Authored By: Ani (Mohd.shafi)
Vivek College of Law, Vivek University, UP
I. Introduction
A deepfake is a piece of synthetic media, such as a video, image, or audio recording, that uses artificial intelligence to make a real person appear to say or do things they never actually did. It is typically created using Generative Adversarial Networks (GANs). In late 2023, a deepfake video of actor Rashmika Mandanna went viral, followed by similar videos of public figures including the Prime Minister and Sachin Tendulkar. According to the NASSCOM 2025 report, India witnessed a 500% increase in deepfake-related complaints between 2022 and 2025.
This technological menace directly challenges the concept of personality rights. Personality rights refer to an individual’s right to control the commercial use of their identity, including name, likeness, voice, and other distinctive traits. In India, there is no codified statute for the same, and protection is derived from judicial interpretation of the Right to Privacy under Article 21 of the Constitution. This article critically examines the inadequacy of existing laws such as the Information Technology Act, 2000 (IT Act), the Bharatiya Nyaya Sanhita, 2023 (BNS), and the Digital Personal Data Protection Act, 2023 (DPDP Act), and argues for a dedicated statutory framework.
The central research problem this article addresses is: does India have an adequate legal mechanism to protect common citizens from deepfake personality theft, or is protection limited to celebrities who can approach the Delhi High Court? This article argues that while the DPDP Act provides a foundation, India urgently needs a dedicated personality rights statute.
II. Personality Rights in India
A. Constitutional Foundation
K.S. Puttaswamy v. Union of India (2017)
The Supreme Court in K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1, held that privacy is intrinsic to Article 21 and includes informational autonomy. Personality rights are considered a natural extension of this right, as they protect an individual’s autonomy to decide how their identity is represented.
B. Judicial Development Through Case Laws
The Indian judiciary has protected personality rights mainly for celebrities. The following decisions trace that development.
Titan Industries v. Ramkumar Jewellers, (2012) 50 PTC 339 (Del)
In this case, the defendant used a deceptive variant of a Tanishq advertisement featuring Amitabh and Jaya Bachchan for his own jewellery brand. The Delhi High Court held that a celebrity’s persona is a protectable right and that unauthorised commercial exploitation amounts to infringement of personality rights and passing off. The court granted a permanent injunction. The decision remains an important precedent for personality rights in India.
Anil Kapoor v. Simply Life India (2023)
The plaintiff sought protection against various websites and AI tools using his likeness, voice, and his iconic phrase “Jhakaas” without consent. The Delhi High Court passed a John Doe order protecting all facets of his personality, including name, image, voice, and mannerisms, from AI misuse and commercial exploitation.
Jackie Shroff v. The Peppy Store & Ors., CS (COMM) 389/2024
The court protected actor Jackie Shroff’s personality rights over his name “Bhidu”, voice, and image against unauthorised use for memes, merchandise, and AI-generated content.
The common thread in these cases is that relief has come almost entirely to celebrities approaching the Delhi High Court, while the common person has no comparable remedy.
C. The Core Gap
Both the Anil Kapoor and Jackie Shroff judgments were ex-parte interim injunctions from the Delhi High Court, accessible only to those who can afford expensive litigation. A common person from Bijnor or any small city whose face is morphed into a pornographic deepfake has no effective district-level remedy. There are no statutory damages, no takedown timeline, and no criminal deterrence specific to deepfakes. The next part examines why the existing statutes do not fill this gap.
III. Why Existing Laws Fail to Curb Deepfakes
1. Information Technology Act, 2000
Sections 66D (cheating by personation using a computer resource), 66E (violation of privacy by capturing or transmitting private images), and 67 and 67A (obscene content) are commonly invoked. However, these sections were designed for obscenity and voyeurism, not for identity theft. Section 66D requires proof of cheating, which fails when a deepfake is made as satire. Moreover, intermediaries claim safe harbour under Section 79.
2. Bharatiya Nyaya Sanhita, 2023 (BNS)
Section 319 punishes cheating by personation, and Section 356 deals with defamation. Both require mens rea (an intention to defraud or defame). In deepfake cases, creators are often anonymous, use VPNs, and operate from outside India, so proving intent becomes extremely difficult. The punishments (up to five years for cheating by personation and up to two years for defamation) also do not reflect the gravity of the harm.
3. Copyright Act, 1957
Under Section 13, copyright subsists in original literary, dramatic, musical, and artistic works. A human face or voice is not a “work”, so a victim cannot claim copyright infringement when their face is cloned. The performer’s right under Section 38A protects only performers’ performances, not static identity.
