Introduction
A deepfake is an AI-generated deceptive image, video or audio clip that shows a real person saying, doing, endorsing or performing something that never actually happened. The real issue stems from its ability to make something false appear real and authentic. This is achieved by placing one individual’s face on another’s body, or vice versa, by cloning an individual’s voice, or by fabricating a video of a person saying something they never said.
Synthetically generated information (“SGI”), when developed and used responsibly, can offer benefits such as enabling innovation, improving access to education and skill development, enhancing research, providing virtual assistants and enabling assistive technologies for persons with disabilities, among many others.1 The legal conundrum arises when SGI is misused to deceive, defraud, impersonate, exploit, humiliate or cause harm.
This is illustrated by the deepfake involving the actor Rashmika Mandanna that went viral in 2023.2 In the video, Ms Mandanna’s face was superimposed on that of Zara Patel, a British-Indian woman who had posted the original video on Instagram, as she entered an elevator. The Delhi Police registered an FIR invoking sections 465 and 469 of the Indian Penal Code (then applicable) as well as sections 66C and 66E of the IT Act.3 Yet the incident exposed a gap: the harm was readily identifiable, but Indian criminal law contained no offence designed for the creation or dissemination of a “deepfake.”
After this incident the legal position changed. The IT Rules were amended in February 2026 to define and regulate “synthetically generated information,” which encompasses AI-generated or algorithmically manipulated audio, visual and audio-visual material.4 The SGI framework specifically addresses deepfakes, voice cloning and other realistic synthetic content.
The primary question is therefore whether the current framework safeguards digital personality rights, adequately regulates the creation and dissemination of harmful SGI, and provides appropriate consequences and remedies, while also balancing legitimate expression and innovation. This paper submits that the current framework is not adequate for dealing with the aftermath of AI-driven deepfakes and other harmful and damaging SGI.
What the SGI regulatory framework has done is impose obligations on intermediaries; it does not, however, delineate the substantive rights of the individual whose identity has been digitally misused. While the 2026 amendments are significant, they are more akin to a transparency protocol. The overarching right to digital identity, with its underlying legal interests of identity, personality, autonomy, dignity, reputation and consent over digital reproduction, remains dispersed across constitutional law, common law, intellectual property law, criminal law and sector-specific legislation.
More concerning is the traditional assumption that personality rights are primarily a mechanism for protecting the commercial value of celebrated personalities. This overlooks how SGI can cause serious injury through revenge pornography, cyberbullying and digital harassment to individuals who possess no commercial celebrity status at all.5
The law must therefore confront a broader question: what legal right does an individual possess over the digital reproduction, dissemination and manipulation of her or his identity (face, voice, likeness and mannerisms) without consent?
What is a deepfake and how is it legally defined?
A. Conceptual meaning
A deepfake is essentially an AI-generated or manipulated video, audio clip or image that makes a real person appear to say, do, endorse or perform something she never actually did.6 It can be so realistic that it is mistaken for the authentic. Deepfakes take many forms: facial replacement, re-enactment, voice cloning, synthetic speech, AI-generated photographs and manipulated videos.
Deepfakes are distinguishable from ordinary editing by their degree of realism and their capacity to deceive. Editing the background or lighting of a photograph, for example, does not produce a deepfake; placing an individual’s face onto another person’s body does.
It is pertinent to note that not all AI-generated material is harmful. A fictional film, a satirical image, an artistic work or a clearly labelled AI-generated advertisement cannot be equated with a fabricated video falsely depicting a person committing a crime.
B. The position before 2026
Before the 2026 amendments to the IT Rules,7 Indian law contained no statutory definition of “deepfake.” Regulation was thus contingent upon identifying the particular harm caused by the manipulated content, not the technology employed.
A single deepfake could simultaneously attract several areas of law: cheating by personation, identity theft, invasion of privacy, defamation, obscenity, infringement of personality rights, passing off and copyright infringement. None of these addressed synthetic fabrication itself.
The law asked what harm had occurred rather than what new technological act had produced the harm.
C. The 2026 position: “synthetically generated information” (SGI)
The 2026 amendments represent a significant change.
