Authored By: Deshna Mehta
Shankarrao Chavan Law College
Abstract
Artificial Intelligence has transformed digital communication by enabling the creation of highly realistic synthetic media, commonly known as deepfakes. While the technology offers significant benefits in education, entertainment, and innovation, its misuse has generated unprecedented legal concerns involving identity theft, financial fraud, political misinformation, cyber harassment, and non-consensual intimate imagery. India has witnessed a rapid increase in incidents involving AI-generated manipulated content, yet its legal framework continues to rely on statutes enacted before the emergence of generative artificial intelligence. This article critically examines whether the Bharatiya Nyaya Sanhita, 2023, the Information Technology Act, 2000, and related constitutional and data protection principles adequately address offences arising from deepfake technology. It argues that the present framework primarily penalises the consequences of deepfake misuse rather than regulating the technology itself or imposing clear responsibilities on developers and digital intermediaries. By analysing the existing statutory regime, judicial developments, and comparative approaches adopted by the European Union, the United Kingdom, and the United States, this article identifies significant legislative gaps and proposes a comprehensive regulatory framework capable of balancing technological innovation with the protection of privacy, dignity, reputation, and public trust.
Keywords
Deepfakes, Artificial Intelligence, Bharatiya Nyaya Sanhita, Information Technology Act, Cyber Crime, Criminal Liability, Privacy, AI Regulation.
Introduction
In recent years, artificial intelligence has undergone unprecedented development, enabling machines to generate highly realistic images, videos, and audio recordings that are virtually indistinguishable from authentic content. Among these innovations, deepfake technology has emerged as one of the most disruptive developments in the digital ecosystem. By employing sophisticated deep learning algorithms, deepfakes can fabricate speeches, alter facial expressions, imitate voices, and create entirely fictional audiovisual content with remarkable accuracy. While these technological capabilities have legitimate applications in cinema, education, healthcare, and accessibility, their misuse has created profound legal and ethical concerns across jurisdictions.
India has witnessed a significant rise in incidents involving AI-generated manipulated media. Public figures, celebrities, journalists, and ordinary citizens have increasingly become victims of digitally fabricated videos and images circulated through social media platforms. Such content has been used to facilitate cyber fraud, impersonation, election misinformation, financial scams, character assassination, and the creation of non-consensual intimate material. The widespread dissemination of manipulated media has not only affected individual victims but has also undermined public confidence in digital evidence and online communication.
The emergence of deepfake technology presents a fundamental challenge to traditional criminal law. Existing offences relating to cheating, forgery, impersonation, defamation, obscenity, identity theft, and publication of unlawful content were enacted at a time when artificial intelligence capable of autonomously generating realistic digital media did not exist. Consequently, law enforcement authorities are often required to fit technologically complex offences within statutory provisions that were never specifically designed to regulate AI-generated content. This reactive approach frequently results in uncertainty regarding criminal liability, evidentiary standards, intermediary obligations, and victim protection.
The constitutional implications are equally significant. Deepfake technology threatens the fundamental rights to privacy, dignity, and reputation recognised under Article 21 of the Constitution of India, while simultaneously engaging the guarantee of freedom of speech and expression under Article 19(1)(a). The law must therefore achieve a careful balance between preventing malicious misuse of artificial intelligence and preserving legitimate artistic, educational, journalistic, and technological innovation.
This article argues that although the Bharatiya Nyaya Sanhita, 2023 and the Information Technology Act, 2000 provide mechanisms to prosecute offences resulting from malicious deepfakes, they fail to establish a comprehensive legal framework governing the creation, detection, regulation, and accountability of AI-generated synthetic media. The absence of dedicated legislation has created significant gaps relating to intermediary responsibility, evidentiary authenticity, algorithmic transparency, and preventive regulation. Drawing upon comparative developments in the European Union, the United Kingdom, and the United States, this article proposes a specialised legislative framework capable of addressing the unique legal challenges posed by deepfake technology while safeguarding constitutional values and encouraging responsible technological innovation.
