A Comparative Study of the Impact of Artificial Intelligence on Privacy in India, The United States, The European Union, and China

INTRODUCTION

The Artificial Intelligence (AI) has emerged by the various works of scientist and programmers who were determined to make life easier by creating a technology which helps the human to perform complex tasks with minimum interference, maximum efficiency and takes less manpower. The term Artificial Intelligence was coined by John McCarthy for the workshop at Dartmouth in 1956¹ he proposed this name stating that he had to call it something. It is one of the greatest technological developments in the 21^st century. The evolution in the AI has reshaped the efficiency, decision making capabilities and producing services with minimum manpower across multiple domains.² the AI is available in vast domains from, education, healthcare, autonomous vehicles, smart houses, etc. Even though the AI are equipped with these skills they tend to breach the privacy, we feed our data and our personal information to get the required tasks to be done by using these AI programs, but it creates a vulnerability and risk for privacy. The AI is used with an intention to get our work done in less time, but there is no knowledge of the AI self-development mechanism. Whenever we use these AI tools and other websites, the website as well as the AI requires a constant stage of development to improve the quality of service they provide by understanding the needs of the customer/user. From making the platform user friendly to all necessary developments the Data stored by the AI is used.

The AI follows a mechanism called machine learning that requires storage of Data’s largely to understand and develop this raises the questions of consent of owner; to learn and produce the works and complete the tasks as desired by the user the AI requires to store these data. Presently, artificial intelligence incorporates machine learning, which is used for data filtering and predicting results. However, deep learning has been incorporated into AI as well, which has improved image recognition and translation capabilities. Along with the advancement of AI, several ethical dilemmas arise that need attention. These dilemmas are related to decision making in various areas, such as lending, hiring, and healthcare. The use of personal data by AI systems creates several governance challenges that need to be considered. At the moment, governments are designing guidelines for AI systems from an ethical perspective. This is also making us think about the role of humans in a new light. The future of AI depends on how it is integrated into society, and for that, strong laws need to be in place. In this research paper, the raising concerns of privacy due to the storage of data will be addressed and effective solutions to overcome the breach will be discussed. To understand such issues in detail, we should have a knowledge of how AI has set a benchmark and how it works. The deepfake is one such technological development that can cause confusion in the viewers mind distinguishing the work to be a real one or an AI generated, this is due to the lack of knowledge that the viewers possess the AI is not only a threat to data security by storage of data by way of ML and Deep learning it is also a threat to victimize others by using deepfake technology to damage the reputation, create a confusion in the choice of people and other harmful effects. The deepfake technology uses Deep learning to create seamless and hyper realistic video, images and audio works.

DEEP LEARNING

Deep learning is one of powerful methodologies in the subset of machine learning and greatly influences the recent developments in Artificial Intelligence (AI). It is defined as the application of deep neural networks that have multi layers of interconnected computational units that process data in a hierarchical situation. This model is based on the human brain where complex networks of neurons are involved in processing information. Even though artificial neural networks are not able to recreate the entire cognitive processing capabilities of the human brain, because of their layered architecture, they can be used to perform tasks which were once thought to have been dependent on human brains, like image recognition, speech processing, and language understanding. Another characteristic of deep learning is the high levels of flexibility and capability of processing complex and unstructured data. Deep learning systems can extract relevant features out of raw inputs, unlike traditional machine learning methods which tend to rely on manually engineered features. This is the process that can take place in several layers of abstraction. As an example, in image recognition problems, the initial layer of a deep neural network can process simple components like pixel intensity and identify edges. The next layer distinguishes more complicated structures like corners and contours, and the lower levels distinguish parts of objects. Finally, the last layers integrate these characteristics to categorize or give sense to the image in totality. This top down learning procedure enables the deep learning systems to be remarkably accurate in pattern recognition activities.

Deepfake AI tools directly integrate deep learning and machine learning, and it is precisely this integration that enables them to bypass privacy concerns by the way they store and use the data to train and make inferences. Deepfake The process of deepfaking draws upon the field of deep learning, a branch of machine learning that trains simple neural networks, particularly Convolutional Neural Networks (CNNs), to the task of identifying simple patterns in images, video, and audio. They are trained to recognize and render facial features like eyes, nose, jawline, skin texture, and micro-expressions associated with large sets of faces and videos and apply them to other faces or shapes, allowing the creation of realistic face-swaps or synthetic faces and voice-clones. The most frequent architecture is the Generative Adversarial Network (GAN), which comprises of a generator that synthesizes the media and a discriminator that attempts to differentiate between the fake and real, and in training, the best way to think about deepfakes is to keep improving the generator until the discriminator can no longer consistently identify the fakes. All of that requires machine learning pipelines that can automatically source, label, and archive large collection of personal images and videos, frequently scraped (or otherwise obtained) on social media, open databases, and other online sources, with no indication whatsoever of express, informed consent by the person that is being photographed. By doing so, facial picture, voice records and behavioural-expression are all transformed into statistical features that are inputted into the design of the model, in effect transforming biometric data into AI-generation raw material instead of safeguarded personal data. What is more concerning, deep learning not only stores what it learns in stored images but in the weights and parameters of the model, so that when the raw data to train it on gets deleted this capability can still be used long after that point. This implies the privacy-invasive patterns will be embedded on the model itself, which will circumvent the age-old tools in data-protection appraisal, including the right of erasure, and making it very hard to audit or un-use how data of a person has been made use of.

Moreover, machine-learning storage and training infrastructure of deepfakes themselves is often strongly non-transparent and non-jurisdictional, existing in the cloud, third-party AI-platforms, and distributed-compute clusters distributed across different countries with different degrees of data-protection implementation. Users are presented with typically wide-ranging and general terms-of-service and one-click agreements that enable a provider to store training data permanently or re-use it elsewhere in AI-products, and because deep-learning models are typically a black-box, users (and sometimes even the developers) have no idea how a particular face or voice is being reconstructed. Due to this, not only technical foundations behind deepfake applications, but also the processes by which they amass, archive, and utilize individual biometric data in a manner that avoids traditional privacy-protections, deep fake rendered individual likenesses into fungible, marketable commodities.

DEEP FAKE TECHNOLOGY

The AI has the capacity to influence decisions and create different perspectives. By making videos that mimic reality, such development of artificial intelligence has resulted in the appearance of deepfakes as one of the most tricky and debatable digital age technologies. Deepfakes or deep learning fakes are terms combining deep learning and fake and are defined as highly realistic synthetic media content produced or altered by the application of advanced machine learning algorithms. These can be pictures, audio recordings, or videos that can persuasively portray people saying or doing things that they did not do. Being a form of synthetic media, deepfakes have profoundly transformed the essence of digital representation by disturbing the border between reality and fabrication, and therefore, putting forward serious legal, ethical, and social issues. Deep fake technology is the application of deep learning models, especially neural networks that can process and analyze large amounts of data. Autoencoders and generative adversarial networks (GANs) are some of the techniques that are important in this process. Such systems are fed by a large set of data in the form of images, videos, and audio recordings of people and can learn complex patterns, including facial expressions, speech, and behavioral peculiarities. By means of repeated procedures, these models produce artificial outputs that are useful and near data in the real world, to such an extent that they are not perceived as artificial. This hyper realistic simulation ability is a big breakthrough to the previous types of digital editing which were relatively easier to spot and required a lot of technical skills.

There are various factors that have supported the proliferation of deepfake technology, the most prominent of them being the growing accessibility of computational resources and big data. Recently, progress in generative artificial intelligence has caused the cost, time, and expertise of generating high quality synthetic media to fall drastically. Consequently, Deep fake technologies are now widely available, and user-friendly sites allow people with a small technical background to produce convincing digital manipulations. This democratization of technology has increased the scope of those who can create deepfakes, increasing the possibilities of its positive effects, and the risks inherent in it. It should be noted that deep fake technology is not actually harmful. Quite the contrary, it has a great variety of legitimate applications in different fields. Deepfakes are applied in the entertainment industry to create better visual effects, recreate historical persons, and create immersive cinematic experiences. Likewise, synthetic media may be applied to create interactive simulation, virtual teachers, and custom-made learning settings. Deepfake technology is also prospective in the context of accessibility where AI created voices and avatars can help people with disabilities by allowing communication and interaction. These positive uses outline the potential buildup of deepfakes in terms of transformation under positive and ethical usage.

