-specific provisions; platform registration or compliance duties; transparency and explainability; human review, appeal and remedy; and express human-rights safeguards. The legal cut-off date for the comparison is 18 September 2026.

The analysis separates three legally distinct forms of governance. ‘Platform AI Governance’ concerns platform-side detection, classification, ranking, recommendation, demonetisation, removal and account restrictions. ‘State Digital Regulation’ concerns legislation, blocking orders, surveillance, interception, criminal investigation and network-level restrictions. ‘Co-regulatory Interaction’ concerns government requests or orders to platforms, intermediary due-diligence duties, registration requirements, transparency reporting and remedies. In addition, the article uses related legal categories distinctly. ‘Cybercrime’ refers to offences directed at or committed through computer systems; ‘cyber-enabled terrorism’ refers to terrorism offences facilitated or carried out through digital systems; ‘terrorist use of ICT’ is broader and includes propaganda, recruitment, communication, financing or operational facilitation that may or may not itself constitute cybercrime; ‘extremist content’ is a policy or descriptive category and is not automatically unlawful; ‘unlawful online content’ means content prohibited under applicable law; ‘cybersecurity’ concerns the protection of systems, networks and data; ‘AI-mediated content moderation’ concerns automated or AI-assisted platform decisions about content or accounts; and ‘State surveillance’ concerns public-authority monitoring, interception or access to communications or data. These categories may overlap factually, but they should not be treated as legally interchangeable.

3. Regulatory and Accountability Gap Between Social Media Platforms and National Jurisdiction

The rule of law provides a framework for organising public authority, resolving disputes, constraining arbitrary power and protecting rights in political, social and economic life (Desai and Berg 2013).

Social media has become an important forum for political participation, collective expression and agenda-setting, while also creating risks associated with disinformation, extremist content and security-related harms (Chachko 2021). Platforms can be used to disseminate extremist content (Thompson 2011; Lieberman 2017) and disinformation (Bergh 2020; Bradshaw et al. 2021). In response, major social media companies deploy automated systems to identify material associated with terrorist organisations or violent extremism. Meta, for example, has described the use of image- and video-matching tools, text analysis and signals associated with accounts, pages and groups to detect previously identified terrorist material and to support content or account enforcement (Bickert and Fishman 2017).

The growth of AI-mediated moderation exposes a rule-of-law problem: decisions that materially affect expression may be implemented through private technical systems whose rules, evidentiary thresholds and review mechanisms differ from public-law procedures. Traditional rule-of-law analysis has focused primarily on public authority, whereas private technology companies now exercise significant practical influence over the visibility and circulation of speech (Kavanagh et al. 2017).

Rule-of-law analysis has traditionally centred on legislation, institutions and other normative sources of legal authority. Brownsword nevertheless argues that technological management must also be considered because technical systems can shape behaviour in ways comparable to conventional legal regulation (Brownsword 2015). He contrasts such mechanisms with more familiar normative tools (Brownsword 2015, p. 12). The regulatory and accountability gap arises because users exercise rights on privately governed platforms, whose contractual terms and corporate interests can shape online expression and political participation, while States separately apply domestic public, criminal and counter-terrorism law (Youmans and York 2012). In A v Secretary of State for the Home Department,1 Lord Hope emphasised the need to respect individual rights and liberties while recognising the State’s responsibility to protect life (A v Secretary of State for the Home Department 2004, para. 99). The underlying point is that security objectives and rights protection must be reconciled within the rule of law, including where technological systems shape the practical exercise of rights (Brownsword 2015).

The gap is not an absence of law. It arises because States and platforms exercise different forms of authority over the same communicative act. State law is territorially organised, while major platforms operate across borders and apply contractual terms and community standards that may be global or regional. The gap is intensified by extraterritoriality, corporate autonomy, intermediary-liability rules, algorithmic opacity, uneven procedural safeguards and the practical difficulty of enforcing human-rights expectations against private actors. International human-rights treaties bind States; private companies are not thereby transformed into treaty parties, although the UN Guiding Principles on Business and Human Rights articulate a separate corporate responsibility to respect internationally recognised human rights.

Distinctive Legal Problems of AI-Mediated Moderation

AI-mediated moderation creates legal problems that are not captured by a general discussion of cyberterrorism. Automated content detection and classification determine whether material falls within a policy category, whereas recommender systems determine what content is shown, in what order and to whom. Removal is therefore only one form of intervention: content may remain online while being down-ranked, excluded from recommendations, demonetised or made difficult to discover. These measures can materially affect expression even without a formal takedown.

