Legal Challenges of Deepfakes in India: Copyright, Defamation, and Privacy

I. Introduction

The rapid advancement of artificial intelligence has enabled the creation of hyper-realistic synthetic media — commonly referred to as “deepfakes” — in which a person’s likeness, voice, or expression is digitally fabricated or manipulated without their knowledge or consent.¹ The term itself is a portmanteau of “deep learning” and “fake,” capturing the machine-learning techniques that underpin this technology.² India confronted the gravity of this phenomenon in late 2023, when manipulated videos of prominent actresses including Rashmika Mandanna circulated widely, prompting an advisory from the Ministry of Electronics and Information Technology and renewed calls for legislative intervention.³

Despite this public outcry, India’s existing legal framework — spanning the Information Technology Act 2000 (“IT Act”), the Copyright Act 1957, and the law of defamation under the Indian Penal Code 1860 (“IPC”) — was not designed to address synthetic media. This article argues that the current legislative architecture is inadequate to govern deepfakes and that targeted statutory reform is urgently required. The article proceeds in three parts: it examines, in turn, the copyright, defamation, and privacy dimensions of deepfake harm, before offering a concluding recommendation.

II. Copyright and the Unlicensed Use of Identity

The most immediate copyright concern raised by deepfakes is the unauthorised reproduction of protected expression. Under the Copyright Act 1957, copyright subsists in original literary, dramatic, musical, and artistic works, as well as in cinematographic films and sound recordings.⁴ Where a deepfake incorporates segments of an existing film, a recorded performance, or any other copyrighted audiovisual material as source data, its creation and distribution may infringe the reproduction right of the original copyright holder without attracting the fair dealing exception under section 52(1)(a).⁵

More nuanced, however, is the question of moral rights. Section 57 of the Copyright Act confers upon authors the right to claim authorship of a work and to restrain distortion, mutilation, or modification of the work that is prejudicial to their honour or reputation — rights that subsist even after the economic rights have been assigned.⁶ In Amar Nath Sehgal v Union of India, the Delhi High Court recognised that moral rights are inalienable and continue to vest in the creator regardless of economic transfer.⁷ A deepfake that grafts a performer’s likeness onto objectionable content constitutes precisely the kind of mutilation that section 57 was designed to prevent. Yet the section is directed at authors in their capacity as creators of works — it does not extend to protect a performer’s personality or likeness as a distinct legal interest separate from authorship.

Crucially, Indian copyright law does not recognise a freestanding “right of publicity” or “personality right” of the kind that would protect a celebrity’s name, image, or voice from commercial exploitation through deepfakes. The Supreme Court’s requirement of minimal creativity for copyright subsistence, articulated in Eastern Book Company v DB Modak, means that a deepfake of a person is unlikely to be treated as a derivative work of any underlying copyrighted material unless identifiable protected expression is reproduced.⁸ This gap leaves performers, public figures, and private individuals without a copyright remedy where the deepfake is generated entirely by artificial intelligence from open-source footage. Legislative recognition of a statutory personality right, modelled on developments in several American states, would address this lacuna.

III. Defamation and the Standard of Falsity

Defamation under Indian law is governed concurrently by section 499 of the IPC, which criminalises the publication of a false statement that harms the reputation of an identifiable person, and by the civil law of tort.⁹ A deepfake that depicts an individual committing a crime, making false statements, or engaging in sexual conduct satisfies the threshold requirement of a false statement of fact. The Supreme Court in Subramanian Swamy v Union of India upheld the constitutionality of criminal defamation, affirming that the protection of reputation is a legitimate state objective.¹⁰

However, several structural features of the defamation framework limit its utility in the deepfake context. First, the requirement of publication “concerning” the plaintiff demands that a reasonable viewer identify the subject. While this presents no difficulty where the face of a recognisable public figure is superimposed, it may prove problematic where the synthetic media involves a private individual whose likeness is less universally known. Second, the defences available under IPC section 499 — particularly the defences of truth and fair comment — were formulated before synthetic media existed and do not squarely address the scenario where the impugned statement is not merely false but technically fabricated. Third, and most significantly, the requirement under Shreya Singhal v Union of India that restrictions on speech meet the proportionality standard under Article 19(2) of the Constitution of India means that any deepfake-specific criminal provision must be carefully drawn to avoid over-criminalising satire, parody, or artistic commentary.¹¹