Nonetheless, the very aspects of deepfakes that can be used to its advantage similarly predispose it to abuse. A major issue that relates to deepfakes is that it can be used to achieve mass deception. Deepfakes can be deployed to disseminate misinformation and influence the general opinion by crafting very realistic and yet fake content. Specifically, it becomes important when it comes to political communication, as with the help of deepfakes of influential people, it is possible to manipulate election results, provoke social conflicts, or destroy the democratic system. The power to create convincing evidence is a direct obstacle to the sincerity of the information ecosystem and brings up the problem of the credibility of digital media as a source of truth. Deepfakes do not just create danger to the political sphere. Over the last several years, the application of the deepfake technology in financial fraud and cybercrime has increased significantly. Audio and video generated by AI can be used to imitate individuals with a high level of accuracy and carry out elaborate frauds like voice phishing, identity theft, and corporate frauds. It is reported that AI based financial fraud has gained a tremendous proportionality, and deepfake technologies are at the forefront to enable such frauds. The high advancement of these techniques makes it hard to determine what is valid and what is not, hence increasing the chances of losing money and reputation. The other aspect of deepfake misuse that is important and critical concerns the dimension of privacy and personal autonomy. The most publicized type of abuse is the production of non-consent explicit material, which has mostly affected women and vulnerable persons. This form of practice is a gross infringement of privacy and dignity that has extensive psychological and social implications. The possibility to play with an image of a person without his/her permission sets out the basis of central issues of the data property and consent and the ethical limits of technological innovation. In addition, the speed with which such content is shared on digital platforms renders it hard to say the least when victims want to pursue redress or regain control of their digital space. Besides such direct injuries, deepfakes add to the overall decrease in digital information trust. With the growing sophistication of the synthetic media, people will struggle to know whether they are viewing genuine or falsified information. Empirical evidence shows that people are becoming less adept at identifying deepfakes, and the level of accuracy is nearly as high as a simple guess in some situations. Such a decrease in detection skills has serious consequences, as it will ruin trust in visual and auditory testimonies. The so called liar dividend aggravates this even further, because people are able to reject veritable information as being fake, and thus avoid responsibility and give rise to doubt.

Deepfakes have complicated legal issues too. Current legal regulations, such as those that regulate defamation, privacy, and intellectual property, are hardly capable of dealing with the specifics of AI based content. As an example, to identify a liability in a deep fakes case, it might be difficult to identify the liability in a case where there are several actors who create, spread, and distribute synthetic media. Likewise, the problem of jurisdiction is also evident when the deepfake material is created in a particular state but shared all over the world. Although certain jurisdictions have started to have their own laws directly addressing deepfakes, these have been inconsistent with efforts, and not comprehensive enough to tackle the global aspect of the issue. Regulatory wise, there is the dilemma that a balance must be struck between ensuring misuse is alleviated and pushing the innovation forward. Excessive regulation can be counterproductive to the advancement of technology, whereas lax regulations can permit dangerous ways of doing business to flourish. This is leading to the realization that broad and dynamic regulatory frameworks are warranted to reduce the dynamism of deep fake technology. These frameworks should include the aspects of data protection, accountability, transparency, and user awareness so that the outcomes of deepfakes should be achieved without the violation of the basic rights. The use of technological countermeasures has also been suggested as a way of reducing the dangers of deepfakes. They involve coming up with detection algorithms, which can detect synthetic media, and digital watermarking and authentication techniques aimed at checking the source and integrity of content. Furthermore, these measures are not as effective as the rates of generative AI innovation are high. The ability of the deep fake generation is increasing with the advancement of detection technologies creating a technological arms race. The given dynamic explains the necessity of a complex solution, which would integrate technological solutions with legal and societal interventions. The fact that the threat of deepfakes is changing only increases the urgency of mitigating these threats. The variety of malicious activities already conducted with the help of synthetic media are disinformation campaigns, cyberattacks, espionage, and psychological operations. Scalability and flexibility of deep fake technology facilitate the threat of actors to base their plans on individual targets, therefore, making their missions more successful. Further, the relatively cheap and easy availability of deepfake technology has increased the number of prospective users, whether state agencies and organized crime or individual offenders. Another issue relates to the social consequences of deep fake technology in the long term. This is because synthetic media is increasingly becoming widespread, and as such it can potentially change the manner in which people receive and relate to information. The loss of trust in online content can bring down democratic institutions, social cohesion, and the rule of law. In this situation, capacity to define and confirm the truth turns out to be more vital and effective mechanisms to authenticate and account are necessary.

IMPACTS OF DEEPFAKE IN PRIVACY AND REPUTATION³

Deep fake technology has posed an insurmountable challenge on the privacy of individuals and the maintenance of personal reputation. Allowing the process of creating highly realistic and yet fabricated images of people, deepfakes have dramatically changed the relationships of identity, consent, and trust within the digital world. In contrast to the classical manifestations of data misuse, deepfakes are not just a form of sharing personal data but an active interference with a statement of appearance, voice, and behavior, which is why it becomes a new type of harm that goes beyond the traditional violations of privacy.

1. Breach of Informational and Decisional Privacy.

Deepfakes are inherently detrimental to the principle of informational privacy that assumes that a person possesses the power to regulate the process of gathering, using, and sharing personal information. The situation with deepfakes is that personal information, photos, videos, voice recordings, and many others, are commonly copied to publicly accessible sources and reused without the understanding or permission of that individual. This personal data is used without one having been given permission and autonomy. People lose not only control over their data, but also when it comes to the methods of how their identity is made and displayed to others. In addition, deepfakes also violate the principle of decisional privacy as they may create the illusion that the person said or did something he or she has never meant. The misrepresentation of personal agency may be particularly pernicious in sensitive situations, such as those in the workplace, in politics, or in other relationships.

2. Non Consensual sex material and Dignitary injury.

The development of non consent explicit materials is one of the most dangerous uses of deep fake technology. Much of deepfake content on the internet entails superimposing the faces of people with adult content, usually abusing women. Such maltreatment is a serious act of dignity and body autonomy infringement. In contrast to conventional methods of harassment, abuses based on deepfakes leave a false but very convincing visual history, and it may be hard to deny it. The victims usually suffer serious psychological trauma, social stigma, and reputational loss. The fact that such material is being propagated and spread at a rapid rate across digital platforms only worsens the damage; that is, it is almost impossible to completely erase or even confine the content once it is released. In India there is an instance where a famous social media Influencer has filed a complaint against a deepfake video consisting of her.⁴

3. Reputational Damage and Defamation.

Deepfakes represent a direct risk to the reputation of individual people as it becomes possible to craft a fake post that will distort the character, behavior, or ideology of a particular individual. Deepfake videos in most instances are utilized to portray persons who have committed an illegal, unethical or socially inappropriate act. The reputational impact of this content may be short and long term. In the workplace, a person can lose job opportunities, destroy his or her career, and lose professional integrity. At the individual level, deepfakes may cause problems in relationships, especially social status, and ostracization. The digital content is further complicated by the pace with which it spreads unlike the efforts to establish the content authenticity or to come up with clarifications. Legally, deepfakes make enforcement of the law difficult for defamation. The conventional defamation models presuppose the demonstration of falsity, publication, and damage. Nevertheless, the factual quality of deepfakes complicates the determination of falsity among the masses, despite the presence of technical evidence. This puts a scenario where people can be badly affected in terms of reputation even though there would be legal solutions.

4. The Lie and Trust Dividend and Erosion of Trust

There is another dimension of reputational damage which is called the “liar dividend phenomenon”. With an increased level of awareness of deepfake technology, persons caught committing wrong can say that the real evidence is made up. There are two implications for this dynamic. One, it is a weakness in accountability, as it enables the wrong people to escape responsibility. Second, it introduces the skeptic atmosphere of a general character where everything published online can be doubted. To personalities, it implies that the false and true depiction of their behaviors can be disputed, hence making it more challenging to build the truth and safeguard the reputation.

5. Personality, Embezzlement, and Stealing identity.

Deepfakes are also a part of a larger identity theft scheme in which the likeness of a person is used to make completely fake personae. Such an abuse of identity is not limited to financial fraud but also includes the misuse of reputation. As an illustration, people can be shown as promoters of products, giving provocative views, or engaging in actions without their authorization. This abuse not only violates personal rights but also the digital space of originality in individual identity. The scale of ability to duplicate and control identity brings up basic ownership and control of the image and voice.