Rule 2(1)(wa) of the amended IT Rules8 defines “synthetically generated information” as audio, visual or audio-visual information that is:
1. artificially or algorithmically created, generated, modified or altered using a computer resource;
2. in a manner that makes it appear real, authentic or true; and
3. depicts or portrays an individual or event in a manner that is, or is likely to be perceived as, indistinguishable from a natural person or real-world event.9
The definition brings within its ambit realistic deepfakes, AI-generated or altered images and videos, and voice cloning.10 It also sets out exclusions, such as routine or good-faith editing, formatting, enhancement, technical correction, colour adjustment, noise reduction, transcription or compression, and processing for accessibility, which do not materially alter, distort or misrepresent the underlying content.11
This marks a shift from regulating merely the consequences of manipulation to regulating a defined category of realistic synthetic content. It is pertinent to note, however, that the SGI definition does not create a comprehensive substantive right against the appropriation of identity without consent. The SGI framework is regulatory in nature and principally governs the obligations of intermediaries.
The existing legal framework
A. Information Technology Act, 2000
The IT Act remains a key statutory foundation for addressing cyber-harms arising from deepfakes.
i. Section 66C: identity theft
Section 66C criminalises the fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature.12 It applies to synthetic media only where a deepfake also involves the misuse of digital credentials or identifying information.
Its scope is narrower than digital impersonation generally. A person may be impersonated through a synthetic video, a cloned voice or a manipulated image without any electronic signature, password or statutory identification feature being misused, in which case the provision is not attracted.
ii. Section 66D: cheating by personation
Section 66D is most relevant where a deepfake is used to perpetrate fraud. It criminalises cheating by personation by means of a communication device or computer resource.13
The provision also highlights the limits of harm-based regulation, since not every deepfake is created to cheat. For example:
• A fabricated political video may be employed to influence voters.
• A sexually explicit deepfake may be used to humiliate rather than to obtain property.
• A synthetic video may falsely depict a teacher committing misconduct without any financial objective.
• A cloned voice may be used to damage a person’s reputation.
The absence of cheating therefore does not eliminate the harm.
iii. Section 66E: violation of privacy
Section 66E penalises the intentional or knowing capture, publication or transmission of the image of a private area of any person without consent, under circumstances violating that person’s privacy.14
While this provision may extend to some non-consensual intimate imagery, it predates generative AI. A synthetic sexual image may never require the actual “capture” of the victim’s private area. The provision reflects a broader issue: new technology can produce new harms that older statutes did not contemplate.
Sections 67 and 67A may also apply to obscene or sexually explicit electronic material.15
B. The BNS and other substantive remedies
The Indian Penal Code has now been replaced by the Bharatiya Nyaya Sanhita, 2023 (“BNS”).
i. Cheating by personation
Section 319 of the BNS addresses cheating by personation.16 It will be attracted where an AI-generated likeness is used to impersonate another person in order to deceive or to cause loss. While the provision addresses cheating, it does not treat the unauthorised reproduction of identity as an independent wrong.
ii. Defamation
Section 356 of the BNS addresses defamation.17 The principles enshrined in this provision would be attracted where a realistic deepfake is employed to depict a person falsely as committing an unlawful, immoral or reputation-tarnishing act.
Deepfakes may be particularly damaging in this context because visual and audio evidence has traditionally carried substantial persuasive value. A recording that appears authentic can tarnish a reputation before the victim has a chance to prove that it is fabricated.
iii. Criminal intimidation
Section 351 of the BNS addresses criminal intimidation and may apply where deepfakes are used for threats, coercion, extortion or related conduct.18
The inherent weakness remains that these provisions regulate the harm caused by synthetic media (SGI) instead of creating a general substantive right against synthetic identity appropriation.
C. The IT Rules: from reactive takedown to specific synthetic-media regulation
As discussed above, the most valuable recent regulatory development concerning deepfakes and other synthetic media is the February 2026 amendment to the IT Rules.19 These amendments mark a shift from a predominantly reactive intermediary regime focused on damage control towards a system built on proactive technical measures, labelling, provenance, verification and the expedited takedown of harmful synthetic media (SGI).
An analysis published on LiveLaw shortly after the amendments called them India’s most assertive regulatory intervention into AI-generated content to date, describing a regulatory model centred on speed, traceability and enforceable accountability.20
i. Prevention of unlawful synthetic content
Rule 3(3) of the amended IT Rules lays down a due diligence framework for an intermediary that offers a computer resource enabling the creation, modification, publication or dissemination of SGI. Such an intermediary must deploy reasonable and appropriate technical measures, including automated tools or other suitable mechanisms, to prevent unlawful synthetic content that violates any law, including the BNS and the Protection of Children from Sexual Offences Act, 2012.21
Read with the general due diligence obligations in Rule 3(1)(b), which now extend to SGI, the framework requires measures against the creation, publication, dissemination or hosting of the following categories of synthetic media and information, among others:
• information belonging to another person to which the user has no right;
• non-consensual intimate imagery and obscene, pornographic, paedophilic or sexually explicit deepfakes;
• synthetic content invading bodily or personal privacy;
• false documents or false electronic records;
• content infringing intellectual property rights;
• content violating any other law;
• deceptive impersonation;
• false depictions of individuals or real-world events;
• fabricated statements, conduct or identities; and
• realistic synthetic depictions likely to deceive or mislead users, including about the origin of a message.