Turning to the civil dimension, the remedy in tort remains theoretically available but is practically hampered by the difficulty of attributing an anonymous deepfake to a specific defendant, the high cost of litigation relative to the harm suffered by non-celebrity victims, and the absence of statutory intermediary liability for platforms that host deepfake content. The IT Act’s existing framework under the 2021 Intermediary Guidelines requires platforms to take down content flagged as violating user dignity,¹² but does not impose proactive obligations to detect or remove deepfakes before harm is done. A dedicated takedown regime with mandatory response timelines would considerably strengthen the position of defamation victims.

IV. Privacy and the Limits of Existing Protection

The right to privacy, recognised as a fundamental right under Article 21 of the Constitution of India by the nine-judge bench in Justice K.S. Puttaswamy (Retd) v Union of India, encompasses informational privacy and the right to control the use of one’s image and identity.¹³ Deepfakes represent a paradigmatic violation of this informational autonomy: they deploy a person’s biometric identity — their face and voice — without consent, frequently in contexts designed to cause humiliation or reputational harm.

The Digital Personal Data Protection Act 2023 (“DPDPA”) constitutes the most recent legislative attempt to operationalise the Puttaswamy framework. The Act requires that personal data be processed only for a specified, lawful purpose with the free and informed consent of the data principal.¹⁴ Where a deepfake is created by processing images or recordings of an identifiable individual — drawn from social media or public footage — such processing plainly engages the consent requirement of the DPDPA. The Act further mandates that data fiduciaries implement reasonable security safeguards to protect personal data.¹⁵ [Author’s note: Please verify whether the intended reference here is DPDPA s 8 (Obligations of Data Fiduciaries / security safeguards) rather than s 6 (Consent), as cited in fn 15.] Platforms that host user-generated deepfake content without verification mechanisms would appear to fall short of this standard.

Nevertheless, the DPDPA is not specifically calibrated to address deepfakes and contains at least two critical gaps. First, section 16 of the Act carves out an exemption for personal data processed for journalistic, research, or artistic purposes,¹⁶ an exemption broad enough to be invoked by bad-faith actors who characterise their synthetic media as artistic expression. Second, the Act does not create a private right of action: enforcement lies exclusively with the Data Protection Board, whose remedial powers and operational timeline remain untested. The IT Act’s section 66E, which penalises the capture and publication of private images without consent,¹⁷ provides narrow supplementary protection but was drafted to address covert photography rather than AI-generated fabrication.

Sections 67 and 67A of the IT Act criminalise the publication of obscene and sexually explicit material in electronic form¹⁸ and have been applied to non-consensual deepfake pornography. However, these provisions do not address the full spectrum of deepfake harm — political manipulation, financial fraud, and identity theft — that falls outside the obscenity paradigm. A holistic privacy remedy for deepfake victims requires an explicit statutory right to erasure of synthetic media, enforceable against both the creator and the platform, with civil damages available to the affected individual.

V. Conclusion

This article has argued that India’s existing legal framework — comprising copyright law, defamation law, and data protection legislation — is structurally ill-equipped to address the distinct harms inflicted by deepfake technology. The Copyright Act 1957 does not protect personality rights; the law of defamation is hampered by attribution difficulties and proportionality constraints; and the DPDPA, while promising, contains exemptions and enforcement gaps that limit its practical utility. Comparative jurisdictions have begun to respond: the proposed Deepfakes Accountability Act in the United States,¹⁹ and the criminalisation of intimate deepfakes under the Online Safety Act 2023 in the United Kingdom,²⁰ offer instructive models.

