The non-consensual distribution of intimate images or videos online, known as non-consensual pornography or ‘revenge porn,’ has reached concerning proportions in Sri Lanka, with the speed, reach, and non-detectability of such recordings driven by the development of technology exacerbating the distress faced by victims.
Forms of online sexual violence are many, and in 2018, the Special Rapporteur on Violence Against Women, its Causes, and Consequences listed doxing, sextortion, trolling, online mobbing, online stalking, online harassment, and revenge porn among these.
The report defines revenge porn as “the non-consensual online dissemination of intimate images, obtained with or without consent, with the purpose of shaming, stigmatising, or harming the victim,” while sextortion refers to “the use of ICT to blackmail a victim [where] the perpetrator threatens to release intimate pictures of the victim in order to extort additional explicit photos, videos, sexual acts, or sex from the victim”.
Legal background
According to University of Sri Jayewardenepura (USJ) Faculty of Management Studies and Commerce Legal Studies Unit Head Attorney-at-Law Dr. Thusitha Abeysekara, Sri Lanka regulates the non-consensual sharing of intimate images or videos through a combination of online safety, cybercrime, criminal law, and data protection legislation.
He noted that the Online Safety Act No.9 of 2024 was the most directly relevant statute, which criminalised the publication or communication of private or personal content intended to harass, humiliate, or cause emotional distress.
“Importantly, the act provides victims with accessible remedial mechanisms through the Online Safety Commission and the courts, including orders for the removal or restriction of access to such content,” he explained.
The Computer Crimes Act No.24 of 2007 also applies where intimate images or videos are accessed, obtained, transmitted, or distributed without authorisation using computer systems. Although the act does not explicitly refer to intimate image abuse, its provisions cover the unauthorised handling or misuse of electronic data, making it relevant in technology-facilitated violations of privacy.
Traditional criminal law remedies are available under the Penal Code and the Obscene Publications Ordinance, which criminalise the publication and dissemination of obscene material. These laws can be invoked where the shared content meets the legal threshold of obscenity.
Finally, the Personal Data Protection Act No.9 of 2022 frames non-consensual intimate image sharing as a violation of privacy and data protection rights. Such conduct amounts to unlawful processing and disclosure of personal – and often sensitive – data. Once fully operational, the act will provide avenues for corrective measures and sanctions against those responsible for the misuse of personal data.
What victims can do
Police Spokesperson ASP F.U. Wootler told The Sunday Morning that prompt reporting improved the chances that the Police and Sri Lanka Computer Emergency Readiness Team (Sri Lanka CERT) could act on such situations quickly.
He advised first reporting the matter to Sri Lanka CERT or the Computer Crime Investigation Division (CCID) in Colombo. “Since an inquiry or an investigation has to be initiated, victims can lodge a complaint with the Criminal Investigation Department’s (CID) cyber crimes division. Any person close to Colombo can come to the CCID and hand over a letter or complaint directly. Sri Lanka CERT will also provide assistance,” he noted.
Similarly, Dr. Abeysekara outlined the course of action victims could take when intimate images or videos were leaked online, noting that Sri Lanka’s legal framework provided victims with multiple, complementary avenues of redress.
“When non-consensual intimate images or videos are circulated online, the first legal step for victims is to make a complaint to the Police, particularly to the CID or its cyber crimes unit. All available evidence, such as screenshots, URLs, timestamps, and platform details, should be preserved and submitted to support the investigation.”
“This activates investigative powers under statutes such as the Computer Crimes Act, Penal Code, and Online Safety Act, allowing authorities to trace perpetrators, secure electronic evidence, and commence prosecutions where offences are established,” he said.
Sri Lanka CERT Lead Information Security Engineer Charuka Damunupola also stressed the necessity of gathering detailed evidence, including platform information, links to pages or posts, messaging groups, or websites links. Moreover, any threatening messages or phone numbers will also count as evidence.
According to Dr. Abeysekara, victims can also file complaints under the Online Safety Act before the Online Safety Commission or the Magistrate’s Court, which can enable authorities to issue directions for the removal of harmful content and prevent further dissemination.
Courts may also grant interim or permanent orders to restrain the continued circulation of such material and, where necessary, compel disclosure of the identities of anonymous perpetrators involved in uploading or sharing the content, he explained.
Separately, victims can pursue civil remedies in the District Court, including claims for damages arising from unlawful publication, distribution, emotional distress, reputational harm, and violation of privacy.
Where personal data is involved, victims may seek relief under the Personal Data Protection Act once the relevant enforcement provisions are in force, particularly for unlawful processing and disclosure of personal and sensitive personal data.
Repercussions
As Dr. Abeysekara explained, under Sri Lankan law, there are several overlapping statutes governing legal repercussions for perpetrators involved in the non-consensual sharing of intimate images or videos.
However, he pointed out a key limitation, which was that Sri Lankan law did not currently recognise a distinct offence specifically termed ‘revenge pornography’ or sextortion. “As a result, prosecutions are typically constructed using general offences across multiple statutes, which can lead to variability in penalties and challenges in consistent enforcement.”
The Online Safety Act makes it an offence to communicate or publish harmful online statements, including the disclosure of private or personal information intended to harass, humiliate, or cause distress. Accordingly, Dr. Abeysekara said that such conduct may attract criminal penalties, including fines and imprisonment, with the nature and severity of punishment depending on the circumstances of the offence and court orders.
The Computer Crimes Act (especially Section 6) enables penalties where unauthorised access to computer systems or handling of data is carried out with intent to commit an offence.
Meanwhile, perpetrators can be punished with imprisonment and monetary fines under the Penal Code and the Obscene Publications Ordinance, where the publication, distribution, or transmission of obscene photographs or videos constitutes a criminal offence.
Further, the Personal Data Protection Act, once applicable, provides sanctions for the unlawful processing, disclosure, or misuse of personal data, including intimate images that qualify as personal or sensitive personal data.
Technical challenges
Despite legal remedies, stopping the spread of Non-Consensual Intimate Images (NCII) remains technically difficult.
According to Damunupola, while Sri Lanka CERT can provide technical assistance, such as taking down the content on websites or any content being spread through TikTok, it cannot assist in controlling the spread on other social media platforms. Moreover, the Telecommunications Regulatory Commission of Sri Lanka (TRCSL) can only advise or instruct Internet Service Providers (ISPs) to block relevant websites, and has no authority over the content itself.
Damunupola said: “Once NCIIs are released online or begin to spread on social media, the technical instruments available to stop this are very limited. Therefore, people should give careful consideration prior to recording or sharing such material, since it may one day be released, even accidentally.”
He emphasised that consent to record such material did not equate to consent to publish or distribute, noting that the use of such material to threaten or coerce victims to remain in relationships was a common occurrence.
In most cases, Damunupola noted, the perpetrator was someone known to the victim. “In 90% of cases, the individual who shares such images is likely to be someone known to the victim. In such cases, their details should also be conveyed, since they have full responsibility to ensure that such material is not leaked.”
While he noted that Sri Lanka CERT could assist with takedowns if the content appeared on an obscene website, he cautioned: “Technically, it is difficult to prevent the spread of such material.” If such content appears on social media, the Bureau for the Prevention of Abuse of Children and Women or the CID’s CCID will need to intervene.