Authored By: Dhanalakshmi R
Ambedkar Law University
Introduction
Indian courts have already dealt with several deepfake cases, but most of these involved fraudulent, such as fake stock market advice or political misinformation[1]– not deepfake pornography. Even though deepfake pornography is one of the most common forms of this technology, no such case has yet been filed in an Indian court, largely because 62% of deepfake abuse cases involving women go unreported due to stigma[2].
Three laws are meant to address this issue, and each of them falls short. The Information Technology Act, 2000 treats deepfakes as a generic cybercrime problem, prosecuted the same way as hacking or online fraud, rather than as a violation of a person’s body and image[3]. The Bharatiya Nyaya Sanhita, 2023 contains provisions on defamation, outraging modesty, and harassment, but these were drafted with physical-world harassment in mind, not the harm of a fabricated digital body[4]. The DPDP Act, 2023, meanwhile, focuses on big corporations and data leaks. It was not designed to give an individual victim a fast, direct remedy against a stranger who creates a fake sexual image of them[5].
This article argues that India requires a dedicated statutory provision that criminalises deepfake pornography as a specific offence. Naming the offence clearly would send a message to cybercriminals that digitally modifying a person’s image into sexual content carries the same legal weight as physical abuse. This article further argues that enforcing such a provision requires specialised cyber courts, rather than relying on traditional police stations that do not understand deep-learning algorithms.
The article proceeds as follows. Section II examines the existing legal framework and its limitations. Section III analyses how Indian courts have approached AI-driven harm so far, and the absence of cases specifically involving pornography. Section IV critically evaluates the gaps in ownership, consent, and enforcement. Section V draws on comparative approaches from other jurisdictions. Section VI concludes with recommendations for a dedicated statutory response.
Legal Framework
The Information Technology Act, 2000
Section 66E, which criminalises the unauthorised transmission of a person’s private body parts, should logically extend to deepfake pornography. Although the body shown in a deepfake is not the victim’s actual anatomy – it is often fused from an actress’s or model’s body onto the victim’s face – the reputational and psychological harm to the victim is identical to that caused by a real, unauthorised image. Defence counsel often argue that the victim’s genuine private body was never revealed, since the exposed body belongs to someone else entirely. This argument, however misses the point. It is the victim’s face and identity attached to a sexual image, without consent, that causes the harm – not the literal ownership of the body parts shown. Since genitals look broadly similar across individuals, the fabrication still inflicts the same reputational damage as an authentic image would[6].
Sections 67 and 67A of the IT Act punish obscene and sexually explicit content, but both provisions were designed around a different harm entirely. Obscenity law exists to protect public morality from vulgar or shocking material – it treats the offence as one against society at large, not against a specific individual. Deepfake pornography does not fit this model. It is not an attack on public decency; it is an attack on one identifiable person’s identity. It violates that individual’s consent, steals their face, and destroys their specific reputation, in a way that generic obscenity provisions were never designed to capture[7].
The Bharatiya Nyaya Sanhita, 2023
The Bharatiya Nyaya Sanhita’s provisions on outraging modesty and harassment assume physical proximity between attacker and victim – historically, these offences involved unwanted touching, following, or verbal insult in a shared physical space[8]. Deepfake pornography breaks this assumption entirely. The harm is completely detached from physical proximity: a stranger on the other side of the world can steal a person’s digital identity and weaponize it against them indefinitely. Unlike a street insult or a momentary physical scare, the damage caused by a deepfake is a permanent, unerasable violation of the victim’s reputation across the internet, one that can resurface, be reshared, or be rediscovered at any time.
The Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 is built to control large-scale data handlers, not individual wrongdoers. It regulates data fiduciaries – platforms, apps, and corporations – by penalising them for data breaches, weak security practices, or sharing personal data with third parties without consent[9]. Its entire structure is oriented around corporate compliance and financial penalties imposed on organisations. This makes the Act practically useless for a victim seeking to imprison a stranger, an acquaintance or a classmate who has maliciously edited their photograph into a deepfake pornographic video – the act was never designed to punish that individual at all
III. Case Law Analysis
In Ankur Warikoo v John Doe[10], cybercriminals used AI tools to create hyper-realistic deepfake videos of the prominent content creator and entrepreneur Ankur Warikoo. The fake videos convincingly mimicked his face and voice to give fraudulent stock market tips, tricking viewers into joining scam WhatsApp groups for financial fraud. Because the attackers hid behind anonymous online profiles, Warikoo filed a “John Doe” lawsuit against unknown defendants. The Delhi High Court issued a strict injunction ordering major tech and social media platforms to unmask the scammers identities and take down the deceptive deepfake links within a strict thirty-six-hour window.
The Warikoo case exposes a deep gap in Indian cyber law. While the court successfully addressed this financial scam using an emergency John Doe order, this framework fails victims of deepfake pornography specifically. A financial deepfake threatens corporate credibility and public trust, justifying a swift, public lawsuit. Explicit deepfakes, by contrast, inflict an intimate harm rooted in social shame – victims cannot easily file a public lawsuit without broadcasting their own violation to the world. The Warikoo case therefore proves that relying on temporary judicial remedies such as John Doe orders is entirely inadequate for protecting ordinary citizens from targeted, sexualised AI abuse.