This represents a substantial development from the earlier position because the Rules expressly recognise the technological category in its own right, rather than relying solely on the underlying offence.
ii. Labelling and provenance
The amended framework also introduces obligations concerning labelling and provenance. Where synthetic content is lawful, the Rules require it to be prominently labelled so that its synthetic nature can be immediately identified, and to be embedded, to the extent technically feasible, with permanent metadata or other technical provenance mechanisms, including a unique identifier, to identify the computer resource used to create, generate, modify or alter it.22 Intermediaries are also barred from enabling the modification, suppression or removal of such labels and metadata.23
This is a significant conceptual shift: regulation no longer waits for harm to surface after dissemination, but seeks to reshape in advance the structure through which synthetic content is created and disseminated.
iii. User declarations and platform verification
Significant social media intermediaries (“SSMIs”) must require users to declare whether uploaded material is synthetically generated information, and must deploy appropriate technical measures to verify the accuracy of those declarations before publication.24
Where synthetic status is confirmed, the material must be clearly and prominently labelled. This provision places part of the burden of identifying synthetic content on the platform, rather than leaving it entirely on the victim.
iv. Speed of removal
The 2026 framework substantially reduces response timelines. Upon a complaint by an individual, or by any person on his or her behalf, about content that prima facie exposes the individual’s private area, shows the individual in full or partial nudity or in any sexual act or conduct, or is in the nature of impersonation in electronic form, including artificially morphed images, the intermediary must take all reasonable and practicable measures to remove or disable access to the content within two hours.25
D. Personality rights and the evolution of Indian jurisprudence
The most significant judicial response to deepfakes stems from the courts’ own jurisprudence on personality and publicity rights rather than from a dedicated statute. Personality rights typically protect the identifiable attributes of a person, including name, image, likeness, voice and other distinctive elements of persona, from unauthorised exploitation. Publicity rights confer on public figures, celebrities, influencers and creators the exclusive right to control and profit from the commercial use of their identity. While these rights clearly prevent the commercial exploitation of celebrity personas, they do not adequately protect an ordinary individual targeted by non-commercial deepfakes, such as revenge pornography, online harassment or cyberbullying.
i. Constitutional foundation: privacy and dignity
In Justice K.S. Puttaswamy (Retd.) v. Union of India, the Supreme Court recognised privacy as a fundamental right under Article 21.26 Privacy, on this understanding, encompasses interests in individual autonomy, personal dignity, bodily integrity and control over aspects of one’s personal information and identity, or conception of “self.”
The earlier decision in R. Rajagopal v. State of Tamil Nadu is also noteworthy.27 The Supreme Court there recognised privacy interests in relation to the publication and use of aspects of an individual’s identity and life without consent. These decisions form the constitutional foundation for protection against the harms of synthetic media (SGI) and their dissemination.
Personality rights, however, are not codified in any single statute. They have evolved through an amalgamation of constitutional principles, passing off, trademark law, copyright, judicial injunctions and common law principles. This judicial development has proved especially important in the AI context.
E. Judicial response to AI and deepfakes
i. D.M. Entertainment Pvt. Ltd. v. Baby Gift House
In D.M. Entertainment Pvt. Ltd. v. Baby Gift House, the Delhi High Court adjudicated on the unauthorised commercial exploitation of the singer Daler Mehndi’s personality attributes through the sale of dolls that imitated him and sang lines from his songs.28 The decision remains a significant foundation of Indian publicity-rights jurisprudence.
