Introduction
A deepfake video can impersonate a person without anyone stealing a password, and a cloned voice can be used to cheat without access to any private information. The difference matters because Indian law attaches consequences to particular conduct, not to the use of artificial intelligence as such. Deepfakes therefore raise a question of attribution as much as of content: the creator, the person commissioning the content, the model provider and the hosting platform may all contribute to the same harm, to varying degrees.
Technical sophistication complicates this inquiry. Synthetic speech and images can support impersonation, while detection tools remain vulnerable to attacks directed at the media under examination.1 The correct legal answer cannot be that all realistic depictions are real, or that all synthetic depictions are illegal, and it cannot presuppose that every technological contributor knows the same thing.
The regulatory response in India is no longer limited to stretching old offences to fit new facts. The Ministry of Electronics and Information Technology (MeitY) set minimum requirements for synthetically generated information through amendments to the intermediary rules notified on 10 February 2026, which came into force on 20 February 2026.2 MeitY’s explanatory material acknowledges the legitimate uses of synthetic content while identifying its misuse, including through deepfakes.3
The question now is whether these duties create enduring responsibility that goes beyond faster removal. This article contends that the framework, while meaningful, is still unfinished. Liability requires separate inquiries into the nature of the underlying wrong, the defendant’s legally relevant contribution to it and, where applicable, intermediary protection. Preventive obligations can reinforce accountability, but they do not fill gaps in the elements of an offence. Read alongside constitutional judgments and personality-rights litigation, the legislation shows that reform should clarify what makes attribution wrongful and how the wrong is to be remedied; compulsory labelling or lost immunity are not, and should not be, substitutes for proof.
Through doctrinal analysis of the law in force on 13 October 2026, the article aims to assess the coherence and remedial reach of this framework, not to measure enforcement outcomes.
Deepfakes and the existing scholarly debate
Scholarship identifies different regulatory priorities. Chesney and Citron explain the privacy injuries that deepfakes cause and the “liar’s dividend” they create.4 Where others have focused on free speech, Silbey and Hartzog emphasise institutional repair.5 Habgood-Coote argues that narratives of technological catastrophe are misleading and that social practices provide a more concrete basis for reliable authentication.6
These approaches all depend on context, but they leave one normative question open: how is India to translate privacy protection and institutional trust into legally differentiated responsibility? The gap after the 2026 amendments is not a lack of rules governing synthetic content. It lies where prevention meets independently actionable harm: who is legally responsible, and to what degree, for what happens or fails to happen upstream in production and distribution. This article explores that relationship rather than assuming that stronger platform obligations would create a more effective liability regime.
Deepfakes and statutory liability under the Information Technology Act, 2000
A. Identity theft, cheating by personation, privacy violations and obscene content
Section 66C punishes the fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature. A cloned biometric characteristic could fall within the last category, but imitation alone does not show the use, or the fraudulent or dishonest intent, that the section requires.7 If courts treated every unauthorised likeness as identity theft, they would replace statutory interpretation with a general prohibition that the provision does not contain.
Section 66D punishes cheating by personation by means of a communication device or computer resource. Consider a fake executive’s voice used to persuade an employee to transfer money: the impersonation is part of a fraudulent operation. By contrast, an openly dramatic imitation is not cheating, however convincing the voice. Cheating requires deception that fraudulently or dishonestly induces the person deceived to act, not merely a false representation.8
Section 66E punishes intentionally or knowingly capturing, publishing or transmitting the image of a private area of any person without consent, under circumstances violating that person’s privacy. A fabricated intimate image that attaches a real person’s identity to a synthetic body sits less easily within this text: the harm is real, but whether such an image meets the statutory requirement of an image of that person’s private area is open to dispute. Publication and transmission are modes of the offence distinct from capture and should be recognised on their own terms, so the fact that nothing was captured does not by itself take a fabrication outside the section.9
Section 67 deals with the publication or transmission of obscene material in electronic form, and Section 67A with material containing sexually explicit acts or conduct. Section 67B is the closer fit for synthetic representation, since it expressly covers creating text or digital images depicting children in an obscene, indecent or sexually explicit manner. All three sections are subject to the exceptions for material justified as being for the public good and for material kept or used for bona fide heritage or religious purposes.10
These provisions do not amount to a general deepfake offence. A fabricated intimate image may engage several sections, but the prosecution must prove each offence charged. Conversely, a person may be harmed more by a non-obscene image that does not depict a private area, or by a deception that falls short of cheating, and neither may come within these sections at all. The result is a doctrinal gap between mismatched statutory elements, not an immunity for everything synthetic.