Critical Evaluation
A further gap in the existing framework concerns ownership of the source photograph itself. Under Indian copyright law, ownership of a photograph belongs to whoever captured it – if a person takes their own selfie, they hold the copyright; if a friend or professional photographer takes the photograph, that person owns it instead. This ownership question, however, does nothing to protect the victim of deepfake pornography, because copyright law was built to protect commercial profit and artistic authorship, not human dignity. Relying on ownership as a legal remedy creates two distinct failures. The first may be called the ownership trap: if a friend or photographer took the original, innocent photograph, the victim cannot personally issue an emergency takedown notice, because they do not legally own the image that was manipulated. The second is a mismatch of harm: forcing a victim to argue that a fabricated nude video infringes their intellectual property, rather than violates their bodily privacy, is deeply insulting. It reduces an act of sexual harassment to a matter of online piracy.
Proponents of the status quo often argue that existing platform takedown mandates under the IT Rules offer sufficient protection. This position overlooks three practical failures. First, the damage happens instantly: AI-generated media spreads faster than any content moderator can react, and by the time a platform acts on a report, the deepfake has already been viewed and shared into thousands of private group chats on encrypted apps like WhatsApp or Telegram. Second, there is a whack-a-mole reality – deleting a video from Instagram or X does not erase it from the internet permanently, because attackers can easily take screenshots, download the file, and reupload it to adult sites or cross-border servers outside India’s legal jurisdiction, making true permanent deletion effectively impossible. Third, takedown orders create zero accountability for the creator: they target the symptom while completely ignoring the cause. Without a dedicated criminal law that punishes the act of manufacturing a deepfake, the original creator can continue generating new images with absolute legal impunity.
This asymmetry reveals a troubling double standard in how Indian law responds to deepfake harm. Male public figures targeted by financial deepfakes, such as Warikoo, can pursue public litigation without shame, because the harm is understood as commercial and reputational in a business sense. Women targeted by deepfake pornography cannot access the same swift judicial remedy, because filing a public lawsuit would require them to expose the very explicit content destroying their lives in the first place. Faced with this choice, most victims remain silent to protect their reputation, rather than risk further exposure through litigation. The result is a system in which prominent men receive rapid judicial intervention, while ordinary women are left to suffer in silence
Comparative Perspectives
The comparative experience of other jurisdictions strengthens the case for legislative reform in India. The United Kingdom’s Online Safety Act 2023[11] introduced a specific criminal offence for sharing non-consensual deepfake pornography, treating it as a distinct wrong rather than folding it into general obscenity or harassment law. This demonstrates two things. First, that legal definitions capable of capturing the unique harm of synthetic sexual imagery already exist and have been tested in a comparable common law jurisdiction. Second, that India need not draft such a provision from first principles – it can adapt an existing legislative model rather than relying on temporary judicial fixes such as the John Doe order used in the Warikoo case
Conclusion
This article has demonstrated that India’s current legal framework is fundamentally mismatched to the harm of deepfake pornography. The Information Technology Act, the Bharatiya Nyaya Sanhita, and the Digital Personal Data Protection Act each address either physical bodily contact, generic obscenity, or corporate data handling – none of them account for how deepfakes weaponize a victim’s face and identity without ever touching her physically. The Warikoo case illustrates that Indian courts can act swiftly when the harm is understood as financial, yet this same swiftness has never been tested for victims of deepfake pornography, who remain silenced by stigma and structural gaps such as the ownership trap.
Accordingly, this article recommends that India enact a dedicated statutory provision criminalising the creation and distribution of deepfake pornography as a specific offence, distinct from existing obscenity and privacy law. It further recommends the establishment of specialised cyber courts, staffed with technically trained personnel capable of adjudicating cases involving deep-learning technology. Without such reform, the law will remain permanently one step behind those who misuse this technology, while victims continue to suffer in silence.
Bibliography
Table of Cases
Ankur Warikoo v John Doe (Delhi High Court, 2024)
Table of Legislation
Bharatiya Nyaya Sanhita 2023
Digital Personal Data Protection Act 2023
Information Technology Act 2000
Online Safety Act 2023 (UK)
Bibliography
Ramani V, ‘India’s Deepfake Crisis: Women Are Falling Prey to AI Menace More Than Men’ (Digit, 10 March 2026) accessed 6 August 2026.
[1] Ankur Warikoo v John Doe (Delhi High Court, 2024)
[2] Vyom Ramani, ‘India’s Deepfake Crisis: Women Are Falling Prey to AI Menace More Than Men’ (Digit, 10 March 2026) accessed 6 August 2026.
[3] Information Technology Act 2000.
[4] Bharatiya Nyaya Sanhita 2023.
[5] Digital Personal Data Protection Act 2023.
[6] Information Technology Act 2000, (n 3), s 66E
[7] Information Technology Act 2000 (n 3), ss 67, 67A.
[8] Bharatiya Nyaya Sanhita 2023 (n 4)
[9] Digital Personal Data Protection Act 2023 (n 5).
[10] Ankur Warikoo v John Doe (n 1).
[11] Online Safety Act 2023, s 188 (UK)