False positives and false negatives are central to the rights analysis of algorithmic content moderation, which raises significant technical and political challenges for platform governance (Gorwa et al. 2020). A false positive may suppress lawful political, journalistic, religious, cultural or academic expression, while a false negative may leave genuinely unlawful or dangerous material available or amplified. Contextual limitations are particularly important for South Asian languages, where transliteration, code-mixing, dialect, religious references and locally specific imagery may not be adequately represented in training data or moderation resources es (Bhatia and Elswah 2025). These challenges also raise broader concerns about the implications of AI-mediated content moderation for freedom of expression in the Global South (Balendra 2025). The appropriate response is not to assume perfect accuracy, but to require context-sensitive thresholds, documented testing, local-language competence and escalation routes proportionate to the rights impact. The Oversight Board’s consideration of a Facebook content-moderation dispute involving Punjabi-language expression in India provides a case-specific illustration of the importance of contextual assessment and effective review in platform governance (Oversight Board 2021).

Explainability, human review and audit are therefore procedural safeguards rather than merely technical features. Users should ordinarily be able to understand the rule applied, the form of enforcement, whether automation materially contributed, the principal reason for the decision and the route for challenging it. Higher-impact systems also justify periodic assessment of accuracy, bias, language coverage, privacy and security, together with human review capable of changing an automated outcome.

4. Existing Rules of International Law and Platform-Governance Standards Related to AI-Mediated Social Media Regulation

Social media regulation engages several distinct bodies of law and governance rather than a single terrorism/counter-terrorism framework. International human-rights law protects freedom of expression and privacy, while permitting carefully delimited restrictions; cybercrime instruments address offences against or committed through computer systems and the handling of electronic evidence; counter-terrorism law addresses terrorist offences and related security measures; and platform rules govern private content moderation. AI-mediated moderation may interact with each of these fields, but it is not itself equivalent to cybercrime enforcement, counter-terrorism, cybersecurity or State surveillance.

This distinction also matters within the international law of State responsibility. Recent scholarship on third-party countermeasures in cyberspace demonstrates that coordinated inter-State responses to State-sponsored cyber operations raise a distinct set of questions under the law of State responsibility, including attribution, proportionality, third-party rights and the contested legal basis for collective countermeasures; these questions should not be conflated with the human-rights responsibilities or contractual governance practices of private platforms (Alkuwari and Abdelrahman 2026).

This section therefore examines the international legal standards most relevant to expression, privacy, cybercrime, counter-terrorism and private-platform responsibility, together with governance benchmarks for AI-mediated social media moderation.

4.1. International Covenant on Civil and Political Rights, 1966

Article 19 of the International Covenant on Civil and Political Rights (ICCPR) protects freedom of expression, including the freedom to seek, receive and impart information and ideas regardless of frontiers. The right is not absolute. Under Article 19(3), restrictions must be provided by law and necessary for respect of the rights or reputations of others, or for the protection of national security, public order, public health or morals. These requirements constrain State discretion and require a legal basis, a legitimate aim, necessity and proportionality.

Human Rights Committee General Comment No. 34 explains that Article 19(2) extends to political discourse, public affairs, journalism, cultural and religious expression, human-rights discussion and electronic or internet-based modes of communication (UN Human Rights Committee 2011). Restrictions must satisfy Article 19(3) and must not be overbroad; necessity and proportionality apply to legislative, administrative and judicial restrictions (UN Commission on Human Rights 1985). In De Jorge Asensi v Spain (Communication No. 1413/2005, CCPR/C/92/D/1413/2005, adopted 25 March 2008), the Committee found the Article 19 claim insufficiently substantiated for admissibility. The decision therefore does not establish a general national-security power to restrict access to information.

General Comment No. 34 also recognises a right of access to information held by public bodies and requires States to give effect to that right. The concept of a public body may extend, depending on the circumstances, to entities exercising public functions. This access-to-information principle should not be conflated with a general right to obtain information stored by private persons or companies; access to privately held data depends on the applicable legal framework, including privacy and data-protection rules.

General Comment No. 34 does not create a freestanding counter-terrorism mandate. Rather, it warns that counter-terrorism offences and restrictions on expression, including offences concerning the encouragement of terrorism or ‘extremist activity’, must be clearly defined and applied consistently with Article 19(3). Vague or overbroad definitions can produce unnecessary or disproportionate interference with freedom of expression.