The Delhi High Court held that, to avail of the right against infringement of the right to publicity, the plaintiff must be “identifiable” from the defendant’s unauthorised use.29 The decision thus recognises the importance of identifiability in preventing infringement of publicity rights. The Court further observed that the right of publicity can be located in the individual’s right and autonomy to permit or not permit the commercial exploitation of his likeness or some attributes of his personality.30
At the same time, the Court cautioned that an over-emphasis on publicity rights could chill free speech, so that caricature, lampooning, parody and the like may not constitute infringement.31
That limitation becomes even more important in the age of AI.
ii. Titan Industries Ltd. v. Ramkumar Jewellers
In Titan Industries Ltd. v. Ramkumar Jewellers, the Delhi High Court considered hoardings that depicted Amitabh Bachchan and Jaya Bachchan, without authorisation, as endorsers of the defendant’s jewellery.32 The Court relied on an American decision, Haelan Laboratories v. Topps Chewing Gum, which holds that a man has a right in the publicity value of his photograph.33
This case is particularly pertinent to AI-generated commercials and advertisements. An AI-generated advertisement showing a celebrity apparently endorsing a product may create the kind of confusion and false association conventionally addressed through passing off and publicity principles. The technological mechanism has changed; the underlying misrepresentation may not have.
iii. Amitabh Bachchan v. Rajat Nagi
In Amitabh Bachchan v. Rajat Nagi,34 the Delhi High Court granted ad-interim protection35 against the alleged unauthorised commercial exploitation of Mr Bachchan’s name, image, voice and other distinctive attributes, including to run a fake Kaun Banega Crorepati (KBC) lottery scheme.
The case demonstrates that personality protection extends beyond a conventional photograph. A person’s voice, identity and distinctive persona may enjoy protectable value.
iv. Anil Kapoor v. Simply Life India
The order in Anil Kapoor v. Simply Life India36 is one of the landmark developments in Indian personality-rights jurisprudence in the AI context.
In that case, the actor Anil Kapoor sought protection of his name, image, voice, likeness, mannerisms and other personality attributes. The alleged misuse included registrations of domain names bearing his name; merchandise such as T-shirts and magnets bearing his images; AI-generated images and face morphing; GIFs; and fake pornographic videos, all without lawful authorisation.
The Delhi High Court granted broad interim protection against unauthorised use of Anil Kapoor’s personality, holding that his “name, likeness, image, persona, etc., deserves to be protected, not only for Plaintiff’s own sake but also for the sake of his family and friends who would not like to see his image, name and other elements being misused, especially for such tarnishing and negative use.” The order expressly restrained misuse through artificial intelligence, machine learning, deepfakes and face morphing.37
It is noteworthy that the Court acknowledged that the harm may extend beyond conventional commercial exploitation, since the unauthorised dissemination of synthetic media can affect privacy, dignity, reputation and livelihood.
v. Jaikishan Kakubhai Saraf v. The Peppy Store
In Jaikishan Kakubhai Saraf alias Jackie Shroff v. The Peppy Store, the Delhi High Court extended the discussion to a broader collection of personality attributes.38
The case involved the alleged unauthorised use of Mr Shroff’s name, image, voice, mannerisms and other attributes, including an AI chatbot that mimicked his persona. The Court granted protection against specified forms of exploitation, such as the use of his name and photograph on websites selling merchandise, but declined at that stage to restrain a YouTube video compiling his humorous interviews, recognising the need to balance personality rights against the creator’s legitimate interests in artistic and economic expression.39
Personality rights cannot become a private censorship mechanism.
A legal framework that prevents a false AI-generated endorsement is materially different from one that prevents a parody, political cartoon, satire, criticism or artistic depiction merely because it uses recognisable elements of a public figure.
vi. Arijit Singh v. Codible Ventures LLP
In Arijit Singh v. Codible Ventures LLP,40 the Bombay High Court dealt specifically with AI tools capable of cloning the singer’s voice and with the unauthorised use of his name, image, likeness and other personality attributes. It held:
18. It is a settled proposition of law that in an action for protecting personality rights and right to publicity, establishing the celebrity status of the plaintiff is only the primary ingredient. Additionally, it must be established that the plaintiff is identifiable from the defendant’s unauthorized use and that such use by the defendant is for commercial gain. … Pertinently, all this is being done by these Defendants without any permission or authorization of the Plaintiff. Making AI tools available that enable the conversion of any voice into that of a celebrity without his/her permission constitutes a violation of the celebrity’s personality rights. Such tools facilitate unauthorized appropriation and manipulation of a celebrity’s voice, which is a key component of their personal identity and public persona. This form of technological exploitation not only infringes upon the individual’s right to control and protect their own likeness and voice but also undermines their ability to prevent commercial and deceptive uses of their identity.