4. Digital Personal Data Protection Act, 2023
This is the most promising law. Under Section 2(t), personal data covers any data about an identifiable individual, which would include facial geometry and voice. Section 6 mandates consent for processing, and Section 8(5) requires the data fiduciary to protect data. A violation attracts a penalty of up to Rs. 250 crore under Section 33. However, the Act is still being brought into force in phases, with most substantive obligations not due until 2027, and the Data Protection Board is only now becoming operational. Crucially, the Act does not provide for injunctive relief or a right to be forgotten in respect of deepfakes. It is a data protection law, not a personality rights law.
IV. Comparative Legal Framework: A Global Perspective
A comparative analysis reveals that while India is still grappling with traditional remedies, major jurisdictions have moved towards specific AI-focused legislation.
1. United States of America
The USA offers the most robust protection through the right of publicity, treated as an intellectual property right.
State laws: California Civil Code § 3344 and New York Civil Rights Law §§ 50-51 prohibit the unauthorised use of a person’s name, voice, or likeness for commercial purposes. California AB 602 (2019) allows victims of pornographic deepfakes to sue their creators. Tennessee’s ELVIS Act, 2024 is path-breaking: it amended the right of publicity to explicitly include voice as a property right, protecting musicians from AI voice cloning.
Federal developments: In March 2024, the DEFIANCE Act was introduced in the US Congress to grant victims of non-consensual sexually explicit deepfakes a federal civil right of action. The proposed NO FAKES Act, 2024 seeks to federally protect every individual’s voice and likeness from unauthorised AI replication.
2. European Union
The EU has adopted a transparency-centric approach. The EU AI Act, 2024 is the world’s first comprehensive AI law. Article 50 mandates that AI-generated or manipulated content (deepfakes) must be clearly and visibly labelled as artificially generated. Non-compliance with these transparency obligations attracts fines of up to 15 million Euros or 3% of global annual turnover, whichever is higher.
GDPR: The creation of deepfakes involves the processing of biometric data, thus attracting strict penalties under the General Data Protection Regulation.
3. United Kingdom
The UK currently lacks a comprehensive deepfake statute but criminalises its most harmful form. Under Section 187 of the Online Safety Act, 2023, sharing non-consensual sexually explicit deepfakes is a criminal offence punishable with imprisonment. Common law remedies such as passing off are also invoked.
Lesson for India
India needs a combination of the EU’s labelling regime and the US property approach. Mandatory watermarking using the C2PA standard and statutory damages without proof of actual loss are essential. In other words, India needs a hybrid model: the property-based protection of the USA and the mandatory disclosure regime of the EU, rather than relying solely on Sections 66E and 67 of the IT Act.
V. Proposed Framework
To fill the legal vacuum, this article proposes a six-point model law.
1. Statutory Definition: Amend the DPDP Act or enact a Personality Rights Act defining “persona” to include face, voice, name, signature, catchphrase, and any identifiable AI-generated replica.
2. Strict Liability for Commercial Use: Any commercial use of a deepfaked persona without consent should attract strict liability with minimum statutory damages of Rs. 10 lakh, without any need to prove actual damage, in line with statutory damages regimes in other jurisdictions.
3. Six-Hour Takedown and Right to be Forgotten: On a complaint by the victim, the intermediary must take down the deepfake within six hours. The victim should also have a right to be forgotten, built on the right to erasure under Section 12 of the DPDP Act, requiring search engines to de-index such content, following the principle in Google Spain SL v. AEPD (2014).
4. Mandatory Watermarking: All generative AI tools operating in India (including open-source models) must embed a C2PA verifiable watermark or metadata in every output, building on the MeitY advisory of 2024.
5. New Criminal Provision (BNS Section 319A): Introduce a specific offence: “Whoever creates or distributes a deepfake with intent to cause fraud, election interference, sexual exploitation or communal hatred shall be punished with imprisonment up to 5 years and fine.”
6. Institutional Reform: Create district-level fast-track benches under the District Judge to grant ex-parte ad-interim injunctions within 48 hours, so that the remedy is not limited to the Delhi High Court.
VI. Conclusion
Deepfakes are not merely a technology issue; they are an assault on Article 21 autonomy, dignity, and informational self-determination. The Delhi High Court in the Anil Kapoor and Jackie Shroff cases has shown judicial willingness, but ad-hoc John Doe orders cannot substitute for a codified law. The DPDP Act, 2023 provides a solid foundation but must explicitly recognise personality rights. India needs a balanced, rights-based law that protects identity without chilling legitimate satire and parody protected under Article 19(1)(a). If we fail to act now, we risk a future where truth itself becomes untrustworthy.
Reference(S):
1.Constitution of India.
2. IT Act 2000
3. BNS 2023
4.DPDP Act 2023
5. Puttaswamy (2017) 10 SCC 1
6. Titan (2012) 50 PTC 339
7. Anil Kapoor CS(COMM) 652/2023
8.Jackie Shroff CS(COMM) 389/2024
9. EU AI Act Art 50
10. ELVIS Act 2024.