6. Social and Psychological Implications.

The consequences of deepfakes on privacy and reputation do not solely affect legal and economic damage but have a considerable psychological and social aspect as well. Deepfake abuse also leads to anxiety, depression, and decreased trust in digital platforms by the victims. This awareness of the possibility of being manipulated and misused without permission because the likeness is under a person can be accompanied by the feeling of vulnerability and loss of control. On the social level, deepfakes may interfere with the relationships between individuals and cause misunderstandings and conflicts based on fake information. In severe scenarios, it can cause harassment, blackmailing, or coercion, which only adds to the damage that the victims have suffered.

7. Long term Consequences to Privacy Conventions.

The extensive application of deepfake technology has further implications with the standards of society in terms of privacy and reputation. With the increasing usage of synthetic media, people might need to resort to defensive mechanisms, e.g. reducing their online activity or not sharing personal content. Simultaneously, the erosion of the expectations of authenticity and consent, at the same time, could be the result of the normalization of manipulated media. The deep learning and machine learning incorporated by the AI will use the photos and the other inputs that have been given to the system and the privacy will be at stake.

LEGAL CHALLENGES IN REGULATING DEEP FAKE CONTENTS

The issue of regulating deep fake content is quite complex and cuts across the technological, legal, and ethical realms. As the deepfake technologies are most rapidly evolving, the legal systems find it hard to cope with their pace, as, most of the time, they can remain at the level of development of the synthetic media. Some of the primary challenges, such as the inability to legally define deepfakes, conflict between the rights of free speech, jurisdictional concerns, and the necessity of technological based solutions, make regulation efforts a difficult endeavor. Defining what amounts to a deepfake and what damages can be brought about by such legal definitions is one of the major challenges. The current legislation tends to concentrate on evils, including defamation, privacy infringements, or fraudulent activity, yet perhaps they overlook the specifics of synthetic media. Indicatively, in the Indian case, the legal structures should be strengthened through the enactment of laws that carry harsh penalties against malicious creation and sharing of deepfakes in terms of fines and imprisonment⁵. The international organization such as the UN is working on the significance of constructing responses that acknowledge human rights, such as the freedom to express oneself, whilst tackling the threats of deepfakes. It is a matter of designing rules that discourage the intent to misuse it without censoring good expression and artistic work.

One of the frontline measures against deepfakes is the content moderation policies. The policy of Meta, such as, bans AI edited content which may be misleading to the viewers although it does not prohibit satire and parody. This difference is significant due to its acknowledgment of cultural and artistic worth of some synthetic media in the quest to stem out ill minded misinformation. Nevertheless, it is difficult to enforce. Detectors cannot be considered 100 percent and can be expensive to moderate by humans. In addition, the bad guys can easily keep up with the times and come up with novel ways of escaping through them. Thus, the deepfakes need to keep changing with the new approaches, and this requires ongoing technological advancement and a concise set of community rules. The regulation also faces problems in jurisdiction, particularly in cases where deepfakes are being made or distributed outside the jurisdiction. Collaboration with other countries is necessary because single handedly, actions are not always enough. An example of this is the European Union, which has been eager to strengthen its arsenal in the fight against disinformation, such as deepfakes, with such measures as the Code of Practice on Disinformation⁶.

Another important issue of regulation is the necessity to minimize harm and provide protection to the basic rights, including free speech. There are certain deepfakes used with entertainment or artistic intent, and excessive regulation would negatively affect these liberties and infringe the rights of the individuals that create the content. Such a detecting AI would lack the skill to distinguish between the good and the harmful content.so, there cannot be a strict regulation⁷. It is a complicated but required method of differentiating between malicious deepfakes and harmless or artistic use of such technologies to prevent censorship. Furthermore, there is a risk of abuse of regulation as such, i. e. of affecting the dissent or of using it against a marginalized group, which should be a matter of prudent handling. Clear legal procedures, regulation of control, and citizen involvement on the same are required to make regulations fair and effective.

Deepfake technology not only is borderless but makes it difficult to enforce and regulate. The international community, including the Digital Trust Initiative of the World Economic Forum, is trying to ensure the responsible use and development of AI, including steps to combat malicious deepfakes. An example of how cooperation at the regional level can contribute to regulatory effectiveness is the enhanced disinformation of policies by the EU. Nevertheless, the differences in the legal standards and technological capacities between countries continue to be problematic.

POSITION IN INDIA

In India the laws are still evolving, the existing laws are traditionally not equipped to deal with the AI and its adverse usage. But the laws like the Information Technology Act provide framework for Intermediary responsibility and proactive monitoring⁸ . Still the liability of the intermediaries remains uncertain, and there is a need for specific guidelines to address Deep fake technology directly. The government of India has issued rules to media platforms to label the manipulated content and active monitoring of the contents available in the public domain. They classify the obscene and vulgar contents as sensitive content, yet there is no comprehensive legislation for the dealing of deep fake contents. Deep fake is a threat to social stability; they are capable of creating controversies, diversions, exacerbate communal tensions, incite violence, and undermine democratic institutions. Foreign and non state actors may use this technology during elections, causing cohesion and destabilizing the country. This highlights the importance of early intervention and deterrent measures. The knowledge of deepfake is limited, so they have the tendency to influence the people and work asper the wish of the person who created such deepfake content, making the victim vulnerable. The landmark judgement in puttaswamy case affirms the privacy of a person to include with the right of life and personal liberty, this gives the inference that the people are posses with the right to have control over the personal information dissemination but practically the victims end up with mental agony as there is no specific law. Speaking of the rights, it includes the right to erasure and the right to be forgotten, yet there is no knowledge of how it works in case of deep fake. Though there is a potential danger of deepfake, there are no specific laws or regulations that deal with these problems.

AI AND PRIVACY IN INDIA

A. Right to Privacy in India

The Indian right to privacy has developed considerably over the years to the point that it is considered a fundamental right as established by the Constitution. In a landmark judgement for privacy in India, KS puttaswamy v union of India⁹, the court ruled that right to privacy is included in the right to life and personal liberty. This ruling highlighted the fact that privacy is the right to regulate personal data, bodily integrity, and autonomy that play a crucial role in enhancing individual dignity and liberty. In later cases like Sasikala Pushpa Versus Facebook India¹⁰ and Others the consent of parties before uploading the photos are also agreed stating privacy is at stake. This right is of great concern in the context of deepfakes. Deepfakes, the artificially created media that can easily pass as something a person did or said, is an immediate threat to the reputation and privacy of an individual. The production and sharing of such content are against the privacy rights of an individual as they lack control over their image and personal data. The ruling of Puttaswamy underlines that infringement should be legal, necessary, and proportional, and that seems to be the challenge of the legal systems used nowadays with regards to combating malicious deepfake content. Moreover, the Indian courts have accepted that the privacy rights are also applicable to the digital information and Internet appearance. The ruling of the Supreme Court highlights that privacy rights, including the use of personal data, such as images and videos, are safeguarded by the Supreme Court, particularly when no consent is given or with ill intent. This juridical context gives a basis in dealing with violations that pertain to deepfakes, and how the legal protection against unauthorized synthetic media that undermine the privacy of individuals needs to be stronger.