19. … In my view, creation of new audio or video content / songs / videos in the Plaintiff’s AI name / voice, photograph, image, likeness and persona without his consent and commercially using the same could potentially jeopardize the Plaintiff’s career / livelihood. Additionally, allowing the Defendants to continue using the Plaintiff’s name, voice, likeness etc. in the form of an AI content, without consent of the Plaintiff, not only risks severe economic harm to the Plaintiff’s life/career, but also leaves room for opportunities for misutilization of such tools by unscrupulous individuals for nefarious purposes.41
The Court thus recognised that personality rights may extend to AI-generated voices and synthetic representations of a performer, and granted interim protection against unauthorised exploitation. The case shows how a voice can become the basis for an entirely new digital identity, and in that sense pushes personality-rights doctrine towards synthetic manifestations of identity.
The principal substantive and enforcement gaps
The 2026 amendments to the IT Rules seek to prevent SGI harm and manipulation through pre-emptive precautions such as verification and platform obligations, and deal with attribution, or tracing the origin of a breach, through provenance and metadata. They do not, however, fully resolve the substantive question of who should be legally responsible across the AI creation and dissemination chain. Despite the 2026 reforms, therefore, significant gaps remain.
A. No coherent substantive wrong for AI-generated or synthetic appropriation of a person’s identity, persona and likeness
The most vital gap today lies in the absence of an independent cause of action for the unauthorised appropriation of a person’s identity, persona or likeness through AI-generated or synthetic media. The wrongful conduct may instead have to be addressed through existing causes of action, namely passing off, copyright or trademark infringement, breach of privacy, defamation, and breach of personality or publicity rights.
This fragmented structure is likely to fail where the harm is serious but does not fit comfortably within any one doctrine. The relevant question is therefore what legal right an individual has over the digital reproduction and distribution of her or his identity, persona and likeness.
B. Personality rights have not been codified and remain largely judge-made
While Indian courts have developed a sophisticated body of personality-rights jurisprudence, there is no dedicated statute comprehensively laying down:
• the scope of personality rights;
• the scope of the rights of ordinary individuals against identity appropriation;
• the regulation of AI-generated media;
• remedies for unauthorised digital identity appropriation; and
• the interplay between personality rights and freedom of expression.
Even though this jurisprudence is evolving continuously through individual cases, it also creates uncertainty.
C. At present, protection is very celebrity-centric
Indian personality-rights jurisprudence has historically revolved around celebrities because a celebrity’s identity carries obvious commercial value. AI exposes the limitations of this approach.
A person’s face, voice, mannerisms or identity can now be manipulated and replicated regardless of whether that person has any commercial goodwill. For example:
• An ordinary individual may receive an AI-generated call that falsely appears to come from a family member.
• A teacher may be falsely depicted accepting a bribe or hitting a student.
• An ordinary individual may become the subject of a sexually explicit synthetic video.
• An employee may be made to appear to make racist or abusive statements.
None of these harms depends on celebrity status. It is therefore submitted that personality-rights protection should not remain confined to celebrities, as the dissemination or publication of harmful AI-driven SGI implicates privacy, bodily autonomy, dignity and control over an individual’s digital manifestations. This necessitates a shift from the commercial value of persona to the personhood value of identity.42
Personality rights cannot exist solely where a person’s identity possesses market value, giving a celebrity stronger protection than a private individual, when the underlying interest is rooted in dignity, autonomy, privacy and personhood, which ought to be protected for both. A more coherent approach would recognise and protect both commercial publicity rights, which protect the economic value of persona, and digital personality or identity rights, which protect the individual’s control over digital manifestations of identity irrespective of celebrity status.
D. Liability across the AI chain
After the 2026 amendments to the IT Rules, the synthetic media (SGI) framework primarily regulates intermediaries and hosting platforms. Practical difficulties arise, however, in imposing liability across the distribution chain of AI-generated media, since several players are involved:
1. the AI tool provider that facilitates the creation of the deepfake;
2. the creator of the deepfake;
3. the uploader of the deepfake;
4. the person who deliberately amplifies it; and
5. the hosting platform or intermediary (website, mobile application, etc.).
It is a challenge to determine when an AI provider should bear responsibility for foreseeable misuse. An AI tool provider cannot automatically become liable merely because its technology can be misused; so rigid an approach would stifle legitimate innovation.43 Where, however, an AI tool is positioned with a known potential for misuse, such as fraud, impersonation or non-consensual sexual imagery, stronger obligations may be warranted.44 Such a risk-based approach to regulation can be found in the EU’s Artificial Intelligence Act.45 A legitimate legal framework must, in short, be based on the risk of reasonably foreseeable misuse,46 knowledge and proportionality.