B. Jurisdiction, electronic evidence and supplementary remedies
Section 75 extends the Act to an offence or contravention committed outside India by any person, irrespective of nationality, where the conduct involves a computer, computer system or computer network located in India.11 Jurisdiction alone, however, neither collects foreign account records nor identifies an anonymous creator.
Electronic evidence raises three separate inquiries: admissibility, authenticity (whether the material has been manipulated) and attribution. The Bharatiya Sakshya Adhiniyam, 2023 deals with electronic records in sections 61 to 63, and section 63(4) requires a certificate for computer outputs.12 That certificate does not prove that the event shown occurred, nor does it conclusively identify who made the content. Investigators should preserve raw data, acquisition logs and available account evidence, and the technical investigation must link the manipulation to the accused’s conduct rather than simply label a file as synthetic.
Supplementary offences under the Bharatiya Nyaya Sanhita, 2023, including cheating, cheating by personation, forgery and defamation, remain subject to their own mental elements and particulars.13 As the personality-rights cases discussed below illustrate, civil injunctions can also restrain continuing abuse.
Data-protection remedies require particular caution. The Digital Personal Data Protection Act, 2023 provides for commencement in stages, and G.S.R. 843(E), dated 13 November 2025, brings the core obligations of data fiduciaries and the rights of data principals into force only eighteen months after its publication in the Gazette. Those provisions were therefore not yet enforceable on the date at which this article states the law.14
Intermediary regulation under the IT Rules, 2021: the 2026 amendments
A. Section 79 and conditional safe harbour
Section 79 shields qualifying intermediaries only in respect of third-party information; it does not protect every activity a technology company may undertake. Protection is conditional: the intermediary’s function must be limited to providing access to a communication system, or it must not initiate the transmission, select its receiver or select or modify the information transmitted, and in either case it must observe due diligence. The exemption is lost where the intermediary has conspired in, abetted, aided or induced the unlawful act.15
In Shreya Singhal v. Union of India, the Supreme Court read down the actual-knowledge route under section 79(3)(b) to a court order, or a notification by the appropriate Government or its agency, relating to the grounds in Article 19(2). Platforms are not to become the judges of what is illegal merely because someone objects to content.16 That holding must be distinguished from the later rules that set specific complaint-handling duties.
Rule 7 provides that an intermediary which fails to observe the rules loses the protection of section 79(1). The loss of an exemption, however, does not supply the physical, mental or material elements needed to prove a separate offence. The proviso to rule 4(1)(a) also provides that no liability may be imposed on a significant social media intermediary without an opportunity of being heard.17
Where one business provides generation, hosting and distribution, the particular function in dispute should therefore be analysed directly. A provider cannot dismiss unlawful output generated for a customer as third-party content, and offering a general-purpose model does not make it complicit in every user’s misconduct. The 2026 amendments remove one disincentive to intervene by clarifying that removing or disabling access to information in compliance with the rules, including through automated tools, does not violate the conditions in clauses (a) and (b) of section 79(2). They are silent on when “generation” amounts to the provider’s own act.18
B. Synthetic-content labelling, preventive due diligence and takedown obligations
The operative amendments commenced on 20 February 2026. Rule 2(1)(wa) defines synthetically generated information as audio, visual or audio-visual information artificially or algorithmically created, generated, modified or altered using a computer resource so that it appears real, authentic or true and depicts any individual or event in a manner that is, or is likely to be perceived as, indistinguishable from a natural person or real-world event. Routine or good-faith editing, the preparation of documents, educational or training materials and research outputs, and improvements in accessibility are excluded, provided they do not materially alter or misrepresent the underlying content or create a false document or electronic record.19