B. Data protection in India

In India there are few data protection laws they are namely, The Digital Personal Data Protection Act, 2023, IT Act, 2000, IT rules and BNS. The provisions of the DPDP Act come into play when there is a breach of personal data such as facial images or voice recording without proper consent or outside their original purpose. Under this law, companies running AI tools or online platforms (data fiduciaries) must get informed consent, set up security controls, and provide redressal mechanisms for people to file complaints. The Act also penalizes the intermediaries if they do not provide adequate mechanism. Before the DPDP Act came along, India relied mainly on the Information Technology Act, 2000 (IT Act, 2000) to handle harm caused by deepfakes. The section 66C criminalizes the use of digital signatures, passwords, or any other distinctive identification element through fraudulent or dishonest purposes, and this can be used in a court of law to imply impersonation with fake faces and voices created by deepfake methods. Section 66D of the IT Act, 2000 also focuses on cheating impersonation with the use of computer facilities, which in fact extends to the cases of deepfakes deceiving or defrauding others. Part 67 and 67A of the IT Act, 2000 criminalize the receipt or dissemination of obscene or sexually explicit material, whereas Part 66E defends the breach of privacy by publishing pictures or sound recordings without consent, and this applies directly to non consensual sexual or exploitative deepfakes. Also, the IT Act 2000, Section 79 offers the safe harbor to intermediaries merely on the condition that they take due diligence and adhere to the take down orders, which indirectly holds the platforms responsible for hosting deep fakes. To add to these criminal clauses, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 which are updated in 2025 and 2026 add certain duties on AI generated and synthetic content. These regulations establish what else is defined as synthetically generated information and stipulates that providers of AI tools and online platforms must indicate clearly such information as deepfake or AI generated content, so that audiences can be made aware that this is not real. The updated IT Rules also put strict deadlines usually three hours of platforms to take down or block content when a valid complaint is received or a government request and establish a fast-track redressal process to deepfake victims. Data fiduciaries and AI tools vendors also have a further duty to implement technical security measures (including watermarking and consent screening) and continue to use their tools to perpetrate harmful deepfakes may be subject to regulation or sanction under the DPDP Act and the IT Act based framework. To seek redress, redress options are thus available to the victims in several numbered form approaches: by making complaints under the adjudicatory scheme as set by the Data Protection Board of India under the DPDP Act , by means of making criminal complaints as provided in Section 66C, 66D, 67, 67A, and 66E of the IT Act, 2000 , by the grievance officer schemes of intermediaries as stipulated by the IT Rules. The existing regulatory policy of deepfake videos in India can be characterized as a continuance of old and general purpose legislature, as opposed to a consistent, foresightful regime relevant to AI synthesized media. The main regulatory gap is that there is no specific law on deepfakes clearly defining what a deepfake is and the difference between harmful intent and harmless parody and binding liability among creators, providers of AI tools, and platforms. Rather, the authorities must fit deepfakes into the provisions of the Acts with no foresight to synthetic media, including Sections 66E, 67, 67A, 66C, and 66D of the Information Technology Act, 2000 and similar examples of the Bharatiya Nyaya Sanhita, 2023 (defamation, forgery, privacy related offences), which will create conceptual ambiguity, inconsistent enforcement, and inadequate deterrence.

The first prominent complaint about the current legislation is that it is not comprehensive enough, and it is too limited to deal with obscenity and impersonation, so the key groups of deepfake related harms are left mostly unregulated. Indicatively, Section 67 and 67A apply to the material that is obsolete or sexually explicit, meaning they can be used against the non consensual pornographic deepfakes, but they do not afford much protection against the deepfakes made to spread political misinformation, manipulate stock markets, propagate election related disinformation, or engage in non sexual harassment and reputational attack, which can be challenging to classify as either obsolete or sexually explicit. Likewise, the BNS based defamation and forgery statutes, do not acknowledge the paradigm shifting reality that now AI can be used to create plausibly real audio visual evidence that cannot be distinguished by an average viewer and therefore disrupts the very principle of evidentiary reliability in judicial proceedings.

Though an important move toward data protection, the Digital Personal Data Protection Act, 2023 (DPDP Act) is also strongly criticized as an act, which is principle based, vague, and has a weak enforcement profile, when it comes to deepfakes. The Act outlaws illegal processing of personal data, such as biometric data employed in facial and voice synthesis, but makes no specific reference to AI training datasets collected off the social media, deepfake generation pipelines, or using non consent of people appearing on the internet to generate detrimental content. The fines are on the high side in theory, but in practice, deepfake related information abuse will remain a byproduct of cases in data protection, and not a high priority offense of its own. And the IT rules also impose a duty on the intermediary and not upstream creators; these are the factors that creates the regulatory imbalance. There are notably several cases of Deepfake in India, and the redressal has been made by following the general provisions rather than the specific law that is required.

LEGAL SYSTEMS OF AI AND PRIVACY IN THE INTERNATIONAL LAW

A. Position in USA

Deepfake regulation in the United States is also becoming a multi level regime a combination of federal criminal law innovation and state level targeted statutes, which directly but potently mediate the effects of AI on personal privacy. The last but not the least federal law that explicitly relates to the privacy violations due to deepfakes is the TAKE IT DOWN Act¹¹ (Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks), which was introduced in 2025. This law criminalizes the intentional release or attempted release of non consensual intimate visual content or other forms of so called digital forgery (deepfakes) of identifiable adults by means of an interactive computer service, and knowledgeingly releases such content, damage is likely to result, and such content is not a current issue of societal interest. The Act refers to a digital forgery as images that are produced or edited with AI in a manner that makes them seem exactly like authentic footage to a judge of reason, thus creating a narrow, technology concerned category of non consent based deepfake porn. In tandem with this, the law makes a notice and take down a compulsory liability of online service providers: once a victim has issued a proper notice, the online service provider must take down the material within 48 hours and make reasonable efforts to prevent re uploads, which in practice is often achieved by technical means (such as using hash matching or watermark checking). Fines and up to two years imprisonment on publication of adult targeted deepfakes and up to 18 months imprisonment on only threatening to publish adult targeted deepfakes, create high deterrent effect against non consensual sharing, but provides victims with a clear and time limited redressal route against platforms that do not act.

In addition to this historic federal law, the U.S. still depends on a set of already existing federal laws, which are currently being applied to address AI powered privacy invasive behavior. Computer Fraud and Abuse Act¹² (18 U.S.C. § 1030) is applied in cases where deepfakes are used in an attack involving unauthorized access to computers or in a fraud, including the use of AI generated videos or voice calls to impersonate corporate executives and authorize fraudulent transfers, which makes the abuse of synthetic media a subdivision of more general cyber crime. In the same way, deepfake enabled frauds that occur via telecommunications networks, such as fake video or audio messages, in which victims are duped by the fraudster into sending money or sensitive information, are also covered under wire fraud statutes (18 U.S.C. § 1343), and should be viewed as deceptive conduct, not a technical misconduct. Another area of application of the Federal Trade Commission Act (15 U.S.C. § 45) to the situation of deepfakes is misleading consumers using such technology, such as AI generated celebrity endorsements or political ads, which are categorized as unfair or deceptive practices or acts in commerce. These rules do not explicitly refer to the term of deepfakes, although they are broadly written, which allows them to be interpreted by regulators and prosecutors to refer to AI controlled manipulations that undermine trust and privacy, particularly when applied to the election or consumer marketing context.

Alongside these federal resources, there exists a growing number of state level legislation which has segmented the terms of explicit, deepfake specific offenses, in two highly risky areas of privacy: election related deepfakes and non consensual deepfake pornography. In Texas, the 2019 bill SB 751 makes the creation or sharing of misleading video or audio, which seems to depict a candidate conducting themselves in a manner that they did not, criminalized, upon a purpose of injuring a candidate, or affecting an election. This law specifically addresses AI generated or manipulated media as a party to political advertisements, which further supports the notion that deepfakes do not only interfere with personal privacy, but also disrupt democratic procedures. The Penal Code § 632.01 of California establishes a separate offense in the production, sale, or ownership of sexually explicit deepfakes of real individuals without their consent, regardless of whether the victim incurred any financial damage or not, and thus separates the synthetic intrusion upon bodily privacy as a separate harm over and above the general doctrine of obscenity. The Elections Code § 20010 of the state also forbids the dissemination of deepfakes that artificially depict candidates in political advertisements within 60 days of an election, regardless of whether it is a domestic or foreign deepfake, an ambition of jurisdiction to preserve the informational privacy of the voters against foreign sourced manipulations. There are other such enactments, which criminalize the creation or distribution of deceptive audio visual content to cause harassment, fraud, or defamation, or sometimes both, and typically include a civil remedy such as an injunction, a takedown order, or damages, including usually a statutory damage multiplier.

Moreover, the federal government has made these substantive laws more supportive by enforcement oriented policies, including the DEEPFAKES Accountability Act and other government related executive level AI safety principles. The DEEPFAKES Accountability Act requires the software developer to make the AI generation tools technically enabling to generate audible or visual disclosure labels and watermarks in any output that has a high likelihood of being viewed as a deepfake and create transparency into design, not just penalize results. This strategy is an AI privacy related push: this approach makes users and investigators know the difference between authentic and fake faces, minimizing the chances of false identity and potentially damaging reputations. The federal government has provided guidance urging platforms and AI firms to implement detection tools, incident response strategies, and disclosure practices with high privacy risk applications, impartially relying on what they may otherwise have been a voluntary best practice, to become something of a quasi-regulation. These state and federal regulations create a developing regime, in which deepfakes are not a free speech challenge or a technical innovation challenge, but instead, a fundamental privacy integrity challenge, particularly where intimate photographs are at stake, election integrity, and identity fraud. To support your paper, you can place the U.S. system somewhere between an incoherent but very aggressive patchwork system of federal law (particularly, the TAKE IT DOWN Act) establishing a solid foundation of non consensual intimate deepfakes but leaving in the air the gaps around elections and harassment, where state law then builds out in dense, but patchy, mesh of privacy protections under the AI deepfake regime.