E. Cross-border enforcement
Deepfakes are inherently transnational: evidence may be stored outside India, the creator may be abroad, hosting platforms and intermediaries are mostly foreign, and the victim may be domiciled in India. This poses a fundamental challenge for complaint redressal and legal action.
Indian law thus requires stronger mechanisms for the disclosure of source information, the preservation of metadata and digital evidence, cross-border enforcement, and rapid identification and takedown. The effectiveness of substantive law ultimately depends upon the ability to identify the actor responsible.
F. Evidence and attribution
The evidentiary problem is that the apparent authenticity of synthetic content is itself part of the harm. Courts need reliable methods to determine whether content is synthetic, what tool was used to generate it, when it was generated, who uploaded it, whether provenance metadata has been removed, and whether the available evidence establishes its source beyond reasonable doubt.
While the 2026 amendments to the IT Rules emphasise provenance and traceability, they are not foolproof: metadata can be stripped, content can be screen-recorded, and synthetic material can be repeatedly transformed.
G. Victim remedies are fragmented
At present, a victim of the unauthorised creation or dissemination of synthetic media may have to pursue the following remedies simultaneously:
• lodging a complaint with the hosting platform or intermediary;
• registering a police complaint;
• filing a civil suit for an injunction, or for defamation or violation of privacy and personality rights, as the case may be; and
• initiating criminal proceedings under several statutes.
This multi-layered and scattered system of redress is especially harassing for victims of intimate imagery or humiliating deepfakes, where delay may amplify the injury. A victim-centric approach must therefore focus on speedy redress, victim confidentiality, evidence preservation and stopping repeated dissemination.
Closing the legal gaps in deepfake (synthetic media) regulation
India does not primarily require a separate “Deepfake Act.” A more effective solution would be a technology-neutral statutory framework that builds upon the 2026 amendments to the IT Rules. Such a framework could address the remaining substantive gaps while protecting legitimate creative, educational, journalistic and satirical uses.
This framework must:
1. Define and regulate harmful synthetic impersonation. Regulation must distinguish lawful, non-deceptive and labelled synthetic media from content that falsely represents a real person or event, is intended or reasonably likely to deceive, and causes or is reasonably likely to cause specified harm. This would target harmful content while avoiding over-regulation of AI-generated media, and would be proportionate.47
2. Codify a statutory “digital personality right.” Such legislative protection ought to extend beyond traditional publicity rights and celebrities to an individual’s persona, name, image, likeness, voice, signature, mannerisms, biometric identifiers, digital avatar and other uniquely identifying attributes. Unauthorised AI replication should constitute an infringement where it involves commercial exploitation, deceptive impersonation, serious reputational harm, or a substantial violation of privacy or dignity.
3. Recognise non-consensual intimate synthetic imagery as a distinct harm, irrespective of whether an actual image of the victim’s body was used. Existing privacy protections do not adequately safeguard against the harms posed by wholly synthetic sexual imagery.
4. Provide a holistic, specialised and rapid victim-remedy mechanism. The two-hour removal obligation for harmful content under the IT Rules (as amended in 2026) must be supplemented by a single reporting portal, evidence preservation, cross-platform coordination for takedown, hash-based identification of copies, confidentiality safeguards, identification and suppression of repeat uploads, and assistance with police complaints. The guiding principle should be “notice once, suppress everywhere reasonably possible.”
5. Treat provenance48 safeguards as a supplement to, rather than a replacement for, detection and enforcement, since provenance is not proof of authenticity. Labelling and provenance requirements should be supported by cryptographic credentials, secure metadata, watermarking, platform-side detection, uploader verification for high-risk content, and preservation of relevant logs. The absence of a provenance marker should not lead to a presumption that content is not authentic; conversely, the presence of a marker does not mean that the content is authentic.
6. Regulate AI providers proportionately. AI providers that offer high-risk face or voice manipulation and cloning tools should bear accountability obligations proportionate to foreseeable misuse, including safeguards against non-consensual sexual imagery, abuse-reporting mechanisms, preservation of relevant logs, cooperation with lawful investigations, and measures against the removal of provenance markers. These obligations should target high-risk AI providers without imposing indiscriminate monitoring duties on developers.