4.2. The Council of Europe’s Convention on Cybercrime

The Council of Europe Convention on Cybercrime (Council of Europe 2001) is principally a cybercrime and electronic-evidence treaty; it does not define cyberterrorism and does not establish a counter-terrorism regime. Articles 2–6 require Parties, subject to the Convention’s conditions, to criminalise illegal access, illegal interception, data interference, system interference and misuse of devices. Chapter II also provides procedural powers for preserving and obtaining electronic evidence, while Chapter III establishes mechanisms for international cooperation, including extradition and mutual legal assistance. These provisions are offence- and evidence-oriented rather than terrorism-specific. They may nevertheless assist investigations or cross-border cooperation involving cyber-enabled terrorism where conduct within the Convention’s scope, or relevant electronic evidence, is involved. Accordingly, cybercrime, cyber-enabled terrorism, terrorist use of ICT, extremist content, unlawful online content and cybersecurity should not be treated as interchangeable legal categories.

4.3. United Nations Resolutions in the Digital Age

UN General Assembly resolution 74/173, ‘Promoting technical assistance and capacity-building to strengthen national measures and international cooperation to combat cybercrime, including information-sharing’ (UN General Assembly 2019), emphasises cooperation, capacity-building and the development of effective domestic legal and institutional frameworks for preventing, investigating and prosecuting cybercrime.

Paragraph 5 encourages Member States to ensure that cybercrime, and other crimes for which electronic evidence is relevant, can be effectively investigated and prosecuted at the national level and supported by effective international cooperation, consistently with domestic law and applicable international law, including human-rights instruments. The resolution therefore treats cybercrime and electronic evidence as matters of criminal justice and international cooperation rather than as synonyms for terrorism.

In its resolution on countering disinformation for the promotion and protection of human rights and fundamental freedoms (UN General Assembly 2021), the General Assembly stresses that responses to disinformation must comply with international human-rights law, including the principles of legality, necessity and proportionality. It also encourages States, international and regional organisations, national human-rights institutions, civil society and business enterprises, including online platforms and technology companies, to foster respect for human rights and human-rights due diligence in the context of new and emerging digital technologies. The resolution supports a multi-stakeholder approach, but it does not make private platforms identical to States in legal status or obligations.

The General Assembly’s resolution on the right to privacy in the digital age (UN General Assembly 2020), recalling Article 12 of the Universal Declaration of Human Rights and Article 17 of the ICCPR, calls on States to consider legislation, regulation and policy that encourage business enterprises, including social media and other online platforms, to respect privacy and other relevant human rights throughout the design, development, deployment and evaluation of technologies, including AI, and to provide access to effective remedy where rights are violated or abused.

In December 2023, the General Assembly adopted a resolution on the promotion and protection of human rights in the context of digital technologies (UN General Assembly 2023). It affirms that human rights and fundamental freedoms must be respected, protected and promoted throughout the life cycle of AI systems and that digital technologies should support, rather than undermine, the enjoyment of human rights.

The resolution calls for measures to prevent harm caused by AI systems and for the cessation or avoidance of AI applications that cannot be operated consistently with international human-rights law or that pose undue risks unless adequate safeguards are in place.

It also calls for transparency in AI systems and appropriate explainability of AI-supported decisions, taking account of the different human-rights risks that such technologies may create. The resolution further encourages participation by relevant stakeholders in decisions concerning the development, deployment and use of AI.

These resolutions do not create identical legal obligations for States and private companies. They instead reinforce the distinction between State duties under international human-rights law and the responsibility of business enterprises to respect human rights, while recognising that both public and private actors influence the digital environment.

4.4. Manila Principles on Intermediary Liability, 2015

The Manila Principles on Intermediary Liability (2015) are non-binding civil-society principles developed by an international coalition, including the Electronic Frontier Foundation (Manila Principles 2015). They propose safeguards for intermediary-liability regimes with the aim of protecting freedom of expression and other rights online. The Principles recognise that internet intermediaries, including access providers, search engines and social networks, can materially affect users’ freedom of expression, association and privacy. They advocate limits on intermediary liability and procedural safeguards for content restriction, including lawful authority, necessity and proportionality. They are best treated as a governance benchmark rather than a source of binding international law.

4.5. UN Guiding Principles on Business and Human Rights

The UN Guiding Principles on Business and Human Rights (UNGPs) provide the central framework for legally characterising the role of private technology companies (United Nations Human Rights Council 2011). They distinguish the State duty to protect human rights, the corporate responsibility to respect human rights, and access to remedy. The corporate responsibility is not identical to a State’s treaty obligation; rather, it calls for policy commitments, human-rights due diligence, identification and mitigation of adverse impacts, and remediation where a business causes or contributes to harm. This distinction is essential when evaluating platform moderation that restricts or amplifies users’ expression.