Existing Indian Legal Framework
Bharatiya Nyaya Sanhita, 2023
The enactment of the Bharatiya Nyaya Sanhita, 2023 (BNS) marked a significant step in modernising India’s criminal justice framework. However, despite replacing the Indian Penal Code, 1860, the legislation does not contain provisions that specifically regulate deepfake technology or AI-generated synthetic media. Consequently, law enforcement agencies continue to rely on traditional offences to prosecute conduct facilitated through deepfakes.
Acts involving AI-generated videos or audio recordings may constitute offences relating to cheating by personation, forgery, identity theft, defamation, criminal intimidation, or publication of obscene material depending upon the facts of each case. Although these provisions enable prosecution after harm has occurred, they fail to recognise the unique characteristics of deepfake technology, particularly the ease with which fabricated content can be produced, replicated, and disseminated on digital platforms within seconds.
The absence of a statutory definition of “deepfake” creates further uncertainty. Investigating agencies must first establish that manipulated content amounts to an existing criminal offence before initiating prosecution. This reactive approach often delays investigations and places a considerable evidentiary burden upon victims, especially where fabricated content spreads rapidly across multiple online platforms.
Furthermore, malicious deepfakes frequently involve multiple actors, including the creator of the synthetic media, the individual who distributes it, anonymous online users who amplify it, and digital intermediaries hosting the content. The BNS provides limited guidance regarding the extent of criminal liability attributable to each participant, thereby creating practical difficulties in enforcement.
Information Technology Act, 2000
The Information Technology Act, 2000 remains India’s principal legislation governing cyber offences and electronic communication. Although enacted before the emergence of generative artificial intelligence, several of its provisions are routinely invoked in cases involving manipulated digital content.
Provisions concerning identity theft, cheating by personation using computer resources, violation of privacy, and the publication or transmission of obscene or sexually explicit material provide important legal remedies against certain forms of malicious deepfakes. Likewise, the intermediary due diligence framework seeks to impose responsibilities upon social media platforms and digital service providers to remove unlawful content upon receiving valid legal notice.
Despite these safeguards, the Information Technology Act does not impose affirmative obligations upon developers of generative AI systems to incorporate watermarking, traceability mechanisms, or technological safeguards capable of detecting synthetic media. Similarly, no statutory framework presently requires AI developers to maintain transparency regarding the datasets used for model training or the safeguards implemented to prevent misuse.
Consequently, the existing framework focuses primarily upon punishing unlawful outcomes rather than regulating the technological processes that facilitate the creation and dissemination of deceptive synthetic content.
Constitutional and Data Protection Considerations Deepfake technology also raises significant constitutional concerns. AI-generated fabricated content has the potential to infringe an individual’s rights to privacy, dignity, reputation, and informational autonomy, all of which have been recognised as integral components of Article 21 of the Constitution of India. At the same time, any legislative attempt to regulate synthetic media must remain consistent with the constitutional guarantee of freedom of speech and expression under Article 19(1)(a).
The Digital Personal Data Protection Act, 2023 contributes to the evolving regulatory landscape by strengthening the protection of personal data and imposing obligations concerning lawful processing. However, the legislation primarily governs personal data management and does not specifically address the creation or circulation of AI-generated synthetic media. Consequently, while data protection legislation may provide partial remedies in certain circumstances, it cannot independently resolve the broader issues of criminal accountability, intermediary responsibility, and technological governance arising from deepfake misuse.