The law should not aim at a technology-specific prohibition, but should provide a proportionate framework of individual rights, platform accountability, provenance, rapid remedies and safeguards against foreseeable misuse.
Conclusion
India’s approach to deepfakes has moved from a fragmented framework of cybercrime and IT law, criminal law, privacy, intellectual property and judicially developed personality rights towards a more structured regulatory regime. The Rashmika Mandanna incident exposed the limitations of relying solely on those remedies. At the same time, the cases involving Anil Kapoor, Jackie Shroff and Arijit Singh demonstrated the willingness of Indian courts to extend existing legal principles to AI-generated misappropriation of an individual’s persona, image, voice and likeness.
The 2026 amendments to the IT Rules embody a regulatory shift by expressly addressing synthetically generated information (SGI) and imposing obligations relating to labelling, provenance, verification and timely removal. A substantive gap nonetheless remains: while India has regulated synthetic content and the hosting platforms through which it travels, it has not addressed the underlying rights of the individual whose identity is reproduced.
The central question is therefore no longer merely whether a deepfake constitutes defamation, fraud, privacy infringement or copyright violation, but what legal right an individual possesses over the digital reproduction of his or her identity. This question grows in importance as AI enables the reproduction, misappropriation and manipulation not only of images but also of voices, mannerisms, expressions and interactive digital personas.49 The resulting harm may implicate dignity, autonomy, privacy, reputation and psychological security, irrespective of commercial goodwill.50
India therefore requires a multi-layered framework combining the 2026 IT Rules with codified digital personality rights, specific protection against non-consensual synthetic sexual imagery, rapid victim-centred remedies, proportionate obligations on AI providers, provenance and traceability standards, improved evidentiary mechanisms and cross-border enforcement, while preserving safeguards for satire, journalism, parody, criticism, political expression and artistic creativity.
The objective must not be to prohibit synthetic media altogether, but to establish digital identity as an aspect of personhood and to ensure that technological innovation does not facilitate harm to identity without effective accountability.
The regulatory objective, in short, is to permit synthetic media, make deception and misuse traceable, make unlawful manipulation punishable, and ensure that redress for victims is faster than the viral spread of the deepfake itself.
*****
Footnotes
1. Ministry of Electronics & Information Technology, Frequently Asked Questions on the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, at 1 (Feb. 10, 2026), https://www.meity.gov.in/static/uploads/2025/10/065b6deb585441b5ccdf8be42502a49c.pdf.
2. Meryl Sebastian, Rashmika Mandanna Calls for Action Against ‘Scary’ Deepfake Video, BBC News (Nov. 7, 2023), https://www.bbc.com/news/world-asia-india-67305557.
3. Press Trust of India, Deepfake Video of Rashmika Mandanna: Delhi Police Registers FIR, Deccan Herald (Nov. 11, 2023), https://www.deccanherald.com/entertainment/deepfake-video-of-rashmika-mandanna-delhi-police-registers-fir-2766561.
4. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, G.S.R. 139(E), Gazette of India, Extraordinary, pt. II sec. 3(i) (Feb. 25, 2021) (India), as amended by The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, G.S.R. 120(E), Gazette of India, Extraordinary, pt. II sec. 3(i) (Feb. 10, 2026) (India) [hereinafter Amendment Rules, 2026], https://egazette.gov.in/WriteReadData/2026/269993.pdf (in force Feb. 20, 2026) [hereinafter IT Rules].
5. Zoya Zafar, Who Owns Your Digital Self? Reimagining Personality Rights in Age of AI Clones, LiveLaw (July 20, 2026), https://www.livelaw.in/articles/reimagining-personality-rights-ai-clones-541953.
6. Phil Swatton & Margaux Leblanc, What Are Deepfakes and How Can We Detect Them?, Alan Turing Inst. (June 7, 2024), https://www.turing.ac.uk/blog/what-are-deepfakes-and-how-can-we-detect-them.
