Regulating Deepfakes in India

Introduction

In November 2023, a fake video that featured the face of Indian actress Rashmika Mandanna pasted on someone else’s body went viral across various social media platforms before it could be recognised as being a deepfake. While the video generated outrage among the citizens, even leading to a case registered against it and a public response from the Union Government, it also highlighted a structural loophole within India’s legal system – until now, there was no legislation against the making of deepfakes.

Deep fakes refer to the production of fabricated audio-visual material by artificial intelligence in a way that shows a real person doing or saying things that the person never said or did. Deep fakes are no longer a thing of laboratory experimentation but have been employed in producing non-consensual adult content, financial fraud through impersonation, and misinformation. For several years, Indian courts responded to this phenomenon largely by extending the common-law doctrine of personality rights on a case-by-case basis, rather than through purpose-built legislation. It is only with the 2026 amendment to the Intermediary Guidelines that a statutory definition of synthetic media has entered Indian law.

This paper asserts that despite the 2026 Amendment, the Indian law’s approach towards deepfakes continues to be reactionary and piecemeal and an integrated legal framework, wherein responsibility for damages caused by deepfakes is not merely placed on the distribution platforms but also on the creators and users of artificial media, is needed to ensure justice to those who lack means to file lawsuits. The paper is divided into five parts. In Part II, the legal framework is discussed. Part III deals with the judicial approach towards personality rights. In Part IV, an analysis of the effectiveness of the legal framework is provided. Part V provides comparative lessons from the EU, USA, and China.

The Existing Legal Framework

The Information Technology Act, 2000 and the 2026 Intermediary Guidelines Amendment

Until 2026, victims of deepfake-related abuse in India would have no choice but to seek remedy under general provisions of the Information Technology Act, 2000, none of which were intended for use in cases involving synthetic media. Section 66D prohibits cheating by personation through a computer resource;  Section 66E prohibits the capturing or transmission of private parts of any person without his/her consent;  and Section 67 and 67A prohibit the publishing of any obscene or sexually explicit content.  All of these provisions lack a definition of “deepfake,” “synthetic media,” and “AI-generated content” and also require the proof of another element, personation, invasion of privacy or obscenity, which is not necessarily present in a deepfake.

The solution to this problem was provided by Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified on 10 February 2026.  These amendments provide for the inclusion of a definition of ‘synthetically generated information’ in Rule 2(1)(wa) of the parent Rules and provide that it includes “information that has been artificially or algorithmically created, generated, modified or altered using computer resources and may reasonably appear to be genuine.”  In addition to this, the intermediaries have been obligated to warn users of uploading of synthetically generated information, mark it clearly when it is visual content, marking a minimum percentage of the frame and embed metadata to ensure traceability.  Non-compliance by significant social media intermediaries to these requirements will result in loss of their safe harbour protection under Section 79 of the parent Act. Although the 2026 Amendment is an important move forward, it is still delegated legislation, being an amendment made through the rule-making power of Section 87 of the Information Technology Act.  The 2026 Amendment does not criminalize the making of a deepfake maliciously; nor does it give rise to a private right of action on the part of the person who was the basis for the deepfake’s likeness.

The Bharatiya Nyaya Sanhita, 2023

The Bharatiya Nyaya Sanhita, 2023, enacted to replace the Indian Penal Code, coming into force on 1 July 2024, provides the legal framework for dealing with deepfake crimes in the absence of a specific provision for such offences.  The offence of cheating by personation is covered under Section 319, where cheating can be done in respect of a living, dead, or imaginary person,  Section 356 retains the crime of defamation in language quite similar to the former, and Section 296 prohibits obscene conduct and content.  Like the provisions of the Information Technology Act, none of these sections recognizes the specific harm posed by synthetic media, particularly the ability of a deepfake to cause reputational and psychological damage without any individual element of cheating, defamation, or obscenity being present.

Privacy, Personality, and the Digital Personal Data Protection Act, 2023

The constitutional grounding for any deepfake-related case in India lies in the right to privacy, which has been upheld as an inherent element of Article 21 of the Constitution by Justice K.S. Puttaswamy (Retd) v Union of India. According to the Supreme Court, the right to informational privacy encompasses control over one’s image and identity, which provides the doctrinal underpinning from which High Courts have made personality rights injunctions.  In addition, the Digital Personal Data Protection Act, 2023, along with the Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, provides a system of consent based framework for the processing of personal data. Though it is possible that a photograph or a voice recording of a person comes within the definition of personal data, it needs to be noted that the Act deals with the processing of personal data by identifiable data fiduciaries in a commercial or institutional setting; it does not cover anonymous generation of deepfakes and does not criminalize the act of fabrication of deepfakes.