B. Position in Europe

In the European Union, the regulation of deepfake videos is not through the adoption of a single, dedicated, and deepfake specific law but through a stratified combination of the Artificial Intelligence Act, the Digital Services Act (DSA), and the General Data Protection Regulation (GDPR), which establish a rights focused and architecture, directly influencing the intersection of deepfakes generated by AI and the personal privacy. Readers of this paper will find the EU AI Act, which was approved in 2024 and comes into force in 2025, as the first piece of global AI governance legislation: it expressly applies to the AI generated or altered content, such as deepfakes. Article 3(60) of the AI act is a formal definition of synthetic content generated or modified by AI and systems based on the generation and manipulation of images, audio, or video are classified as separate AI applications, notably where they produce indistinguishable outputs. The next classification scheme imposed by the Act is the risk based classification: AI systems which produce deepfakes with the power to confuse viewers or lead them astray about the identity, behavior or beliefs of a person can be listed as high risk or even banned when it threatens democratic procedures, societal order, or basic rights, especially in the context of elections or heavy disinformation. This risk based strategy does compel developers and deployers of these systems to perform proper risk assessment, to use human in the loop controls, and to keep good records of the training of models, and such a design makes it more difficult to deploy privacy violating deepfakes anonymously or unmonitored.

The transparency requirement of Article 50 of the AI Act, under which providers of AI systems generating or otherwise producing synthetic material of a realistic quality are required to ensure that machine readable marking and detectability of AI generated or AI manipulated content is ensured, is one of the fundamental pillars in the deepfake regulation of the EU. Even when the material being created by deployers of such systems is legitimate and harmless, they must indicate that the content is artificially produced or altered, sometimes with on screen labels or metadata tags indicating as much. The need to have disclosed this is to ensure privacy to avoid having a viewer deceived on the actuality of the face, voice, or behavior of an individual, and it extends to a broad range of usages, including both social media content and political adverts and entertainment. The EU also defines that where the content is apparent to be artistic, creative, satirical or fictional (e.g. obviously stylish cartoons or where the parody is marked), the requirement is restricted to a non-intrusive minimal disclosure that is not harmful to the user experience. By integrating these standards of transparency into the design of AI system, the EU can push the load of privacy protection upstream, in which it is more difficult to covertly use AI to attack the image or reputation of a person without leaving a noticeable imprint on the record that the information is fake.

The Digital Services Act (DSA), which was amended in 2022 and now largely corresponds to the AI Act, serves as the platform focused component of the EU regulation of deepfakes in terms of privacy and content moderation. The DSA has systemic responsibilities on the large online platforms, officially known as Very Large Online Platforms (VLOPs), to identify, limit, and delete unlawful content that includes deepfakes that fall within the category of harassment, defamation, non consent intimate images, or election related disinformation. The DSA mandates such platforms to implement proactive content moderation systems and risk reduction measures to limit the proliferation of harmful synthetic media and to also collaborate with fact checkers, researchers, and authorities on the analysis of deepfakes and their effect on the discourse of the population. The DSA also incorporates a transparency obligation policy: the platforms should release periodic reports about the process of dealing with deepfakes and other manipulated content, and they have to explain why they prefer to down rank, label, or take down particular pieces. Not only does this level of accountability ensure the virality of privacy invasive deepfakes is limited but also leaves a paper trail, which can, in turn, be scrutinized by regulators and civil society watchdogs, which strengthens the human rights focused vision of AI driven privacy threats by the EU.

Together with technology and platform specific regulations, the General Data Protection Regulation (GDPR) offers a potent privacy related safeguard to deepfake regulation even though it is not presented as a deepfake law. According to the principles of GDPR, facial images, voiceprint, and biometric data to train or produce deepfakes are subject to sensitive personal information, and their processing without active and informed consent may provoke serious fines. Non consenting victims of deepfakes may rely on the right to erasure (the right to be forgotten) of GDPR to request the deletion or closure of access to AI generated content containing their lookalike by claiming that the content was processed illegally. According to GDPR based enforcement, national data protection authorities are also empowered to impose fines of up to 4% of the global annual turnover of a firm in the event of serious breaches of the regulation, which will provide companies with a significant financial motive not to engage in harvesting biometric data to be used in deepfake generation without the most stringent security measures. Practically, this implies that the EU deep fake regime would entail a combination of proactive requirements of technical transparency (AI Act), high profile platform moderation (DSA), and severe data privacy penalties (GDPR) to provide an overall multi layered protection to the privacy of individuals in the era of AI generated media.

C. Position in China

In China the deepfake is regulated by the provisions on the Administration of Deep Synthesis Internet Information Services (Deep Synthesis Provisions) they are main pillar and was adopted on 10 January 2023 and issued by the Cyberspace Administration of China (CAC) with the assistance of the Ministry of Industry and Information Technology, the Ministry of Public Security and others. These Provisions are broadly termed to be the first of its kind, an extensive nationwide deepfake specific regulation and it relates to any internet based information service based on the use of deep synthesis technology to produce and alter text, images, audio and video within the territory of China.

The Deep Synthesis Provisions ¹³have a number of purposes. To begin with, Article 1 indicates that the rules are developed based on the bigger statutes such as the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law (PIPL) and their stated purpose is to enhance the management of deep synthesis services, protect the national security, safeguard the public interest and legally protect the rights and interests of the citizens and organizations. Practically this translates to mean that the law does not solely view deepfake technology as an issue of privacy or individual rights but as a systemic threat to information order and state defined stability. The Provisions hence forbid the implementation of deep synthesis technology to disseminate fake data, destabilize social order, jeopardize national security, or cause economic damage, providing the authorities with excessive discretionary authority to decide what is considered as illegal or destructive material.

The second reason is to ensure that AI generated content is noticeable. The Provisions specify that anything produced or modified by deep synthesis be visibly marked as artificial either by text on the screen or aural cues that the material is produced by AI, and by technical means, such as watermarks in the metadata of the file. This is a privacy by design model that tries to safeguard the privacy of individuals by eliminating the likelihood of causing a person to be fooled into thinking that a fake photo, voice, or video is real, thus lowering the chances of reputational harm, harassment, or theft. The act clearly prohibits addressing such watermarks, which makes it possible to treat anybody, either a developer, platform, or a single person, as an individual violator to emphasize that the concept of authenticity of media products is a public interest sensitive attribute of the digital landscape.

Third, the Provisions put significant burdens on the service providers and the platform operators. Article 8 directs the services that perform deep synthesis to write and publish management rules and platform covenants, to enhance their service agreements, and to include mechanisms of user consent, identity authentication, as well as the processes of complaint handling. This implies that applications, social media, and AI tool services have to seek approvals of the users whose information goes towards training or executing deep synthesis models, confirming user identities (typically by real name registration), and establish internal mechanisms by which the victims can seek to erase privacy invasive deepfakes. The Provisions also authorize the cybersecurity and information departments and other competent authorities to carry out inspections and enforcement: when a deep synthesis service is identified as causing information security risks that are larger, regulators can require the provider to stop information updates, user registration or other services. This provides a powerful, government enforced motivation to develop platforms to actively screen, filter, and ban deepfake data, especially that which seems to pose a danger to political discourse or social peace.

Parallel to Deep Synthesis Provisions, there are other policies on AI generated content identification that were released on 1 September 2025 in China. The Measures of Identifying Artificial Intelligence Generated Synthetic Content, published by the CAC, the Ministry of Industry and Information Technology, and the Ministry of Public Security and the National Radio and Television Administration, create a unified, countrywide system of marking and tracking media produced by AI. The Measures demand that all AI generated work on the Internet, regardless of whether it is explicit or inexplicable, be explicitly labeled to identify it, and that there be a technical indication (e.g., watermarks or metadata tags) of synthetic content even in the cases where it is not explicitly illegal, so that detection tools can automatically mark synthetic work in all platforms. This is to fight fake news, Internet scams, and deepfake copyrighted content and enhance the authority of the state to establish the authenticity of information it presents to the populace.

