Authored By: Maya Vasu
Maharaja Agrasen Institute of Management studies
Introduction
A deepfake is synthetic audio, image or video generated or altered by artificial intelligence to depict a person saying or doing something they never said or did, in a manner realistic enough that a viewer could reasonably mistake it for genuine footage. What was, until recently, a niche technical curiosity has become a mainstream legal problem: cloned voices used in financial fraud, fabricated videos of political figures, and non-consensual sexually explicit content generated from ordinary photographs are now routine enough that Indian regulators have had to respond directly.
That response raises a genuine constitutional tension. Article 19(1)(a) protects freedom of speech and expression, a right that extends to satire, parody and fiction, all of which may involve deliberately manipulated or synthetic depictions of real people.[1] Article 19(2) permits reasonable restrictions on that right only on specified grounds, including defamation, public order and incitement to an offence.[2] Any legal response to deepfakes must therefore distinguish, in practice and not merely in principle, between synthetic content that is expressive and synthetic content that is deceptive or harmful. This article argues that India’s 2026 regulatory intervention gets the diagnosis broadly right but leaves two problems only partly addressed: the practical difficulty of applying a harm-based test at platform scale, and the gap between data-protection law and the specific harms deepfakes cause to identity, dignity and reputation. It proceeds in four parts. Part II sets out the current legal framework. Part III considers the free expression dimension. Part IV turns to privacy, consent and personal identity. Part V proposes a way forward, before Part VI concludes.
The Current Regulatory Framework
Until February 2026, India had no statute that named deepfakes as a distinct legal category. Harms caused by manipulated media were addressed indirectly, through defamation law, the limited personality-rights jurisprudence developed by the High Courts, and the general intermediary due-diligence obligations under the Information Technology Act 2000. That changed with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026, notified by the Ministry of Electronics and Information Technology on 10 February 2026 and in force from 20 February 2026.[3] The Amendment Rules introduce a defined legal category, ‘synthetically generated information’ (SGI), covering audio, visual or audio-visual content that is artificially or algorithmically created, generated, modified or altered using a computer resource in a manner that makes it appear real, authentic or true.[4] The definition is deliberately technology-neutral: it names no specific tool, model or company, which should allow it to remain workable as the underlying technology changes.
Three obligations follow from that definition. First, significant social media intermediaries, those with more than five million users in India, must ensure that SGI uploaded to their platforms carries a prominent label and permanent provenance metadata, and users may not strip or suppress that label.[5] Second, the timeline for removing unlawful content has been sharply compressed: general takedown obligations fall from thirty-six hours to three, and particularly sensitive categories, non-consensual sexually explicit deepfakes and impersonation content among them, must be removed within two hours of a valid complaint.[6] Third, failure to meet these obligations exposes an intermediary to loss of the safe-harbour protection it would otherwise enjoy under section 79 of the Information Technology Act 2000, together with attendant civil and criminal exposure. Separately, the Bharatiya Nyaya Sanhita 2023 criminalises cheating by personation, pretending to be another real or imaginary person in order to deceive, an offence punishable by up to five years’ imprisonment that squarely covers deepfake-enabled impersonation fraud, even though it was not drafted with synthetic media specifically in mind.[7] The Digital Personal Data Protection Act 2023 adds a further, indirect layer: because a deepfake is typically built from a person’s photographs, voice recordings or other personal data, its creation without consent may itself engage the Act’s consent and purpose-limitation requirements, quite apart from whatever the resulting content depicts.[8]
III. Deepfakes and Freedom of Expression