4.6. Contemporary AI and Platform-Governance Benchmarks

Recent instruments from outside South Asia are used as comparative benchmarks, not as directly applicable law. UNESCO’s (2023) Guidelines for the Governance of Digital Platforms emphasise human-rights due diligence, transparency, user information and accountability. The Council of Europe’s Framework Convention on Artificial Intelligence and its risk-assessment approach emphasise human rights, democracy, rule-of-law safeguards, transparency and remedy (Council of Europe 2024). The EU Digital Services Act similarly provides a useful comparator for systemic-risk assessment, recommender-system transparency, independent audit and reporting on automated moderation (European Parliament and Council 2022). These developments identify governance mechanisms that may inform domestic reform and corporate due diligence in South Asia.

5. Selected South Asian Countries: National Legislation

Digital communications challenge territorially organised legal systems because platforms, users, infrastructure and data may be located in different jurisdictions. Domestic legal frameworks therefore address several distinct matters: cybercrime, cybersecurity, terrorism and terrorist use of ICT, intermediary responsibility, unlawful online content, surveillance and access to data. These fields may overlap in practice, but each has a different legal basis and should not be collapsed into a single concept of ‘cyberterrorism’.

This section examines the national laws, regulations and policies that structure State responsibility, intermediary or platform obligations and the use of AI in social media governance in India, Bangladesh, Pakistan and Afghanistan. The analysis applies the distinction between Platform AI Governance, State Digital Regulation and Co-regulatory Interaction established above.

5.1. Legislation of India

5.1.1. Information Technology Act 2000 (IT Act)

In India, the Information Technology Act 2000 (IT Act) is a central statute for cybercrime and electronic governance. Section 66F specifically defines and penalises cyberterrorism, including specified conduct involving computer resources undertaken with the requisite intention to threaten India’s unity, integrity, security or sovereignty or to strike terror. The provision identifies forms of conduct such as denial of authorised access, unauthorised or excess access and the introduction of computer contaminants when the statutory elements are satisfied.

Section 43A of the IT Act provides for compensation where a body corporate handling sensitive personal data or information is negligent in implementing and maintaining reasonable security practices and thereby causes wrongful loss or gain. For this purpose, ‘body corporate’ includes companies, firms, sole proprietorships and other associations engaged in commercial or professional activities.

Currency note (law as of 18 September 2026): section 43A remains in force on the cut-off date. The Digital Personal Data Protection Act 2023 provides for its future omission, but the relevant commencement notification delays that provision until May 2027 (India 2026). The section should therefore not yet be described as repealed.

Section 69 of the IT Act authorises the Central or State Government, or an authorised officer, in specified circumstances and subject to the statutory framework, to direct the interception, monitoring or decryption of information generated, transmitted, received or stored in a computer resource for listed purposes, including sovereignty and integrity, defence, State security, friendly relations with foreign States, public order and the prevention or investigation of certain offences.

The IT Act does not establish a general offence of ‘misuse of AI’. Instead, sections 66 and 66F address specified computer-related and cyberterrorism conduct when their statutory elements are met. Section 79 establishes a conditional safe-harbour regime for intermediaries, subject to due-diligence requirements and other statutory conditions. NCRB data2 record cybercrime cases by reported motive, including ‘terrorist activities’,3 ‘political motives’4 and ‘inciting hate against the country’.5 These statistical categories should not be treated as legal definitions of the underlying offences.

5.1.2. Unlawful Activities (Prevention) Act 1967 (UAPA), as Amended in 2019

The Unlawful Activities (Prevention) Act 1967 (UAPA), as amended in 2019, is a principal Indian counter-terrorism statute. It addresses ‘unlawful activity’ and terrorist activity through statutory definitions that are distinct from cybercrime offences under the IT Act. The UAPA does not create a general definition of cyberterrorism. Section 22A addresses offences by companies and, subject to its terms, the liability of persons responsible for the conduct of the company’s business. The statute’s corporate-liability provisions should therefore be distinguished from the intermediary safe harbour and due-diligence regime under section 79 of the IT Act.

5.1.3. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 define categories including ‘social media intermediary’ and impose due-diligence obligations on intermediaries. The Rules address specified forms of unlawful content and government or judicial directions for removal or disabling access. For significant social media intermediaries, Rule 4(4) also addresses proactive technology-based measures for specified categories of content, subject to safeguards. These obligations form part of Co-regulatory Interaction: the legal duty is imposed by the State, while the platform determines how compliant technical and human review systems are implemented.

The 2026 amendments to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules are directly relevant to AI-mediated moderation (India 2025). They add obligations concerning synthetically generated information and amend the framework for specified proactive technical measures by significant social media intermediaries. Rule 4(4)’s safeguards include appropriate human oversight and periodic review of automated tools for accuracy, fairness, propensity for bias or discrimination, and effects on privacy and security. India therefore provides the most explicit framework among the four selected jurisdictions for connecting specified automated enforcement measures with formal review safeguards.

