The Cyber Protection Act, 2026 specifically criminalises digital blackmail, sexual harassment, revenge pornography, child sexual abuse material, sextortion, obscene content, and threats to publish or distribute such material. The offence can apply to genuine, altered, edited, or artificial intelligence-generated images, audio, or video, meaning that a perpetrator cannot avoid liability merely because the content is a deepfake.
A victim should first secure personal safety, preserve the original digital evidence, report the content to the relevant platform, and submit a written complaint to the police. If the police refuse to accept the complaint, section 40 provides a procedure for approaching the Cyber Tribunal with a written complaint and affidavit.
Governing law
The principal legislation is the Cyber Protection Act, 2026, Act No. 81 of 2026. It received presidential assent and was published in the Gazette on 10 April 2026, but section 1 provides that it is deemed to have taken effect from 21 May 2025. The Act replaced the Cyber Protection Ordinance, 2025 and repealed the Cyber Security Act, 2023, subject to its transitional and savings provisions.
The most important provision for online sexual harassment and non-consensual content is section 25. Other relevant provisions include section 4 on conduct occurring outside Bangladesh, section 30 on compensation, section 36 on preservation of data, sections 40 and 41 on complaints and trial, sections 42 and 43 on procedure and digital evidence, section 45 on the trial period, section 46 on the classification of offences, and section 48 on international cooperation.
Depending on the content and conduct involved, the Pornography Control Act, 2012 and the Penal Code, 1860 may apply alongside the Cyber Protection Act. Article 43 of the Constitution also recognises the privacy of correspondence and other means of communication, subject to lawful restrictions. Constitutional privacy is an important legal value, although criminal responsibility for abuse by a private individual must be established under the applicable penal statute.
What section 25 criminalises
Section 25 applies where a person intentionally or knowingly uses a website, social media account, messaging service, computer system, digital device, or another electronic means to engage in blackmail, sexual harassment, revenge pornography, sextortion, publication of obscene material, or conduct involving child sexual abuse material.
The provision covers information, video, audio-visual material, still images, graphics, and other digital content. It expressly extends to content that has been altered or edited and to content created or modified using artificial intelligence. The offence may therefore cover fabricated nude images, face-swapped videos, manipulated voice recordings, and other deepfake material when the remaining statutory conditions are satisfied.
Section 25 is not limited to content that has already been uploaded. Threatening to transmit, publish, or disseminate the material may itself fall within the offence where the communication is harmful or intimidating. A person who says, “Pay me or I will send this video to your family,” may therefore commit an offence even if the video is never ultimately published.
The punishment under section 25 is imprisonment for a term that may extend to two years, a fine that may extend to Tk 10 lakh, or both. Section 46 classifies the offence as cognizable, bailable, and compoundable with the permission of the court. Cognizable status permits police action according to the applicable procedural law. Bailable status means that bail is legally available, not that release is automatic. Compoundable status means that a settlement can conclude the prosecution only through the legally required court process.
Consent to creation is not consent to publication
A person may voluntarily take an intimate photograph, participate in a private video call, or send private content to a trusted partner. That earlier consent does not automatically authorise the recipient to publish, forward, sell, threaten to distribute, or use the content for coercion.
The legal issue is not limited to how the material was originally created. Section 25 examines the later use, storage, alteration, transmission, publication, dissemination, or threatened publication of the material and whether that conduct amounts to blackmail, sexual harassment, revenge pornography, sextortion, or another prohibited category.
Likewise, the fact that an image is false does not prevent harm. AI-generated intimate content may damage a person’s safety, dignity, employment, education, family relationships, and reputation even though the depicted event never occurred. The express reference to AI-altered and AI-created material is therefore a significant feature of the 2026 Act.
Not every unpleasant message is a section 25 offence
“Online harassment” is a broad everyday expression, but section 25 addresses particular forms of harmful or intimidating sexual, obscene, or blackmail-related conduct. An insulting comment, repeated unwanted message, commercial dispute, or rude social media post does not automatically satisfy section 25.