III. Judicial Response and Comparative Analysis
Judicial Response to Deepfake-Related Harms in India Although Indian courts have not yet developed an extensive body of jurisprudence specifically addressing deepfake technology, several landmark constitutional decisions provide the legal foundation for regulating AI-generated synthetic media. The recognition of privacy as a fundamental right has significantly expanded the scope of protection available to individuals whose identity, image, voice, or personal information is manipulated through artificial intelligence. The Supreme Court’s decision in Justice K.S. Puttaswamy (Retd.) v Union of India established that the right to privacy forms an intrinsic part of the right to life and personal liberty under Article 21 of the Constitution. This principle extends beyond physical privacy and includes informational privacy, personal autonomy, dignity, and control over one’s identity. The misuse of deepfake technology directly interferes with these constitutional guarantees by enabling the creation and circulation of fabricated digital representations without the consent of the affected individual.
Similarly, judicial recognition of the right to reputation as an essential component of Article 21 reinforces legal protection against malicious deepfakes. Fabricated videos portraying individuals engaging in unlawful or immoral conduct may cause irreversible reputational damage even after their falsity is established. The speed with which manipulated content spreads across digital platforms often renders conventional legal remedies inadequate.
Nevertheless, existing judicial principles continue to operate within a legal framework that addresses the consequences of technological misuse rather than the technology itself. Courts remain dependent upon broadly worded statutory provisions that were enacted before the emergence of generative artificial intelligence, thereby limiting the effectiveness of judicial intervention in rapidly evolving technological disputes.
Comparative Legal Approaches
The challenges posed by deepfake technology are not unique to India. Several jurisdictions have begun developing specialised regulatory frameworks that provide valuable guidance for future Indian legislation.
The European Union has adopted one of the world’s most comprehensive regulatory approaches through the AI Act, which introduces a risk-based framework for artificial intelligence systems. The legislation imposes transparency obligations for AI-generated content and requires providers of certain AI systems to implement safeguards intended to reduce misuse. Rather than relying solely upon criminal prosecution after harm occurs, the European model emphasises preventive regulation and accountability throughout the AI lifecycle.
The United Kingdom has similarly recognised the dangers associated with AI-generated intimate images, online fraud, and digital impersonation. Recent legislative developments seek to strengthen criminal liability for the creation and dissemination of harmful synthetic media while preserving legitimate uses of artificial intelligence in research, journalism, and artistic expression.
In the United States, regulation has largely developed through state legislation and sector-specific initiatives. Several states have enacted laws targeting election-related deepfakes and the non-consensual creation of synthetic intimate imagery. Technology companies have also introduced voluntary measures, including watermarking and content authentication tools, to reduce the circulation of manipulated media.
These comparative approaches demonstrate that effective regulation requires a combination of criminal sanctions, technological safeguards, platform accountability, and public awareness rather than reliance upon traditional criminal law alone.
Critical Evaluation of the Existing Indian Framework The current Indian legal framework provides only fragmented protection against harms arising from deepfake technology. While offences relating to cheating, impersonation, obscenity, defamation, and identity theft enable prosecution in appropriate cases, they fail to address several issues unique to AI-generated content.
First, there is no statutory definition of a deepfake or synthetic media, resulting in inconsistent interpretation and enforcement. Secondly, existing legislation imposes limited proactive obligations upon AI developers and digital intermediaries to detect, label, or prevent the dissemination of manipulated content. Thirdly, victims frequently encounter procedural delays in securing the removal of harmful material, during which irreparable reputational and psychological harm may occur.
Furthermore, advances in generative artificial intelligence have significantly complicated the evidentiary process. Courts and investigating agencies must increasingly determine whether digital photographs, audio recordings, or videos constitute authentic evidence or AI-generated fabrications. The absence of uniform forensic standards and authentication protocols may undermine confidence in digital evidence and adversely affect the administration of criminal justice.
These shortcomings indicate that India’s legal response remains largely reactive rather than preventive. A modern regulatory framework should therefore combine criminal liability with technological regulation, intermediary accountability, victim protection, and transparent governance of artificial intelligence systems.
Recommendations for a Comprehensive Regulatory Framework The rapid evolution of artificial intelligence demands a proactive legal framework that addresses not only the consequences of deepfake misuse but also its creation, dissemination, and governance. While existing criminal and cyber laws provide partial remedies, India requires a specialised regulatory framework capable of responding to the unique challenges posed by synthetic media.