5.2. Legislation of Bangladesh

Bangladesh’s framework combines constitutional protections, counter-terrorism law and a rapidly changing cybersecurity regime. For present purposes, the current legal position is stated as of 18 September 2026. The Cyber Security Act 2026 (Act No. 81 of 2026) (Bangladesh 2026a, 2026b), enacted on 10 April 2026, superseded the earlier framework and was subsequently amended by the Cyber Security (Amendment) Act 2026 (Act No. 99 of 2026). The national analysis therefore distinguishes current law from the former Digital Security Act and earlier Cyber Security Act arrangements.

5.2.1. Constitution of Bangladesh

Article 39(2) of the Constitution of Bangladesh permits restrictions on freedom of speech and expression on specified grounds, including State security, friendly relations with foreign States, public order, decency or morality, contempt of court, defamation and incitement to an offence, provided the restriction is imposed by law and is reasonable. Article 43 protects the privacy of home and correspondence or other means of communication, subject to restrictions imposed in accordance with law. Neither freedom of expression nor privacy is therefore framed as an absolute right.

5.2.2. Anti-Terrorism Act 2009 (ATA), as Amended in 2013

Section 6 of the Anti-Terrorism Act 2009 defines terrorist activities by reference to specified conduct, purposes and harms affecting, among other interests, State security, public safety and public order. Digital communications or social media material may be relevant as evidence or as a means by which prohibited conduct is carried out, but online content is not automatically terrorist content merely because it is digital. The breadth of the statutory definition has been criticised on legality and legal-certainty grounds (Human Rights Watch 2023). Those concerns are particularly significant where criminal liability attaches to speech or online communications.

5.2.3. Cyber Security Act, 2026, as Amended

The Cyber Security Act 2026 (Bangladesh 2026a, 2026b) is the operative cybersecurity framework at the cut-off date. It also illustrates a tendency to address particular AI-enabled harms within cyber legislation: section 25 reaches specified harmful sexual or blackmail-related material created or edited using AI. This is an AI-specific criminal prohibition, not a general framework for platform algorithmic moderation. It does not by itself establish comprehensive transparency standards for classifiers, algorithmic-audit duties or a general right to human review. Bangladesh therefore remains more focused on cybersecurity, cybercrime and harmful-content offences than on a dedicated platform algorithmic-accountability model.

5.3. Legislation of Pakistan

Pakistan’s digital-regulation framework combines national-security and counter-terrorism legislation, cybercrime law, cybersecurity policy and increasingly institutionalised regulation of social media services.

5.3.1. Anti-Terrorism Act 1997 (ATA), as Amended in 2014

The Anti-Terrorism Act 1997 (ATA), as amended, is a principal statutory framework for counter-terrorism in Pakistan. Section 6 defines terrorism by reference to specified actions, purposes and effects, including conduct intended to coerce or intimidate the government or the public or to advance certain religious, sectarian or ethnic causes through statutorily defined forms of violence, intimidation or disruption. The ATA’s terrorism framework is distinct from cybercrime and platform-regulation provisions under PECA.

5.3.2. National Cyber Security Policy 2021

The National Cyber Security Policy 2021 (Ministry of Information Technology and Telecommunication 2021) provides strategic background for cybersecurity governance. It should not, however, be treated as the legal source of every platform-content power or as a substitute for the statutory provisions governing social media content under the Prevention of Electronic Crimes Act 2016 (PECA), as amended in 2025 (Pakistan 2025).

5.3.3. Prevention of Electronic Crimes (Amendment) Act 2025

The Prevention of Electronic Crimes (Amendment) Act 2025 (Act No. II of 2025) (Pakistan 2025), in force from 29 January 2025, significantly changed social media governance under PECA. It inserted Chapter IA establishing the Social Media Protection and Regulatory Authority (SMPRA), with functions relating to online safety, regulation of unlawful or offensive content, enlistment of social media platforms, directions and blocking powers for non-compliance. The earlier reference in this manuscript to a ‘Digital Rights Protection Authority’ is therefore corrected. The 2025 amendments have also been examined in policy scholarship addressing the implications of PECA’s revised regulatory framework (Naweed and Khanum 2025). For AI-mediated moderation, the important point is that statutory content-control obligations can create incentives for automated compliance even where the statute does not prescribe the model architecture used by platforms; notice, scope, over-removal risk, language competence, human escalation and avenues of challenge remain central safeguards.