7. Amendment Rules, 2026.
8. IT Rules r. 2(1)(wa) (inserted by Amendment Rules, 2026, r. 2(a)(ii)): “‘synthetically generated information’ means audio, visual or audio-visual information which is artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that such information appears to be real, authentic or true and depicts or portrays any individual or event in a manner that is, or is likely to be perceived as indistinguishable from a natural person or real-world event; Provided that the purposes of this clause, an audio, visual or audio-visual information shall not be deemed to be ‘synthetically generated information’, where such audio, visual or audio-visual information arises from (a) routine or good-faith editing, formatting, enhancement, technical correction, colour adjustment, noise reduction, transcription, or compression that does not materially alter, distort, or misrepresent the substance, context, or meaning of the underlying audio, visual or audio-visual information; or (b) the routine or good-faith creation, preparation, formatting, presentation or design of documents, presentations, portable document format (PDF) files, educational or training materials, research outputs, including the use of illustrative, hypothetical, draft, template-based or conceptual content, where such creation or presentation does not result in the creation or generation of any false document or false electronic record; or (c) the use of computer resources solely for improving accessibility, clarity, quality, translation, description, searchability, or discoverability, without generating, altering, or manipulating any material part of the underlying audio, visual or audio-visual information;”
9. Id. r. 2(1)(wa).
10. Id.
11. Id. r. 2(1)(wa), proviso.
12. The Information Technology Act, No. 21 of 2000, India Code (2000), § 66C.
13. Id. § 66D.
14. Id. § 66E.
15. Id. §§ 67, 67A.
16. The Bharatiya Nyaya Sanhita, No. 45 of 2023, India Code (2023), § 319.
17. Id. § 356.
18. Id. § 351.
19. Amendment Rules, 2026.
20. Aayushman Gaikwad & Smruti Mishra, Three Hours to Comply: India’s New Rules for AI-Generated Content and Deepfakes, LiveLaw (Feb. 21, 2026), https://www.livelaw.in/articles/ai-generated-content-deepfakes-524064.
21. IT Rules r. 3(3)(a)(i); see also id. r. 3(1)(b) (categories of prohibited information), read with id. r. 2(1A) (references to “information” include synthetically generated information).
22. IT Rules r. 3(3)(a)(ii).
23. Id. r. 3(3)(b).
24. Id. r. 4(1A).
25. Id. r. 3(2)(b).
26. India Const. art. 21; Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, ¶¶ 62, 625–636 (India).
27. R. Rajagopal v. State of T.N., (1994) 6 SCC 632 (India).
28. D.M. Entertainment Pvt. Ltd. v. Baby Gift House, 2010 SCC OnLine Del 4790 (India).
29. Id. ¶ 13.
30. Id. ¶ 14.
31. Id. ¶ 14.
32. Titan Industries Ltd. v. Ramkumar Jewellers, 2012 SCC OnLine Del 2382, ¶¶ 8–10 (India).
33. Titan Industries, 2012 SCC OnLine Del 2382, ¶ 15 (quoting Haelan Lab’ys, Inc. v. Topps Chewing Gum, Inc., 202 F.2d 866 (2d Cir. 1953)).
34. Amitabh Bachchan v. Rajat Nagi, 2022 SCC OnLine Del 4110 (India).
35. Id. ¶¶ 20–23.
36. Anil Kapoor v. Simply Life India, 2023 SCC OnLine Del 6914 (India).
37. Id. ¶¶ 42–46, 48.
38. Jaikishan Kakubhai Saraf alias Jackie Shroff v. The Peppy Store, 2024 SCC OnLine Del 3664, ¶¶ 13–24 (India).
39. Jaikishan Kakubhai Saraf, 2024 SCC OnLine Del 3664, ¶¶ 17–22.
40. Arijit Singh v. Codible Ventures LLP, 2024 SCC OnLine Bom 2445 (India).
41. Id. ¶¶ 18–22.
42. Zafar, supra note 5.
43. See Fabian Teichmann, Risk, Reasonableness and Residual Harm under the EU AI Act: A Conceptual Framework for Proportional Ex-Ante Controls, 17 Eur. J. Risk Regul. 611 (2026), https://doi.org/10.1017/err.2025.10077, also available at https://www.researchgate.net/publication/399922202_Risk_Reasonableness_and_Residual_Harm_under_the_EU_AI_Act_A_Conceptual_Framework_for_Proportional_Ex-Ante_Controls.
44. Id.
45. See Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), O.J. L, 2024/1689, 12.7.2024 [hereinafter EU AI Act].
46. EU AI Act arts. 3(13), 9(2)(b); see also Teichmann, supra note 43.
47. See Modern Dental College & Research Centre v. State of Madhya Pradesh, (2016) 7 SCC 353 (India) (proportionality of restrictions on fundamental rights).
48. Provenance means information about the origin and history of a digital file, for example who created or uploaded it, whether AI was used to modify it, what tools were used, the cryptographic credentials or metadata attached to the file, and watermarks or other authenticity signals.
49. Zafar, supra note 5.
50. Id.