The regulation of deepfakes cannot be separated from Article 19(1)(a), which protects freedom of speech and expression against unreasonable state interference.[9] Not all manipulated media constitutes harmful misinformation. Political satire, parody, artistic expression and fictional works can deliberately distort reality without intending to deceive anyone; a comedian using an AI-generated impression of a public figure is not doing the same thing as someone fabricating a political speech and presenting it as genuine. The regulatory challenge is therefore one of proportionality and context, precisely the standard Article 19(2) demands of any restriction on speech.[10]
Measured against that standard, a legal framework should distinguish between synthetic content that is clearly fictional, content that is ambiguous, and content deliberately designed to deceive. The last of these presents the strongest case for intervention, particularly where it causes identifiable harm to a real person or to public order. This is also why labelling can be preferable to blanket prohibition in many circumstances: if viewers are clearly informed that content is synthetic, the law protects transparency without automatically treating synthetic expression as unlawful. The 2026 Amendment Rules broadly track this logic, since a labelling and metadata obligation is, by design, less restrictive of expression than an outright ban on generating synthetic content would be.[11] The harder question the Rules leave open is who decides, at platform scale and often within a two-hour window, whether a given piece of content falls on the satire side of the line or the deception side; that determination is currently left largely to the intermediary itself, which has an obvious incentive to over-remove ambiguous content rather than risk its safe harbour.[12]
Industry responses to the Amendment Rules make this incentive explicit rather than speculative. Platforms have raised concerns that the SGI obligations apply platform-wide rather than post-by-post, which may lead them to pre-emptively restrict ambiguous content simply to manage regulatory risk, and that the absence of any government-provided verification tooling leaves smaller intermediaries with a real compliance burden and no reliable way to establish whether particular content in fact meets the statutory definition.[13] These are not reasons to abandon the labelling and takedown approach, since the harms it targets are real, but they do suggest that Article 19(1)(a) analysis of the Rules cannot stop at their text; a facially proportionate labelling regime can still produce a disproportionate chilling effect if the compliance incentives it creates push intermediaries toward removing more than the statute actually requires.
Privacy, Consent and Personal Identity
Deepfakes also raise a distinct question about control over one’s own identity. A person’s face, voice and mannerisms can now be reproduced without their participation or knowledge, and reassembled into content they never created. Where that reproduction is sexually explicit, defamatory or used for fraud, the consequences can be severe; even outside those extreme cases, the mere ability to replicate a person’s identity convincingly raises questions about privacy and autonomy that predate, but are sharpened by, generative AI.
Indian courts have begun to answer this question through personality-rights litigation rather than through statute. In 2023, the Delhi High Court granted the actor Anil Kapoor an ex-parte injunction restraining a range of websites and unnamed defendants from using his name, voice, image and catchphrases, including through AI-generated deepfakes and morphed videos, for unauthorised commercial gain.[14] The court accepted that free speech protects satire and criticism, but held that this protection ends where synthetic content is used to exploit or misappropriate a person’s identity rather than to comment on it.[15] That reasoning sits comfortably with the broader right to privacy the Supreme Court recognised as an incident of Article 21 in Justice KS Puttaswamy (Retd) v Union of India, which grounds a person’s control over their own image and identity in constitutional rather than merely contractual or statutory terms.[16]
The Digital Personal Data Protection Act 2023 is relevant to this broader data-governance environment, since it establishes a statutory framework governing the processing of digital personal data from which a deepfake is typically built.[17] Yet deepfake regulation cannot be reduced entirely to data protection. The problem also concerns identity, expression, reputation, consent and deception simultaneously, and a comprehensive response therefore requires interaction between data-protection law, personality-rights jurisprudence, intermediary regulation and criminal law, rather than reliance on any single statute.
The Way Forward
India’s current approach, combining a defined SGI category, labelling and metadata obligations, compressed takedown timelines and a general personation offence, is a significant development, but regulation should not stop at imposing obligations on platforms.