5.3.4. Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules, 2021

The Removal and Blocking of Unlawful Online Content (Procedure, Oversight and Safeguards) Rules 2021 replaced the 2020 rules and establish procedures for complaints, directions, removal or blocking of unlawful online content, and obligations applicable to social-media companies under PECA (Pakistan 2021).They form part of Pakistan’s State Digital Regulation and Co-regulatory Interaction with platforms; they should not be treated as a platform for AI-moderation code in themselves.

5.4. Legislation of Afghanistan

Since August 2021, Afghanistan has been governed de facto by the Taliban. This section therefore distinguishes the legal framework of the former Islamic Republic from the current de facto governance environment.

5.4.1. The Islamic Republic of Afghanistan

Before August 2021, the former Islamic Republic of Afghanistan maintained legislation addressing terrorist offences, including the Law on Combat Against Terrorist Offences. Its provisions defined terrorist offences by reference to specified conduct and purposes directed at government, public order and other protected interests, and contemplated liability for both natural and legal persons. These provisions are treated here as part of the former Republic’s legal framework rather than as evidence of current de facto law.

Under the former Islamic Republic, the 2017 Penal Code included a dedicated chapter on cybercrimes. It addressed offences including unauthorised access, interference and related computer-system conductArticle 863, entitled ‘Cyber Terrorism’, provided that a person who commits a terrorist crime contained in the Code through a computer system or online is punishable under the Code’s terrorism provisions (Islamic Republic of Afghanistan 2017). Article 866 concerns disclosure of information and misuse of identity, not cyberterrorism. The Code did not establish a comprehensive framework for AI-mediated platform moderation. These former provisions are therefore treated as historical law and are not assumed to govern current de facto practice after August 2021.

5.4.2. De Facto Taliban Governance

Since August 2021, Afghanistan has operated under de facto Taliban authorities, and the current legal environment should not be treated as a straightforward continuation of the former Islamic Republic’s cybercrime framework. Recent UNAMA monitoring further documents continuing human-rights concerns under the de facto authorities, including restrictions affecting freedom of expression and the media (United Nations Assistance Mission in Afghanistan 2026). Joint reporting by UNAMA and OHCHR documents restrictions affecting media freedom and access to information, including censorship, arbitrary detention of journalists and a constrained media environment (United Nations Assistance Mission in Afghanistan and Office of the United Nations High Commissioner for Human Rights 2024). Amnesty International (2024) likewise documents human-rights concerns in Afghanistan, providing further context for the restrictions on fundamental freedoms under de facto Taliban governance. Afghanistan is therefore used as a deliberately divergent or limiting case: where domestic rules, procedures and review mechanisms are less transparent or less stable, platform-side notice, context-sensitive human review and effective appeal become especially important for users affected by automated moderation.

6. Comparative Analysis of the Regulatory and Accountability Gap

The preceding analysis shows that freedom of expression is protected but subject to restrictions that must satisfy the applicable legal requirements. It also shows that technology companies are not uniformly outside domestic law. Domestic accountability, jurisdiction and enforceability vary across the four jurisdictions: India and Pakistan impose specific intermediary or platform duties and compliance mechanisms; Bangladesh regulates online conduct principally through constitutional, criminal and cybersecurity rules with fewer platform-specific algorithmic safeguards; and Afghanistan presents a less transparent and institutionally constrained de facto environment. Even where domestic law purports to bind a platform, enforcement against cross-border services may be indirect, territorially limited, dependent on local presence, intermediary cooperation or technical blocking, or practically difficult. States nevertheless retain powers such as lawful content or blocking orders, data and preservation requests, intermediary obligations, criminal investigation, interception and network-level restrictions, while platforms retain contractual and technical control over ranking, recommendation, removal and account enforcement. The interaction is therefore better analysed through Platform AI Governance, State Digital Regulation and Co-regulatory Interaction than as two wholly separate systems.

Technology companies use automated systems to identify and compare images, videos, text and other signals with previously detected material associated with terrorist organisations or violent extremism. YouTube, for example, reported extensive automated enforcement against violent-extremist content in 2017 (Wojcicki 2017). Twitter likewise described automated tools as part of its enforcement systems (X 2018). Platform categories do not necessarily reproduce domestic legal definitions of terrorism: companies apply contractual community standards that may cover terrorist organisations, violent extremist entities, hate content and other policy-defined categories. In 2017 YouTube removed large numbers of videos associated with Anwar al-Awlaki, including material that reportedly did not independently violate then-existing Community Guidelines (Shane 2017). Meta’s standards likewise employ platform definitions and designation systems for dangerous organisations and individuals. These are examples of Platform AI Governance, not exercises of State criminal jurisdiction, although the two may interact through legal orders, referrals and other compliance processes. The 2017–2018 YouTube and Twitter examples in this paragraph are retained solely as historical illustrations of the early institutionalisation of automated platform enforcement; they are not relied upon as evidence of contemporary platform-governance practice, which is addressed in Section 7 using recent 2025–2026 materials.