To substantiate this framework, there are the Personal Information Protection Law (PIPL) and Data Security Law in China that are privacy protective backdrops. These laws consider facial images, voiceprints, and other biometric data sensitive personal information and stipulate informal and express consent to collect and process them, and propose powerful protection in case they are deployed in deep synthesis models. Deep synthesis providers should hence ensure that their systems are such that they are not collecting biometric data or likeness information unless one is duly authorized to do so and there are substantial fines and penalties of a type of suspension in case of such breaches. This is why the privacy affected by this regime is very unique. On the one hand, the compulsory labelling, watermarking, registering the real name, and monitoring functions of the platform make it a proactive and technically oriented barrier to most types of non consent misuse of deepfakes, particularly on the online frontier. The Provisions and PIPL style rules enable victims to request the takedown and accountability, and platforms have no choice but to invest in detection mechanisms instead of considering the deepfakes as a subsequent content moderation feature. Conversely the very extensive bans on both fake news and harmful information combined with the broad enforcement discretion of the state place the authorities in a strong position to suppress political dissent, reporting on political topics or satire on a topic indirectly through the deepfake regulation banner and turns the information ecosystem into a more opaque and state controlled environment.

REGULATORY ISSUES IN AI GOVERNANCE: A GLOBAL PERSPECTIVE

Controlling deep-fake content has serious legal issues that make the fight against the ill-intended applications of such technology challenging. The difficulties are based on the legal frameworks, constitutional rights, jurisdictions, and the swift change in technology that exceeds the legislative actions. The major problem is that the existing laws sometimes punish the behavior that is already forbidden by the available laws already, which narrows the possibilities of their effective implementation in combating the production and distribution of deepfakes. An example of the laws which address deepfakes, includes Texas SB-751 and California AB-730, which are at risk of constitutional review due to the fact that it could violate the right to free speech given by the First Amendment¹⁴. According to the author Nina I. Brown, the Supreme Court has protected false speech, making it difficult to control deepfakes only on the basis that they are false. In addition, the fact that the creation and distribution of deepfakes have been criminalized makes this problem more complicated due to jurisdictional concerns. Cybercriminals offer the capability of creating deepfakes in one country and serving them through servers in a different country and spreading them globally through social media. This cross-border quality renders it hard to enforce because of the laws where one jurisdiction cannot necessarily apply or be enforced in another state. The legal remedies legislation demands that a legal action be brought before a court, but this may be a tedious task to do because of the anonymity of those involved or even if it is through an intermediary.¹⁵

The other major problem is that there exists a possibility of law unintentionally limiting valid application of synthetic media. To illustrate, the legality of the terms and conditions such as the California AB-730 may make use of modified content illegal to reproduce the actual events or other artistic intent thus limiting free expression and forming an expression of art. Such ambiguity puts deepfakes in a gray area of the law, possibly prosecuted as criminals when they are used benignly or in ways that are beneficial to society and cause overreach and censorship issues.

Laws also do not keep up with advancement in technology. Development of deep fake creation tools is more cost-efficient and approachable and allows ordinary people and malicious individuals to create believable synthetic media within a short time. Since the velocity and the amplification capacities of deepfakes imply that legal measures tend to be slow compared to the dissemination of harmful materials. Legal measures could not be as effective on the situation unless the damaging content had gone viral by the time a legal suit was filed and closed. One of the other obstacles is that it has been difficult to establish what a deepfake is in law. As the term has not been demarcated in Indian law, say, the authorities would have to use the broad definition of the term or the technical definition which might not be enough to prosecute. In the absence of legal definitions, the enforcement agencies might have problems in detecting infractions resulting in unequal interpretation of laws. The thin line between safeguarding illicit deepfakes and addressing the rights to free speech. It implies that certain jurisdictions find it difficult to separate the deepfakes whose purpose is harmful behavior and those that are made as entertainment or art. Such differentiations are however tough to put in place and are subjective and thus may cause legal ambiguity and misuse of laws to silence legal speech.

The next complexity also stems around privacy and consent. In non-consensual pornography and impersonation, deepfakes might infringe upon the right to get privacy, as well as cause psychological damage. The fact that some laws are created to fight any violations of privacy, e.g. a set of laws against harassment or defamation, might not be effective or applicable to the cases of deepfakes, particularly when those communications are shared anonymously or internationally. Further, there is the possibility of the risk of deepfakes to be employed as a source of extortion/blackmail, which creates further legal issues. Since the law against such behavior usually entails the demonstration of the intent and harm which can be quite hard to prove in the digital domain. The difficulty is to demonstrate ill intent and association of the information to the offender, particularly in cases where electronic footprints are deliberately covered. International collaboration is crucial, however, quite hard to attain since countries have differing legal requirements and priorities. Whereas some countries are thinking or even implementing acts, others do not have detailed laws that cover deepfakes. As technological solutions, including digital forensics and AI-based detection tools, are perceived to be complementary to the use of law but remain foolproof. The more the deepfakes become undetectable, and it might be necessary to rely not only on legal solutions. The fast development of deep-fake technology requires dynamic legal regulations that can address emerging threats without violating the most basic rights.

European Union (EU) has undertaken a serious initiative in finding a solution to the issues, creating the AI Act according to which AI systems will be classified according to what risks they imply and the corresponding regulatory measures will be taken. However, AI Act is restricted as it is integrated with poor penalties in the event of noncompliance, as well as, possibilities of regulatory gaps, especially the fast development of AI resources. The classification method and risk assessment applied in the Act may not be good enough to cope with such emerging threats as deepfakes which can be easily implemented and modified to avoid detection. ¹⁶ The other problem is that it is not convenient to monitor and provide compliance at different platforms and actors. Law enforcement agencies (LEAs) require additional resources, specific training, and technology to be effective in cases with deepfakes. Diffusion of AI produced content is beyond the giant platforms, and it is hard to execute the detection and attribution work, necessitating creation of new technical protective tools, such as watermarking and surveillance software.

ACCOUNTABILITY AND TRANSPARENCY PROBLEMS

The key elements of good AI governance include accountability and transparency since there are numerous possible harms linked to deepfakes and AI based disinformation. The lack of transparency of most AI systems, sometimes termed as black boxes, affects the capacity to comprehend the decision-making processes, as well as the accountability of harmful outputs. Transparency requirements have become increasingly acknowledged as a key to the creation of trust and facilitation of supervision. The AI Act of the EU requires creators of AI generated content to reveal AI usage, especially with the deepfakes, under certain transparency provisions. This is necessary to make the users aware of the source of the content and to avoid misleading them. In the same vein, the European Commission also stresses the importance of platforms to label AI generated material clearly and enhance detection. Nonetheless, self regulation practices have not been effective because visibility and engagement metrics are usually valued more than transparency resulting in conflict of interest. As an example, Meta whistleblowers have pointed out the fact that algorithms develop mechanisms to increase the visibility of content, which can accidentally amplify disinformation and deepfakes. Such conflict of commercial interests and transparency highlights the necessity of enforcing laws and regulation by independent entities.

AI developers and deployers are also accountable. The manufacturers of general purpose AI systems now must provide training data, as well as make sure that they comply with the copyright laws, yet the responsibility of abuse has become an issue . In a case of malicious use of deepfakes, it is difficult to specify the party to be liable, whether it is the developers, the platform providers or the end users. Technical solutions like watermarking and monitoring software are being created to improve transparency in the generated AI content and traceability . Such tools may be beneficial to detect manipulated media and prosecute actors. However, malicious agents keep evolving, which produces advanced deepfakes that cannot be noticed and thus complicates the entire accountability process. Moreover, AI innovation is associated with the lack of transparency due to the speed of technology development efforts, in which regulatory bodies are unable to keep pace with new methods. The policymakers, researchers, and civil societies need to be in partnership on the standard of transparency such as labeling, auditability, and explainability of AI systems. To have good governance, transparency is legally binding, safeguarded by technology, and the liability schemes are well defined to guarantee good AI implementation.

REQUIREMENT OF MORE INTENSE DATA PROTECTION

This form of AI governance is inherently based on data protection, given that AI systems, such as deepfake generators, are highly dependent on large volumes of data to be trained. Risks, including privacy breach, bias, and malicious content creation, can be aggravated by the misuse or mishandling of the data. The AI Act of the EU is concerned with responsible management of the data, such that producers of the general purpose AI systems should be able to guarantee the quality and legality of the training data. These involve adherence to copyright regulations and protection of personal information, which is essential since the deepfakes could pose a threat to personal privacy of individuals.