First, Parliament should enact a statutory definition of “deepfake” and distinguish malicious synthetic media from legitimate artistic, educational, and research applications. A precise legislative definition would eliminate ambiguity and facilitate consistent enforcement by investigative agencies and courts.
Secondly, AI developers should be required to incorporate technological safeguards such as digital watermarking, metadata preservation, and content authentication mechanisms capable of identifying AI-generated material. Such measures would significantly reduce the circulation of deceptive content while preserving beneficial innovation.
Thirdly, digital intermediaries and social media platforms should assume greater responsibility for detecting and promptly removing malicious deepfake content. Mandatory reporting mechanisms, rapid grievance redressal procedures, and cooperation with law enforcement agencies would strengthen victim protection while improving regulatory compliance.
The Government should also establish specialised forensic laboratories and provide training for police officers, prosecutors, and judges regarding the identification and investigation of AI-generated evidence. Uniform forensic standards would enhance the reliability of digital evidence and minimise the risk of wrongful prosecution.
Finally, India should adopt a risk-based regulatory approach similar to emerging international practices while ensuring that any restrictions imposed upon artificial intelligence remain proportionate and consistent with constitutional guarantees of free speech, privacy, and due process. Such a balanced framework would encourage responsible innovation without stifling technological advancement.
Conclusion
Deepfake technology represents one of the most significant legal challenges arising from the rapid advancement of artificial intelligence. Its capacity to manipulate reality with remarkable accuracy threatens individual privacy, reputation, democratic institutions, and public confidence in digital communication. While these statutes provide an important legal foundation for prosecuting deepfake-related offences, they remain largely reactive and were not specifically designed to regulate AI-generated synthetic media.
This article has demonstrated that India’s existing legal framework lacks clear statutory definitions, preventive regulatory mechanisms, intermediary accountability, and comprehensive technological safeguards. Comparative developments in the European Union, the United Kingdom, and the United States indicate that effective regulation requires a combination of criminal liability, transparency obligations, platform responsibility, and technical standards rather than reliance upon traditional criminal law alone.
As artificial intelligence continues to evolve, India’s legal system must transition from merely responding to technological misuse toward proactively governing emerging digital risks. A comprehensive legislative framework that balances innovation with constitutional rights will not only strengthen public confidence in digital technologies but also ensure that the law remains capable of addressing future developments in artificial intelligence. Such reforms are essential to preserve privacy, dignity, and the integrity of digital evidence in an increasingly AI-driven society.
Table of Cases
- Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1
- Shreya Singhal v Union of India (2015) 5 SCC 1 Subramanian Swamy v Union of India (2016) 7 SCC 221
Table of Legislation
- Constitution of India, 1950
- Bharatiya Nyaya Sanhita, 2023
- Information Technology Act, 2000
- Digital Personal Data Protection Act, 2023
- Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
- Regulation (EU) 2024/1689 (Artificial Intelligence Act)
Bibliography
Legislation
- Bharatiya Nyaya Sanhita, 2023.
- Constitution of India, 1950.
- Digital Personal Data Protection Act, 2023.
- Information Technology Act, 2000.
- Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
- Regulation (EU) 2024/1689 (Artificial Intelligence Act).
Cases
- Justice K.S. Puttaswamy (Retd.) v Union of India (2017) 10 SCC 1.
- Shreya Singhal v Union of India (2015) 5 SCC 1.
- Subramanian Swamy v Union of India (2016) 7 SCC 221.
Books and Journal Articles
- Goodfellow I and others, ‘Generative Adversarial Networks’ (2014).
- OECD, Artificial Intelligence, Machine Learning and Policy.
- World Intellectual Property Organization, WIPO Technology Trends: Artificial Intelligence (2019).
- European Parliament, Artificial Intelligence Act.