International human-rights law protects freedom of expression online as well as offline (Ahmet Yıldırım v Turkey 2012).6 The European Court of Human Rights has recognised the Internet’s central role in the exercise of freedom of expression and information (Cengiz and Others v Turkey 2015).7 State surveillance, interception and access to communications engage privacy protections and must be lawful, non-arbitrary and accompanied by safeguards appropriate to the interference (UN Human Rights Council 2017). State measures affecting access, including shutdowns or broad blocking, must likewise be assessed against the applicable requirements of legality, legitimate aim, necessity and proportionality rather than treated as inherently lawful or unlawful (Anuradha Bhasin v Union of India 2020, para. 152).8 These forms of State Digital Regulation are analytically distinct from Platform AI Governance even where automated tools are used. Cybercrime is not a single offence under international law: domestic systems criminalise specific conduct, while international instruments facilitate harmonisation, investigation and cross-border cooperation. Where digital systems are used to facilitate or carry out terrorist offences, the resulting cyber-enabled terrorism remains distinct from terrorist use of ICT more broadly. Any use of AI by public authorities for investigation, security or surveillance must be assessed separately for its legal basis, purpose, necessity, proportionality, privacy and due-process implications.

The comparison reveals convergence in regulatory objectives but divergence in institutional design. India, Bangladesh and Pakistan each recognise security, public-order or crime-control interests that can justify restrictions on online activity when the applicable legal conditions are met, while Afghanistan’s present de facto environment operates through a distinct and less transparent legal-institutional structure. Across all four settings, global platforms continue to apply their own terms and automated systems. The accountability gap therefore appears in different forms rather than disappearing in more heavily regulated jurisdictions.

India’s distinctive feature is a comparatively elaborate intermediary due-diligence framework with explicit 2026 provisions concerning synthetically generated information and oversight of specified automated tools. Bangladesh’s current Cyber Security Act contains AI-related criminal prohibitions (Bangladesh 2026a, 2026b) but does not amount to a comprehensive algorithmic moderation code. Pakistan has moved towards a dedicated institutional platform-regulation model through SMPRA, PECA’s enlistment and content-control provisions, and the 2021 unlawful-online-content rules. Afghanistan differs because platform accountability operates against a de facto governance environment in which legal continuity, media freedom and procedural review are materially different from the other three jurisdictions.

These differences matter for corporate accountability. In India, platforms must map their systems to detailed intermediary due-diligence obligations; in Pakistan, compliance is increasingly channelled through a dedicated social media authority and statutory directions; in Bangladesh, platforms confront cybercrime and harmful-content rules but there are fewer explicit requirements concerning the audit of classifiers and recommender systems; and in Afghanistan, private platform rules may become a comparatively important practical source of speech governance because domestic remedies and institutional transparency are constrained. None of these settings displaces the corporate responsibility to conduct human-rights due diligence under the UNGPs.

The comparison also demonstrates why ‘AI regulation’ cannot be reduced to content removal. Detection, classification, recommendation, down-ranking, demonetisation, account restriction, human review, notice, appeal and remedy form a broader decision system. Legal analysis must therefore evaluate both the formal rule and the technical-procedural pathway through which that rule is implemented. Table 1 summarises the key similarities and differences among India, Bangladesh, Pakistan and Afghanistan in terms of legal protections, intermediary and platform regulation, AI-specific provisions, transparency, review mechanisms and comparative implications.

Table 1. Comparative matrix of the four selected jurisdictions (law as of 18 September 2026).