III. Judicial Responses: Personality Rights as an Interim Remedy

With no deepfake-specific law existing prior to 2026, the Indian judiciary, especially the Delhi High Court, established an ad hoc law based on the right to personal identity. In the case of Anil Kapoor v Simply Life India, an actor was claiming the violation of his rights concerning the unauthorized usage of his name, voice, and likeness, even in the form of AI morphing his face with other celebrities and pornographic images. Justice Prathiba M. Singh issued an ex parte and omnibus injunction against the defendants and all others acting jointly with the defendants restraining them from using the personality of the plaintiff by means of technological devices such as “Artificial Intelligence, Machine Learning, deep fakes, face morphing” for commercial purposes. The court based its reasoning on the plaintiff’s fundamental right to lead his life with dignity, under Article 21 in conjunction with the reasonable restrictions on the freedom of speech guaranteed under Article 19(2). The Anil Kapoor order is part of an ever-growing set of such orders. The Delhi High Court in Amitabh Bachchan v Rajat Nagi, decided a year earlier, safeguarded the name, voice, and likeness of the renowned actor from unauthorized commercial exploitation, even extending its prohibition to a scam that was exploiting his reputation. In 2024, the Delhi High Court issued a similar order in relation to actor Jackie Shroff for preventing the abuse of his personality through an AI-generated scam. By 2026, courts had begun issuing dynamic, in rem orders against anonymous parties, known as Ashok Kumar orders, due to the swift nature with which deepfake content moved between mirror websites and social media handles. In practice, such relief is available only to plaintiffs who have the means to bring litigation before the Commercial Division of the Delhi High Court, as well as the ability to hire specialized lawyers; it does not really help the average citizen who has been victimized through the use of deepfakes of intimate images. Secondly, such relief relies upon personality and publicity rights, which themselves are judge-made concepts without any statutory definition within India, hence leaving much ambiguity about the nature of these rights after death and for how long they would last. Lastly, even when injunctions are awarded, the intermediaries have to cooperate for such an injunction to work, as section 79 safe harbor protects intermediary platforms that operate based on actual knowledge.

Critical Evaluation: A Reactive and Fragmented Regime

Despite the 2026 Amendment and the doctrine surrounding personality rights described above, it is argued that the Indian legal system’s reaction to deepfakes is insufficient in protecting regular citizens because there are, at the very least, four reasons why.

First, the locus of liability is wrongly placed along the value chain. Liability for the offense under the 2026 Amendment mainly falls on the intermediary, as it obligates them to label and delete the synthetic content, whereas the person who used generative artificial intelligence to produce an illegal deepfake remains without any direct liability in their own right.

Second, the criminal provisions invoked, personation, obscenity and defamation under the Bharatiya Nyaya Sanhita, were not meant to address synthetic media and are thus under-inclusive. Political deepfakes which harm discourse through misrepresentation but do not impersonate a certain individual with intent to extort money from him, or satirical deepfakes which do not offend or defame but misappropriate another person’s likeness without his consent, could evade all forms of current legislation. Third, the civil remedy sought, that of an injunction on personality rights, is judge-made, expensive, and can only be granted after injury has occurred, often widely. There is no statutory cause of action for misappropriation of likeness in India such as right of publicity in several American states, making the remedy vary across benches of the High Courts. Fourth, the interplay between the 2026 Amendment and the safe harbour of Section 79 still needs to be tested. Despite the fact that the Amendment threatens to strip safe-harbour immunity from platforms not complying with their obligations to label or takedown the synthetic content in specified time frames, given the precedents established by the unconstitutionality of the Fact Check Unit rules before the Bombay High Court, and which is now pending before the Supreme Court, it appears that India’s content based intermediaries obligations can always face constitutional challenges in the context of overbreadth and prior restraint.

In general, all the above discussed deficiencies show that India’s strategy to regulate deepfakes has been reactive in nature rather than deliberate statutory design.

Comparative Perspectives

The European Union

The EU Artificial Intelligence Act has established transparency obligations as per Article 50 which became fully applicable on 2 August 2026.  Those deploying an AI system that generates or alters images, audio, and video to create a deepfake shall reveal that the content has been artificially generated or altered unless the work is excluded due to its nature, such as when it is a law enforcement task or an obvious artwork or satire.  Generative AI systems shall also label their outputs using machine-readable means to facilitate the detection thereof.  Non-compliance may lead to penalties up to fifteen million euros or three per cent of the global turnover, whichever is greater.  Europe’s approach is particularly useful for India since it makes a distinction between those building the AI system and those deploying the AI system for a particular purpose.

The United States

Although there is no all-inclusive federal statute against deepfakes in the United States, it has made steady progress in that direction. The introduction of the “TAKE IT DOWN Act” on 19 May 2025, for example, means it is now illegal to share any non-consensual intimate imagery, whether AI-generated deepfake or otherwise, and it must be removed from the relevant platform within forty-eight hours. Thirty or more states in the United States have passed legislation about deepfakes, with a focus mainly on non-consensual intimate imagery and election-disinformation. The sectorial and harm-based strategy is far more focused, and consequently easier to enforce, compared to the European Union’s transparency policy and the nascent labeling policy in India.