First, there should be greater investment in digital forensic capacity. Law enforcement agencies need the technical expertise to authenticate manipulated audio, video and images and to preserve that evidence in a form that will withstand challenge in judicial proceedings, since a takedown obligation is of limited value if the underlying prosecution cannot establish what was actually altered. Second, public awareness is essential: regulation cannot succeed if users automatically treat every video circulating online as authentic, so digital literacy initiatives should specifically include the ability to recognise synthetic content and verify information before sharing it. Third, transparency should accompany platform obligations in the other direction as well; where content is removed or labelled as synthetic, the person who posted it should have a meaningful and reasonably fast avenue to challenge an erroneous classification, given how easily a two-hour takedown clock can be met by removing legitimate content rather than adjudicating it. Finally, regulation should remain technology-neutral and proportionate, as the 2026 definition of SGI largely already is.[18] The objective should not be to eliminate synthetic media, which would be neither realistic nor desirable, but to prevent deception and identifiable harm while preserving legitimate artistic, educational and commercial uses of the same underlying technology.
Conclusion
Deepfakes represent a genuinely difficult problem for the law because they blur the distinction between reality and fabrication at exactly the moment that distinction matters most, in courts, elections, financial transactions and personal reputations. The same technology that can be used to deceive, defame, impersonate and defraud can equally support legitimate artistic, educational and commercial activity, and a workable legal framework has to keep both possibilities in view rather than treating synthetic media as inherently suspect.
India’s legal framework has begun to recognise that distinction rather than collapse it. The 2026 Amendment Rules expressly address synthetically generated information for the first time, combining labelling and provenance obligations with sharply compressed takedown timelines for the most harmful categories of content, while the Bharatiya Nyaya Sanhita’s personation offence and the courts’ personality-rights jurisprudence supply complementary protection that the intermediary rules alone do not reach.[19] The real test, however, will not be whether India can write rules about deepfakes; it will be whether those rules can be enforced quickly, accurately and proportionately, without simply shifting the incentive from under-moderation to reflexive over-removal. Synthetic media is not going to disappear, so the law’s task is to become better at identifying when technology crosses the line from creativity into deception, without turning the underlying technological possibility itself into a legal offence.
Reference(S):
[1]Constitution of India 1950, art 19(1)(a).
[2]Constitution of India 1950, art 19(2).
[3]Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026, GSR 120(E) (10 February 2026, in force 20 February 2026), amending the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021.
[4]Freshfields, ‘India Targets Deepfakes and AI-Generated Content: Key Changes under MeitY’s 2026 Amendments to the IT Rules’ (Technology Quotient, 20 February 2026) <https://www.freshfields.com/en/our-thinking/blogs/technology-quotient/india-targets-deepfakes-and-ai-generated-content-key-changes-under-meitys-2026-102mjwn> accessed 5 September 2026.
[5]RNA Technology and IP Attorneys, ‘Regulating Synthetically Generated Information: India’s IT Rules Amendment of 2026’ (6 March 2026) <https://rnaip.com/regulating-synthetically-generated-information-indias-it-rules-amendment-of-2026/> accessed 5 September 2026.
[6]ecorpit, ‘India’s IT Rules 2026: Deepfake Takedown and AI-Labelling’ (10 July 2026) <https://ecorpit.com/india-it-rules-2026-deepfake-takedown-ai-labelling/> accessed 5 September 2026.
[7]Bharatiya Nyaya Sanhita 2023, s 319.
[8]Digital Personal Data Protection Act 2023.
[9]Constitution of India 1950 (n 1).
[10]Constitution of India 1950 (n 2).
[11]Freshfields (n 4).
[12]Constitution of India 1950 (n 2); cf Freshfields (n 4).
[13]Managing Intellectual Property, ‘Regulating Synthetically Generated Information: India Amends IT Intermediary Rules’ (11 March 2026) <https://www.managingip.com/article/2g3bz6kdk7qxkoxxcsg00/sponsored-content/regulating-synthetically-generated-information-india-amends-it-intermediary-rules> accessed 5 September 2026.
[14]Anil Kapoor v Simply Life India CS(COMM) 652/2023 (Delhi High Court, 2023).
[15]ibid.
[16]Justice KS Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.
[17]Digital Personal Data Protection Act 2023 (n 8).
[18]Freshfields (n 4).
[19]Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026 (n 3).