Rule 3(3) requires an intermediary whose computer resource enables the creation or dissemination of synthetically generated information to deploy reasonable and appropriate technical measures to prevent unlawful synthetic material, including non-consensual intimate imagery and content that deceptively portrays a natural person or real-world event. Permitted synthetic material must carry a prominent visible label or, for audio, a prominently prefixed audio disclosure, and must be embedded with permanent metadata or other technical provenance mechanisms, to the extent technically feasible. The unique identifier identifies the intermediary’s computer resource used to generate the content, not an individual author. The intermediary must not enable the modification, suppression or removal of the label or metadata.20
Significant social media intermediaries must require users to declare, before publication, whether content is synthetically generated, deploy appropriate technical measures to verify the accuracy of that declaration, and label content that the declaration or verification confirms to be synthetic. An intermediary that knowingly permits, promotes or fails to act on synthetic content in contravention of the rules is deemed to have failed to exercise due diligence; it cannot escape that consequence simply by asserting otherwise.21
Deadlines have different triggers. Under rule 3(1)(d), an intermediary must remove or disable access to unlawful information within three hours of actual knowledge, which arises only from a court order or a reasoned written intimation from an authorised officer. That officer must be not below the rank of Joint Secretary or equivalent or, where no officer of that rank is appointed, a Director or equivalent; for police intimations, each authorised officer must be not below the rank of Deputy Inspector General of Police. An intimation must state its legal basis, the statutory provision invoked, the nature of the unlawful act and the specific location of the content, and all intimations are reviewed every month by an officer not below the rank of Secretary of the concerned Government. Under rule 3(2)(a)(i), a grievance must be acknowledged within twenty-four hours and resolved within seven days, while complaints seeking removal of content under rule 3(1)(b), other than under sub-clauses (i), (iv) and (xi), must be resolved within thirty-six hours. Rule 3(2)(b) sets a limit of two hours for removing content that is prima facie in the nature of intimate exposure, nudity, a sexual act or impersonation in electronic form, on a complaint by the individual concerned or someone on their behalf. That last category is not confined to sexual impersonation.22
Speed has two sides. It protects victims faster, but it may also produce considerable defensive deletion where content is legally borderline or the identity of the person depicted is uncertain. Detection remains vulnerable to transformations such as compression, and to deliberate evasion.23 Reasonableness must therefore rest on demonstrable testing and attention to context, not on an unattainable promise of perfect classification. Small services and large platforms may differ in their capacity to comply, but both remain bound by the relevant obligations. Most importantly, a synthetic label establishes neither illegality nor consent: labelling cannot legitimise abusive imagery, and the absence of a label is not in itself an offence.
Judicial interpretation and constitutional safeguards
A. Freedom of expression, privacy and intermediary responsibility
Constitutional safeguards constrain both regulation and its implementation. In Shreya Singhal, the Supreme Court struck down section 66A as an unconstitutional restriction on speech, while upholding section 79 subject to reading down section 79(3)(b).24 The point is not that blunt impersonation receives blanket protection, but that indeterminate offensiveness is not a legally cognisable basis for censorship.
In Justice K.S. Puttaswamy (Retd.) v. Union of India, the Supreme Court held the right to privacy to be a fundamental right. Chandrachud J.’s opinion requires any intrusion by the state on privacy to satisfy the requirements of legality, a legitimate state aim and proportionality.25 These principles limit indiscriminate identification and general tracking, but they also support protection against intimate fabrications of identity. They do not confer unlimited ownership over every public portrayal of a person.
Bhandari and Bailey’s review of the Supreme Court’s post-Puttaswamy decisions finds that the judgment’s influence has been significant in some areas, limited in others and still uncertain in many.26 This has a methodological implication: invoking dignity cannot substitute for analysis of necessity, scope and safeguards. Satire, art and political criticism that use synthetic techniques require context-specific evaluation, not blanket censorship. Emergency intervention should therefore be combined with reasons, review and the correction of mistaken removals. Otherwise, rules designed to safeguard autonomy may give private moderation systems too much power over expression.