It is submitted that Parliament should enact a standalone Deepfakes Regulation Act that: (i) confers a statutory personality right enforceable by any individual whose likeness is synthetically reproduced without consent; (ii) establishes mandatory disclosure requirements compelling creators and distributors to label synthetic media; (iii) imposes proactive removal obligations on intermediaries with defined response timelines; and (iv) creates a civil right of action for affected individuals, distinct from the DPDPA’s board-mediated enforcement model. The Law Commission of India has indicated its intention to examine this area,²¹ and the present moment — while public attention is focused — offers the most propitious opportunity for durable legislative action. Technological harms of this nature do not wait for the law to catch up; the law must, this time, move first.

Bibliography

Primary Sources

Legislation

• Constitution of India 1950
• Copyright Act 1957 (India)
• Indian Penal Code 1860 (India)
• Information Technology Act 2000 (India)
• Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India)
• Digital Personal Data Protection Act 2023 (India)
• Deepfakes Accountability Act, HR 4355, 116th Cong (US 2019)
• Online Safety Act 2023 (UK)

Cases

• Amar Nath Sehgal v Union of India AIR 2005 Del 2005 (India)
• Eastern Book Company v DB Modak (2008) 1 SCC 1 (India)
• Justice K.S. Puttaswamy (Retd) v Union of India (2017) 10 SCC 1 (India)
• Shreya Singhal v Union of India (2015) 5 SCC 1 (India)
• Subramanian Swamy v Union of India (2016) 7 SCC 221 (India)

Secondary Sources

Books

• Nina Schick, Deep Fakes and the Infocalypse: What You Urgently Need to Know (Monoray 2020)

Journal Articles

• Hany Farid, “Creating, Using, Misusing, and Detecting Deep Fakes” (2022) 19 Journal of Online Trust and Safety 1

Government Documents

• Ministry of Electronics and Information Technology, Advisory on Deepfakes (Government of India, 26 November 2023)
• Law Commission of India, Consultation Paper on Regulation of Deepfakes (2024) (forthcoming) [Author’s note: Please verify whether this paper has since been formally published and update the citation accordingly.]

Newspaper Articles

• Press Trust of India, “Deepfake Videos of Rashmika Mandanna, Katrina Kaif Go Viral; Govt Issues Advisory” The Hindu (New Delhi, 7 November 2023)

Footnote(S):

¹ Hany Farid, “Creating, Using, Misusing, and Detecting Deep Fakes” (2022) 19 Journal of Online Trust and Safety 1, 1.

² Nina Schick, Deep Fakes and the Infocalypse: What You Urgently Need to Know (Monoray 2020) 18.

³ Press Trust of India, “Deepfake Videos of Rashmika Mandanna, Katrina Kaif Go Viral; Govt Issues Advisory” The Hindu (New Delhi, 7 November 2023).

⁴ Copyright Act 1957 (India), s 13.

⁵ Copyright Act 1957 (India), s 52(1)(a).

⁶ Copyright Act 1957 (India), s 57.

⁷ Amar Nath Sehgal v Union of India AIR 2005 Del 2005 (India).

⁸ Eastern Book Company v DB Modak (2008) 1 SCC 1 (India).

⁹ Indian Penal Code 1860 (India), s 499.

¹⁰ Subramanian Swamy v Union of India (2016) 7 SCC 221 (India).

¹¹ Shreya Singhal v Union of India (2015) 5 SCC 1 (India).

¹² Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India), r 3(1)(b).

¹³ Constitution of India 1950, art 21; Justice K.S. Puttaswamy (Retd) v Union of India (2017) 10 SCC 1 (India).

¹⁴ Digital Personal Data Protection Act 2023 (India), s 4.

¹⁵ ibid s 6. [ Citation query — see Author’s note in body text above.]

¹⁶ Digital Personal Data Protection Act 2023 (India), s 16.

¹⁷ Information Technology Act 2000 (India), s 66E.

¹⁸ Information Technology Act 2000 (India), ss 67, 67A.

¹⁹ Deepfakes Accountability Act, HR 4355, 116th Cong (US 2019).

²⁰ Online Safety Act 2023 (UK), ss 66–67.

²¹ Law Commission of India, Consultation Paper on Regulation of Deepfakes (2024) (forthcoming). [ Currency query — see Author’s note in Bibliography above.]