Greater data protection should be implemented so that personal information should not be abused in the production of deepfakes. An example is identity theft, defamation or political manipulation which may occur due to the use of images or voices without permission. These risks could be overcome through the implementation of stringent consent procedures, anonymization of data and the safeguarding of data storage. Additionally, the spread of deepfake information on rogue websites, messaging applications and dark net markets makes it difficult to regulate data. Such platforms are not always regulated by law, and this makes it hard for them to control. Data sharing agreements that are cross border and international cooperation are necessary to monitor and prevent malicious data use. Watermarking and digital signatures are some of the technical solutions that may be used to ensure the authenticity of content and data integrity . Also, it is possible to minimize vulnerabilities with the help of developing AI models that would be less dependent on sensitive personal data or use privacy saving methods (e.g., federated learning). Data protection is not only necessary in relation to privacy but also to the strength and justice of AI systems. The biases in the training data may promote discriminatory deepfakes or support the negative stereotypes. It is crucial to make sure that AI development is responsible through the sourcing of diverse, representative, and ethically sound datasets.

AI REGULATION POLICY RECOMMENDATIONS

AI should be regulated to reduce complexity; the AI has the capacity to make work easier and provide desirable work at a quick time; the AI is used in all fields and in all domains. It enhances the quality of work and requires less energy. Nowadays AI deepfake is used very commonly and publicly. Nowadays the news channels use Deepfake videos to explain to the viewers in an easy manner, but still, they do follow the laws and add water marks denoting AI content. It is easy to generate, and the consequence of the AI being used by a wrong person should be foreseen before it’s too late. The victims of deepfake are forced to face many discriminations and mental agony. Though AI is an emerging technology and there are only few cases reported related to the breach of privacy, it becomes the duty of the policy makers to make laws to ensure the Right to Privacy as given to the citizens by the Constitution of India, the policy makers should create new laws that are dedicated to the Deepfake technology and should make redressal mechanism a smoother and easier one rather that creating complexity and lengthy process. While comparing other countries which have dedicated policies and laws related to Deepfake technologies some recommendations can be given to bring a robust law to regulate the crimes by Deepfake

A. Enact a Special Law

The Government of India can enact an Deepfake Special Law to promote Deepfake accountability and protect the privacy ,which expressly defines the concept of deepfake and establishes offences designed specifically to apply to AI generated synthetic media, and not simply extend the general offences against IT Act type offenses to apply to AI generated content. This law should be enacted and should provide a definition of “deepfake,” it should contain keywords like the different forms of deepfake and the definition of the offender. The law should deal the non consent production, sharing, or threatening to share intimate deep fake images or videos of real individuals, with an intention or impact of causing humiliation, blackmail, reputation damage, or sexual exploitation, as a criminal offense, it should be based on the U.S TAKE IT DOWN Act and uniform law should be created to deal with these AI works but adjusted to the current laws like burden of proof and standard practice. As there can be misuse of the Act and innocent people will be punished unnecessarily.

The Act should also recognize offence of relevant to election and criminalize the creation or sharing of AI manipulated audio visual content falsely representing a candidate, office holder or other public figure before a 60 to 90 day election period, with the levels of the penalties and mechanisms, similar to the U.S. state based election deepfake laws, and with it, there will be no undue influence on the people who are voting and the integrity of the democratic process will improve.

The act must bring Civil and Criminal remedy:

Under the Criminal punishment, an imprisonment of 3 to 5 years and fine concerning creation or distribution of non consenting or election related deepfakes and the fine and punishment should be given by considering the involvement of minors, public figure or mass distribution.

Under Civil liability the right to injunctions, takedown orders and monetary damages (including economic loss, reputational damage, and emotional distress), there should be special adjudicating to remove the deepfake video within very less time and the victims should be given justice without a high litigation cost.

B. Amendment in the Information Technology Act, 2000

The existing IT Act should be amended to deal with Deepfake and AI like the purpose of codification as a Digital India Act. Although the Digital India Act (DIA) is still being debated, the government of India ought to revise the Information Technology Act, 2000 to incorporate AI related laws and create laws that shows how deepfakes can be integrated into the current cybercrime systems.

The amendments that can be Proposed are:

Addition of a new chapter that encompasses the includes the scope of the Act to synthetic AI generated content and deepfakes (Chapter XV B) with provisions related to the creation, spread, as well as monetary exploitation.

Addition of levels of liability in Act and rules:

•  Social responsibility of creators and AI tool developers who create, train or deploy models to generate deepfakes in a knowingly non consent checked and non protective way.

•  Secondary liability of platforms which cannot see or remove apparent deepfakes despite having reasonable technical capacity to do so, based loosely on the EU DSA style platform duty regime but expressed in the institutional capacity of India.

•  Safe harbor safe diligence under Section 79, upon using AI based detection tools, AI grievance redressal procedures, and proving to have implemented takedown timelines.

Enhance and bring interpreting clarity to the current provisions such as 66C (identity theft), 66D (impersonation or cheating by personation), 66E (non consensual intimate images style privacy violations), and Sections 67 and 67A (obscene or illegal content) by notices, guidance documents and model circulars of MeitY and the Data Protection Board, to show how they may be used in relation to deepfake related identity theft, impersonation, privacy invasive intimate images.

C. Leveraging and Operationalizing the Digital Personal Data Protection Act, 2023

The DPDP Act, and Rules, offer an effective privacy backstop which may be narrowed down to deepfakes induced by AI by recommending measures to provide unambiguous, binding direction by the Data Protection Board of India to the effect that the use of facial images, voiceprints, body features and likeness information to train, generate or manipulate deepfakes, is sensitive personal data by the DPDP Act, and each use of such data must be express, informed and authorised (e.g. training, inference, public disclosure or commercial use) also have the requirements by AI tool providers and AI platforms such as permission to biometric data collection (e.g., scraping facial images of the public web), permission of utilizing that data to train AI pipes or to create deepfakes and approval given to share or commercially profit on AI generated deepfakes of recognizable individuals.

Authorize the Data Protection Board to give sector specific codes of practice in AI and deepfake related data processing, together with mandatory privacy impact assessment, anonymous or synthetic data substitution requirement, and regular audit of AI tool providers and major platforms which process biometric data. Ban permission managers, data portability tools like or opt out from AI training switches allowing users to prohibit or simply avoid the use of their biometric data in AI training or deepfake generation.

D. Label Content

Make artificial intelligence generated content compulsory, technologically transparent, and labelled. To be closer to the EU like transparency by design philosophy and a Chinese like watermark protection, revise the IT (Intermediary Guidelines and Digital Media Ethics Code), to require visible and non-deceptive labelling of AI generated or deepfake content, such as having an always present visible text overlay or audio (i.e. overlaying saying AI generated” or AI altered at the beginning of the video or audio). Provide that the outputs of AI generators be required to contain technical watermarks or metadata tags so that platforms and forensic tools can automatically identify and label synthetic media, even when humans look at the output; legally, this type of action is prohibited and should be regarded as an administrative and could carry criminal descart, a separate violation of the law, as opposed to an administrative and potentially criminal violation. Provide AI tools sold or used in India, introduce new so called deepfakes design standards, which require the developers to disable of deepface generation features by default to certain users. Add inbuilt watermark and disclosure generation features to every image and video model based on AI. Before high-risk operations are permitted, provide user education pop ups to consumers regarding the dangers of creating non consensual or misleading deepfakes and enhance platform duty, detection, and takedown.

E. Create Risk Management Mechanism

Existence of high risk platforms (functionally equivalent to VLOPs) within the IT Rules: platforms containing more than a threshold number of Indian users, deepfake related traffic or AI tool integration must implement AI based detection tools and quick takedown mechanisms. Expand and enforce the 3-hour takedown timeline of clearly illegal deepfakes and 48 hour timelines on non consenting intimate deepfakes and 6 hour timelines on imminent risk cases (e.g. election related disinformation approaching polling day). Non compliance must result in the threat to lose safe harbour protection and penalty based on platform revenue share based on India.

Require high risk platforms to disclose, in form of transparency reports, details on:

•  The number of complaints they received in a quarter related to deepfaking.

•  The number of items that they cleared and the duration of each decision.

•  How numerous were challenged in the law courts or voluntary body

F. Establish Forensic Capability and Specialized Enforcement Organizations

Since India has asymmetry in technology between the producers of cheap deepfakes and the ineffective detecting capacity, the following institutional upgrades need to be made:

•  Create specialized cyber forensics units or AI forensics task forces inside the Central Forensic Science Laboratories (CFSL), state cyber crime cells, and cross deck collaboration structures, provided with AI detection software, training in digital authentication techniques, and cross decade collaboration structures.