Where a person threatens injury to another person, reputation, or property to cause alarm or compel an act, sections 503 and 506 of the Penal Code concerning criminal intimidation may become relevant. Where threats are used dishonestly to obtain money or property, the extortion provisions beginning with section 383 may also require consideration. The elements of the specific Penal Code offence must still be proved.
Overlap with the Pornography Control Act, 2012
Section 8(2) of the Pornography Control Act, 2012 may apply where pornography is used to damage a person’s personal or social dignity, obtain money or another benefit through fear, or mentally torture a person using pornography recorded with or without that person’s knowledge. The stated punishment is rigorous imprisonment for up to five years and a fine of up to Tk 2 lakh.
The Pornography Control Act should not be applied to every abusive photograph or defamatory post without examining its statutory definition and the nature of the material. In a particular case, investigators and prosecutors must determine whether the evidence supports section 25 of the Cyber Protection Act, the Pornography Control Act, the Penal Code, or more than one applicable offence without imposing duplicative punishment contrary to law.
Immediate practical steps for a victim
A victim facing immediate physical danger should contact emergency services and move to a safe location. Paying a blackmailer does not guarantee deletion of the content and may lead to repeated demands. The victim should avoid threatening the perpetrator, attempting to hack the perpetrator’s account, or widely forwarding the intimate content to friends for confirmation.
Evidence should be preserved before accounts, posts, or messages disappear. The victim should retain the original device where possible and save the complete conversation, profile name, username, profile link, telephone number, email address, post URL, date and time, voice messages, payment demands, bank or mobile financial service details, and the platform’s report confirmation. Screenshots should show the wider context rather than only a cropped sentence. Original files, metadata, chat exports, and screen recordings may be more useful than screenshots alone.
The content should then be reported through the platform’s procedures for intimate-image abuse, impersonation, harassment, or sexual exploitation. Removal limits continuing harm, but the victim should preserve evidence before requesting deletion. Section 8 of the Cyber Protection Act gives public authorities blocking powers in specified public-interest and security-related situations, but it should not be presented as a universal victim-controlled takedown mechanism for every private intimate-content complaint.
Filing a police complaint
Section 40 provides that a case under the Act may be initiated by the directly aggrieved person, a person authorised by the victim in writing, or a member of a law-enforcement agency. The written complaint should provide a clear chronology, identify the suspect where known, describe the threats or publication, list the affected accounts and devices, and attach copies of the available evidence.
A person living outside Bangladesh may use the written-authorisation route where appropriate. However, section 40 does not itself set out every authentication or consular formality for an authority executed abroad. The acceptable form should be confirmed with the investigating authority or a Bangladeshi advocate before filing.
Women may also seek technical and legal assistance from the Bangladesh Police’s Police Cyber Support for Women. This support service does not replace the formal statutory complaint where prosecution is sought. A complaint to the nearest police station remains the primary legal route.
What happens if the police refuse the complaint?
If the aggrieved person, or a representative authorised in writing, asks the police to accept the complaint and the police fail to do so, section 40 permits a written complaint to be filed before the Cyber Tribunal with an affidavit.
The Tribunal may examine the complainant. If satisfied that there is a basis for investigation, it may direct the police to investigate. If it finds no sufficient basis, it may dismiss the complaint. The Tribunal cannot ordinarily take cognizance of an offence under the Act without a written police report, so the statutory route is not identical to an ordinary private criminal complaint.
Evidence of the earlier attempt to approach the police should be retained. This may include the receiving copy of the complaint, general diary reference, postal delivery record, email acknowledgement, or written refusal.
Preservation and use of digital evidence
Section 36 permits a data-preservation direction requiring a person or institution controlling relevant data to preserve it for ninety days. The Tribunal may extend preservation, subject to the statutory maximum of 180 days. This is an investigative mechanism exercised through the competent authority, not a direct order that a victim can independently impose on a platform. The victim should therefore tell the investigating officer immediately if account logs, deleted messages, IP information, or platform records may disappear.