China

The Provisions on the Administration of Deep Synthesis Internet Information Services in China have been in place since January 2023. These provisions mandate the obtaining of the consent of the individual whose biometric data is being used for the creation of the synthetic content, the labelling of deep synthesis content, and the verification of the identity of the users through a real-name system. The Chinese model, while much more state-oriented than its counterparts in Europe and America, does highlight that mandatory labelling, coupled with the traceability of the uploader rather than just the platform, can be implemented.

Proposals for Reform in the Indian Context

Based on this comparative analysis, three particular reforms can be recommended.

Firstly, Parliament must introduce an autonomous provision either as an amendment to the Information Technology Act or as a part of some future digital safety legislation that would criminalize the production and dissemination of a sexual or defamatory deepfake irrespective of the satisfaction of the elements of personation, obscenity or defamation. It would help bridge the gap between the harm done by deepfake and the elements of the offence identified in Part IV above.

Second, the labeling and traceability obligations of the 2026 Amendment ought to be broadened by legislative act, as opposed to simply through delegation in rule-making, such that there is a duty on the developers and distributors of generative artificial intelligence technologies to disclose directly, in the same way as the provider versus distributor distinction set out in Article 50 of the EU’s Artificial Intelligence Act.

Third, India should create a statute that creates a cause of action for misappropriation of personality, detailing the components, applicability, and time frame after death, so that the present protection that is limited to celebrities by virtue of being able to obtain injunctions from the High Court of Delhi becomes available to ordinary citizens who have been victims of non-consensual deepfake videos.

VII. Conclusion

Rashmika Mandanna’s case of November 2023 is not an anomaly; it was just the first sign of an issue that has only become more advanced since then. As this article has demonstrated, India’s legal framework in its current form, which involves general provisions from the IT Act, personality rights case law through the Bharatiya Nyaya Sanhita, and the 2026 Amendment to the Intermediary Guidelines Rules, still amounts to a very limited and reactive legal regime. Liability is focused on distribution platforms rather than the creators and distributors of synthetic materials, civil remedy is mostly available only for those who have the means to file suit in the Delhi High Court, and the constitutional resilience of these labeling rules has yet to be tested.

In this article, I have maintained that the Parliament needs to go further than delegating rule-making powers and develop a statutory regime which would make the creation of malicious deepfakes a criminal act, delineate disclosure responsibilities between the creators and users of deepfakes following the model developed by the European Union, and develop a civil mechanism for personality misappropriation. The experience of the European Union, the United States, and China makes it clear that such reform is administratively possible and increasingly considered a necessity. With cheaper and easier access to generative artificial intelligence software, the difference between the harms they can inflict and the ability of the law to remedy such harms will increase unless the Parliament takes action with the same sense of urgency as the courts have.

Reference(S):

Cases

Justice K.S. Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.

Anil Kapoor v Simply Life India CS(COMM) 652/2023 (Delhi High Court, 20 September 2023).

Amitabh Bachchan v Rajat Nagi & Ors CS(COMM) 819/2022 (Delhi High Court, 25 November 2022).

Jackie Shroff v The Peppy Store & Ors CS(COMM) 389/2024 (Delhi High Court, 2024).

Kunal Kamra v Union of India (Bombay High Court, 2024) (Fact Check Unit Rules).

Legislation

Constitution of India 1950, arts 19(2), 21.

Information Technology Act 2000 (India), ss 66D, 66E, 67, 67A, 79, 87.

Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (India), as amended by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026, GSR 120(E), 10 February 2026.

Bharatiya Nyaya Sanhita 2023 (India), ss 296, 319, 356.

Digital Personal Data Protection Act 2023 (India).

Digital Personal Data Protection Rules 2025 (India), notified 13 November 2025.

Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) [2024] OJ L1689, art 50.

Tools to Address Known Exploitation by Immobilizing Technological Deepfakes on Websites and Networks Act 2025, Pub L No 119-12 (US).

Provisions on the Administration of Deep Synthesis Internet Information Services (China, effective 10 January 2023). 

Secondary Sources

‘Rashmika Mandanna: India actress urges women to speak up on deepfake videos’ BBC News (29 November 2023) accessed 23 August 2026.

‘India targets deepfakes and AI-generated content: key changes under MeitY’s 2026 amendments to the IT Rules’ (Freshfields, February 2026).

‘Deepfake Legislation Tracker: Federal, State Laws’ (StackCyber, 6 August 2026).

‘The EU AI Act’s Transparency Rules: A Practical Guide to Article 50’ (EU Artificial Intelligence Act, 2026).