Variable	India	Bangladesh	Pakistan	Afghanistan
Expression/privacy	Constitutional protection; statutory restrictions; IT Act powers	Arts 39 and 43; statutory restrictions	Art 19; statutory restrictions	International obligations remain relevant; de facto rules and practice differ
Intermediary/platform regime	IT Act s 79 + IT Rules 2021, as amended	Cybersecurity law; no equivalent comprehensive AI-moderation code identified	PECA 2016, as amended in 2025; SMPRA; 2021 unlawful-online-content rules (Pakistan 2021; 2025)	Global platform rules operate amid uncertain domestic legal continuity
Security/unlawful content	Cyberterrorism and lawful government directions distinguished from platform rules	Cybercrime and terrorism provisions; Cyber Security Act 2026	ATA + PECA unlawful/offensive-content framework	De facto restrictions and media controls documented by UNAMA
AI-specific elements	2026 SGI duties; oversight/review safeguards for specified automated tools	Cyber Security Act 2026 includes specified AI-created/edited harmful content	No general AI-moderation code; statutory platform duties can drive automated compliance	No transparent general AI-moderation framework identified
Transparency/review	Grievance and compliance mechanisms; human oversight for specified automated tools	General criminal/procedural remedies; limited algorithmic-transparency duties	Authority/complaint/tribunal structure; implementation quality remains central	Procedural and institutional transparency materially constrained
Comparative implication	Most explicit automated-tool safeguards among the four selected jurisdictions	AI-harm provisions without a full platform-audit architecture	Most institutionalised dedicated social media regulatory structure	Limiting case demonstrating the importance of platform-side safeguards

7. A Human-Rights Test for AI-Mediated Moderation

The article proposes a seven-element test: legality, legitimate aim, necessity, proportionality, transparency, procedural fairness and effective remedy. The first four elements derive principally from legal standards governing State restrictions on expression; the latter three translate rule-of-law and business-and-human-rights concerns into operational safeguards for automated platform decisions. Applying the same sequence to State and platform conduct does not make their legal obligations identical; it provides a common analytical vocabulary for evaluating comparable effects on users.

Legality asks whether a restriction is grounded in an accessible and sufficiently precise rule. Legitimate aim identifies the objective served. Necessity asks whether intervention is required to address the identified risk, while proportionality asks whether the severity, breadth, duration and geographic reach of the intervention are commensurate with that risk. These questions are especially important for automation because a single classifier may trigger very different measures, from flagging for review to down-ranking, removal or account termination.

Transparency requires meaningful information about the policy basis and decision pathway, including whether automation materially contributed. Procedural fairness requires context-sensitive review by personnel with appropriate language and regional competence, particularly in high-impact or ambiguous cases. Effective remedy requires a realistic path to correction through restoration, reinstatement, correction of labels or reach restrictions, explanation and, where applicable, access to independent or judicial review. Periodic testing for accuracy, fairness, bias, privacy and security should complement rather than replace qualified human oversight.

Recent platform disclosures from 2025–2026 illustrate both the utility and the limits of these safeguards. YouTube’s official guidance describes a combination of automated detection and trained human review, including human review of appeals (Google/YouTube Help 2026). Its Community Guidelines Enforcement report for January–March 2026 also provides data on automated flagging and content removals, illustrating the operational scale of platform moderation (Google Transparency Report 2026).

Meta’s 2025 policy announcement acknowledged excessive enforcement errors and described changes intended to reduce over-enforcement, including adjustments to proactive moderation (Meta 2025). Its 2026 disclosure subsequently discussed the expanded use of AI in user support and safety functions (Meta 2026). X’s October 2025 Digital Services Act Transparency Report similarly describes a blend of machine-learning systems, heuristics, human review and appeals (X 2025). These disclosures are informative but remain platform self-reporting; independent audit, regulator access and researcher scrutiny are important for assessing whether safeguards operate consistently across languages and markets.

8. Conclusions

The revised analysis yields five concrete findings. First, the central problem is a regulatory and accountability gap rather than an absence of law: States possess public-law and criminal-law powers, while platforms possess contractual and technical control over visibility, recommendation and accounts. Second, the four selected jurisdictions converge around security, public order and cybercrime concerns but diverge in regulatory technique: India combines intermediary due diligence with express 2026 safeguards for specified automated tools; Bangladesh contains AI-specific harmful-content provisions without a comprehensive algorithmic-accountability regime; Pakistan institutionalises platform regulation through SMPRA and related PECA mechanisms; and Afghanistan remains a structurally different limiting case because legal continuity, media freedom and practical review mechanisms cannot be assumed to operate like the formal systems of the other jurisdictions. Third, AI changes the legal analysis because moderation extends beyond removal to detection, classification, recommendation, down-ranking, demonetisation and account restrictions, while false positives, false negatives, linguistic bias and contextual error directly affect freedom of expression. Fourth, State duties and corporate responsibilities must be legally distinguished: States remain bound by applicable human-rights obligations, whereas technology companies bear a corporate responsibility to respect human rights under the UNGPs through due diligence, mitigation and remedy. Fifth, AI-mediated moderation should satisfy the proposed safeguards of legality, legitimate aim, necessity, proportionality, transparency, procedural fairness and effective remedy, supported by language-aware testing, qualified human review, appeals, periodic risk assessment and meaningful external scrutiny.