•  Develop deepfake investigation and prosecution protocols codified in specialised model guidelines developed by the Ministry of Home Affairs, the Ministry of Law and Justice and the National Legal Services Authority (NALSA), which assists prosecutors and judges in distinguishing between malicious deepfakes, lawful parody and fake news because it happens to be AI generated.

•  Promote mechanisms that are friendly to public interest litigation, and enable privacy focused NGOs, advocacy groups, or even the use of class action like and representative plaintiffs to initiate the type of systemic challenges inherent in challenging negligent AI tool providers or platforms, and provide cost recovery and legal aid support to help reduce obstacles to justice.

G. Implement the Measures of Awareness, Education, and Redressal¹⁷

In addition to stringent legal and technical standards,government needs to lay down forces against deepfake targeted privacy harms on the societal level:

•  Conduct nationwide public awareness campaigns through MeitY, the Ministry of Information and Broadcasting, the Ministry of Education, and the National Digital Literacy Mission to show what to look at in order to identify deepfakes (e.g., unnatural lip sync, unnatural lighting, unnatural audio artifacts), how to report in platforms, police cyber cells, and Data Protection Board and what are the legal solutions in respect of IT Act, DPDP Act and BNS.

•  Create streamlined online complaint and takedown portals, WhatsApp based or SMS based first response gateways, and state level cyber crime desk integration systems such that users will be able to make complaints related to deepfakes without going through multiple, overlapping agencies.

•  Introduce self regulatory codes to AI tool developers with incentives e.g. data localisation benefits, preferential treatment in government procurement, or privacy by design certification programmes, so that those companies who voluntarily incorporate privacy protective default settings are rewarded with reputational and operational benefits.

CONCLUSION

This study demonstrates that the issue of deep fake technologies is severe and multifaceted in terms of legal, societal, political, and security spheres. With the ongoing development of artificial intelligence, deepfakes are made more sophisticated, available, and hard to detect. This has been a fast development that has made them more effective in manipulating perceptions, misinformation, and eroding trust in online content. Therefore, the deepfakes has ceased to be a technological indulgence but an effective weapon that can disrupt institutions and shape the public discourse.

Deepfakes can increase misinformation, fake news, and political manipulation with the popularization of the internet and relatively low media literacy. The examples of AI generated videos in political campaigns reveal how these technologies are currently being used to manipulate the electoral results. in addition to that the growth of non consensual deepfake pornography poses serious concerns on privacy, dignity, and cyber harassment. these are more likely to affect vulnerable populations and women. Such developments raises the imminent need to reform the laws and create public awareness programs that are sensitive to the Indian situation. In technology, the development of superior systems like Generative Adversarial Networks have greatly reduced the barrier towards the production of quality deepfakes. What used to take considerable skills, and effort can now be done with easy to use apps so that amateurs can be made to create convincing synthetic media¹⁸. This democratization of establishing deepfakes increases the threat of massive disinformation campaigns, especially in sensitive times like elections or natural disasters. Simultaneously, the regulatory and investigation agencies have serious difficulties, such as the absence of technical skills and the inability of the current frameworks to follow fast technological progress.

Along with deception, there are also far reaching psychological and epistemic consequences of deepfakes. They destroy the trust in visual and sound evidence, as it has long been trustworthy. Deepfakes can even serve to strengthen negative stereotypes, prejudices, and social polarities, even when detected as fake. This underscores the fact that their effects go beyond the short term misleading effects to the long term effects on society, such as undermining social trust in information systems. Security wise, not being able to distinguish between real and manipulated contents, presents great weaknesses to a person. The literature that human beings are only slightly more effective at identifying deepfakes than chance highlights the urgency of creating technological solutions to counter deepfakes like AI detection technology and digital forensics. Besides, the possibility of the deepfakes being abused by organized crime groups and state actors to propagate, interfere in elections, and destabilize also increases the risk to the national and global security, as the research results show that currently, the regulatory and societal measures are insufficient to respond to the ever changing landscape of deepfakes. It is therefore important that a multi-layered approach is in place. This should involve good legal systems, technological advancement in detection and prevention, institutional capacity, and mass awareness. Of equal value is international collaboration as digital content is borderless. It is by means of such concerted actions that only societies can effectively counter the threats that deepfakes represent and protect the truth, privacy, and democratic integrity in the digital era.

*****

Footnotes

1. A biographical memoir by Nils J. Nilsson ©2012 National Academy of Sciences. Available at: https://www.nasonline.org/wp-content/uploads/2024/06/mccarthy-john.pdf.

2. The importance of artificial intelligence in the 21st Century. Available at: https://easychair.org/publications/preprint/8QhQ

3. Mahashreshty Vishweshwar, Shalini, “Implications of Deepfake Technology on Individual Privacy and Security” (2023). Culminating Projects in Information Assurance. 142. https://repository.stcloudstate.edu/msia_etds/142

4. Influencer Payal gaming not in viral video, Maharashtra Police launch probe (2025) Hindustan Times. Available at: https://www.hindustantimes.com/india-news/influencer-payal-gaming-not-in-viral-video-maharashtra-police-launch-probe-payal-dhare-101766175914916.html

5. Vig, Shinu. “Regulating Deepfakes: An Indian Perspective.” Journal of Strategic Security 17, no. 3 (2024): 70–93. https://www.jstor.org/stable/48793910.

6. SALVI, ANDREA, Rumena Filipova, Bart Hogeveen, Ivana Karásková, Patryk Pawlak, and Andrea Salvi. “THE ATTACK OF THE CLONES: Deepfakes and the Evolving Landscape of Disinformation.” In HACKING MINDS AND MACHINES: Foreign Interference in the Digital Era, edited by Nad’a Kovalčíková. European Union Institute for Security Studies (EUISS), 2024. http://www.jstor.org/stable/resrep62147.7.

7. Koenig, Alexa. “‘HALF THE TRUTH IS OFTEN A GREAT LIE’: DEEP FAKES, OPEN SOURCE INFORMATION, AND INTERNATIONAL CRIMINAL LAW.” AJIL Unbound 113 (2019): 250–55. https://www.jstor.org/stable/27003917.

8. Vig, Shinu. “Regulating Deepfakes: An Indian Perspective.” Journal of Strategic Security 17, no. 3 (2024): 70–93. https://www.jstor.org/stable/48793910.

9. K.S. Puttaswamy (Privacy-9J.) v. Union of India, (2017) 10 SCC 1

10. Sasikala Pushpa v. Facebook India, 2020 SCC OnLine Del 618

11. The take it down act: A federal law prohibiting the nonconsensual publication of intimate images | congress.gov | library of Congress. Available at: https://www.congress.gov/crs-product/LSB11314 .

12. Interpreting the Computer Fraud and abuse act. Available at: https://www.researchgate.net/publicati on/305850068_Interpreting_the_Computer_Fraud_and_Abuse_Act.

13. Sheehan, Matt. “China’s AI Regulations and How They Get Made.” Horizons: Journal of International Relations and Sustainable Development, no. 24 (2023): 108–25. https://www.jstor.org/stable/48761167.

14. First Amendment | Constitution | congress.gov | library of Congress. Available at: https://constitution.congress.gov/browse/amendment-1/

15. Vig, Shinu. “Regulating Deepfakes: An Indian Perspective.” Journal of Strategic Security, vol. 17, no. 3, 2024, pp. 70–93. JSTOR, https://www.jstor.org/stable/48793910.

16. SALVI, ANDREA, Rumena Filipova, Bart Hogeveen, Ivana Karásková, Patryk Pawlak, and Andrea Salvi. “THE ATTACK OF THE CLONES: Deepfakes and the Evolving Landscape of Disinformation.” In HACKING MINDS AND MACHINES: Foreign Interference in the Digital Era, edited by Nad’a Kovalčíková. European Union Institute for Security Studies (EUISS), 2024. http://www.jstor.org/stable/resrep62147.7.

17. Mahashreshty Vishweshwar, Shalini, “Implications of Deepfake Technology on Individual Privacy and Security” (2023). Culminating Projects in Information Assurance. 142. https://repository.stcloudstate.edu/ms ia_etds/142

18. Cooke, D., Edwards, A., Day, A., Nair, D., Barkoff, S., & Kelly, K. (2024). Crossing the Deepfake Rubicon: The Maturing Synthetic Media Threat Landscape. Center for Strategic and International Studies (CSIS). http://www.jstor.org/stable/resrep64562