B. Personality rights and judicial responses to AI-generated impersonation
In Anil Kapoor v. Simply Life India, the Delhi High Court granted an ex parte interim injunction against the unauthorised exploitation of the actor’s name, likeness, voice and other attributes of his persona, including through artificial intelligence tools. The order also recognised that free speech about a well-known person is protected in the form of information, news, satire, parody that is authentic, and genuine criticism.27 The point is to craft remedies against misuse, not to require a licence for every mention of a celebrity.
In an ex parte ad-interim order in Arijit Singh v. Codible Ventures LLP, the Bombay High Court restrained the defendants, including platforms offering AI voice-conversion tools, from exploiting the singer’s personality attributes without his permission. The Court took the prima facie view that making available AI tools that convert any voice into that of a celebrity without permission violates the celebrity’s personality rights, and it expressed concern at the vulnerability of performers to unauthorised generative AI content used for commercial gain.28 These were interlocutory findings, not final findings establishing liability for model developers generally.
Taken together, these orders show that specific civil relief need not wait for a tailored deepfake offence. Their celebrity-centred setting nonetheless reveals a remedial difficulty: the dignity claims of ordinary people should not depend on their ability to show a marketable persona. That concern is better met by accessible privacy-based procedures than by automatically extending publicity rights to every representation.
Regulatory gaps and the way forward
A. Accountability of AI developers, deployers and intermediaries
Responsibility follows a sequence: identify an actionable wrong, attribute the conduct and knowledge of each participant, and then determine duties to act and immunities. Fraud perpetrated by a creator is distinct from impersonation commissioned or carried out by a deployer, and a host’s failure to act on a lawful notice raises a separate question again. Foreseeable harm can justify precautionary design without establishing criminal intention.
The reform proposed here is a framework of documented risk assessments, safeguards for identity-sensitive functions and recourse where misuse is substantiated. Developers should not be strictly liable for releasing adaptable technology. Equally, a commercial deployer should not escape responsibility by claiming that every decision was automated. Courts should require causal evidence linking the defendant’s control and statutory obligation to the wrongful act at issue, keeping a firm line between compliance failure and substantive liability.
B. Proportionate enforcement, content provenance and transparency
Provenance should support trust, but it is not a certificate of truth. A signed generation history aids investigation, but it does not prove consent, lawful purpose or fact. Habgood-Coote’s critique of purely technical responses supports pairing authentication with institutions that people trust, rather than substituting detection scores for judgment.29
Platforms should publish error rates, keep the efficacy of detection separate from legal determination, and allow human correction. Each restriction should identify the affected content and the legal ground, and go no further than necessary. Privacy-preserving identifiers are preferable to exposing users’ identities.
These proposals build on existing safeguards rather than replace them: rule 4(4) already requires that the specified proactive measures be proportionate, subject to appropriate human oversight and periodically reviewed, including for accuracy and fairness.30 Impact assessment should measure wrongful removals alongside missed abuse, and should not create incentives under which maximising removals counts as regulatory success.
C. Victim-centred remedies and institutional capacity
Beyond making harms actionable, victims need a clear path from complaint to preservation of evidence, relief and investigation. Platforms should provide complaint forms that allow the confidential submission of identity evidence, together with escalation channels. Police and forensic personnel need training that distinguishes the classification of content as synthetic from its attribution to a person. Legal aid should support applications for urgent injunctions without requiring the applicant to be a celebrity. It is more justifiable to build these mechanisms into existing grievance and court structures than to establish a new institution before existing capacity is understood. Removal must protect the individual without destroying the evidence needed to establish accountability.
Conclusion
The Indian framework regulates harmful deepfakes meaningfully but unevenly. Existing offences can reach fraud using another person’s identity and abusive sexual material, while the rules add preventive processes, provenance obligations and response timelines specific to each category of content. These mechanisms, however, serve a better legal architecture for intervention; doctrinal analysis cannot establish their effectiveness in practice.
The remaining difficulty is attribution. Participation, or non-participation, in a technical function does not by itself establish any of the conditions for liability. Interim orders on personality rights, like privacy law, provide grounds for relief, but their justification must also respect constitutional and procedural limits. Reform must address non-sexual synthetic injury explicitly, make the preservation and reporting of evidence accessible, and assign role-specific responsibilities based on actual capability.