Under sections 42 and 43, the Code of Criminal Procedure, 1898, Evidence Act, 1872, and Information and Communication Technology Act, 2006 apply where the Cyber Protection Act is silent, and forensic evidence obtained under the Act is admissible. Preservation of the original material and maintenance of a reliable evidential chain remain important.
Tribunal, appeal and compensation
Section 41 provides that offences under the Act are tried by the Cyber Tribunal, with appeals going to the Cyber Appellate Tribunal. Section 45 states that the trial should ordinarily be completed within 180 working days from the framing of charge. The judge may extend the period by up to ninety working days by recording reasons, and further delay must be reported to the High Court Division. This is a statutory case-management period, not a guarantee that every case will conclude within that time.
Under section 30, the Tribunal may direct that all or part of a fine, or an additional amount considered appropriate, be paid to the person or institution harmed by the offence as compensation. The victim should preserve evidence of financial loss, treatment expenses, relocation costs, loss of work, and other measurable consequences, although the amount remains subject to judicial determination.
Conduct occurring outside Bangladesh
Section 4 gives the Act important cross-border application. It may apply to a Bangladeshi citizen committing an offence outside Bangladesh, to conduct carried out from abroad through a computer, network, or digital device located in Bangladesh, and to conduct occurring in Bangladesh that produces effects outside the country. Section 48 also recognises international assistance under the Mutual Legal Assistance in Criminal Matters Act, 2012.
Legal jurisdiction does not guarantee immediate identification or arrest of a person using an anonymous foreign account. Cooperation from foreign platforms, service providers, banks, and overseas authorities may be necessary.
Case-law verification and unsettled issues
As of 13 July 2026, no official online Appellate Division or High Court Division judgment was identified that authoritatively interprets section 25 of the Cyber Protection Act, 2026. The Act is too recent for a settled judicial interpretation of concepts such as revenge pornography, sextortion, AI-generated intimate content, and the precise boundary between section 25 and the Pornography Control Act.
Older decisions under repealed cyber legislation should not automatically be treated as controlling interpretations of the new section. The case-law verification stage is therefore incomplete because no authoritative judgment under section 25 was available, not because a judicial rule has been omitted.
Common mistakes
Common mistakes include deleting the conversation after taking one screenshot, paying the blackmailer repeatedly, forwarding intimate content to multiple people, reporting only to the platform without approaching the police, waiting until account records disappear, confronting an anonymous offender, and assuming that a deepfake is outside the law.
Victims should also avoid publishing the suspect’s identity or reposting the disputed content in a way that harms the victim further, compromises the investigation, or creates separate legal risks.
For related Ain.bd guidance, see Cybercrime Complaints in Bangladesh: How to Report and Preserve Digital Evidence, Defamation on Social Media in Bangladesh, Criminal Intimidation and Extortion under the Penal Code, and Legal Remedies for Identity Theft and Fake Social Media Accounts.
Law updated as of 13 July 2026.
Primary-source references
The Constitution of the People’s Republic of Bangladesh, article 43.
The Cyber Protection Act, 2026, Act No. 81 of 2026, sections 1, 4, 8, 25, 30, 36, 40 to 46, 48, 50 and 51.
The Pornography Control Act, 2012, section 8.
The Penal Code, 1860, sections 383 to 389 and 503 to 506.
The Code of Criminal Procedure, 1898.
The Evidence Act, 1872.
The Mutual Legal Assistance in Criminal Matters Act, 2012.
Official service information issued by Bangladesh Police concerning Police Cyber Support for Women.
Disclaimer
This article provides general legal information and is not legal advice. The appropriate offence, complaint procedure, evidential requirements, jurisdiction, and protective measures depend on the content, threats, identity of the perpetrator, location of the parties, and available digital evidence. A victim facing blackmail, sexual exploitation, or threatened publication should promptly consult a licensed advocate in Bangladesh and report immediate danger to the police.