The defensible regulatory purpose is therefore neither universal identification nor maximum deletion. It is a system that can explain why particular content is illegal, why a particular participant is liable, and why the remedy proposed is proportionate.
*****
Footnotes
1. Yisroel Mirsky & Wenke Lee, The Creation and Detection of Deepfakes: A Survey, 54 ACM Computing Surveys 1 (2021), https://doi.org/10.1145/3425780.
2. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, G.S.R. 120(E), r. 1(2), Gazette of India, Extraordinary, pt. II, sec. 3(i) (Feb. 10, 2026) (India), https://egazette.gov.in/WriteReadData/2026/269993.pdf.
3. Ministry of Electronics & Information Technology, Frequently Asked Questions on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 1 (Feb. 10, 2026).
4. Bobby Chesney & Danielle Citron, Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security, 107 Calif. L. Rev. 1753 (2019).
5. Jessica Silbey & Woodrow Hartzog, The Upside of Deep Fakes, 78 Md. L. Rev. 960 (2019).
6. Joshua Habgood-Coote, Deepfakes and the Epistemic Apocalypse, 201 Synthese 103 (2023), https://doi.org/10.1007/s11229-023-04097-3.
7. The Information Technology Act, No. 21 of 2000, India Code (2000), § 66C.
8. The Bharatiya Nyaya Sanhita, No. 45 of 2023, India Code (2023), §§ 318–319; The Information Technology Act, supra note 7, § 66D.
9. The Information Technology Act, supra note 7, § 66E.
10. Id. §§ 67–67B.
11. Id. § 75.
12. The Bharatiya Sakshya Adhiniyam, No. 47 of 2023, India Code (2023), §§ 61–63.
13. The Bharatiya Nyaya Sanhita, supra note 8, §§ 318–319, 335–336, 356.
14. The Digital Personal Data Protection Act, No. 22 of 2023, India Code (2023), § 1(2); Ministry of Electronics & Information Technology, Notification G.S.R. 843(E), cl. (c), Gazette of India, Extraordinary, pt. II, sec. 3(i) (Nov. 13, 2025) (India).
15. The Information Technology Act, supra note 7, § 79.
16. Shreya Singhal v. Union of India, (2015) 5 SCC 1, ¶¶ 117–119 (India).
17. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, G.S.R. 139(E), rr. 4(1)(a), 7, Gazette of India, Extraordinary, pt. II, sec. 3(i) (Feb. 25, 2021) (India), as amended up to G.S.R. 120(E) (Feb. 10, 2026).
18. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, supra note 2, r. 2(b) (inserting r. 2(1B)).
19. Id. rr. 1(2), 2(a)(ii) (inserting r. 2(1)(wa)).
20. Id. r. 3(c) (inserting r. 3(3)).
21. Id. r. 4(a) (inserting r. 4(1A)).
22. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, supra note 17, rr. 3(1)(d), 3(2); Ministry of Electronics & Information Technology, supra note 3, at 9–10 (Questions 14–18).
23. Mirsky & Lee, supra note 1.
24. Shreya Singhal, supra note 16, ¶ 119.
25. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, ¶¶ 310, 325 (Chandrachud, J.) (India).
26. Vrinda Bhandari & Rishab Bailey, Evolution of Privacy Jurisprudence in the Supreme Court of India: Evaluating the Impact of Puttaswamy, 36 Nat’l L. Sch. India Rev., no. 2, art. 7 (2025), https://repository.nls.ac.in/nlsir/vol36/iss2/7/.
27. Anil Kapoor v. Simply Life India, CS(COMM) 652/2023, ¶¶ 38–48 (Del. HC Sept. 20, 2023) (India).
28. Arijit Singh v. Codible Ventures LLP, Interim Application (L) No. 23560 of 2024 in Commercial IPR Suit (L) No. 23443 of 2024, ¶¶ 18–20, 24 (Bom. HC July 26, 2024) (India).
29. Habgood-Coote, supra note 6.
30. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, supra note 17, r. 4(4).