Introduction
Artificial intelligence has made it possible to fabricate a video, voice, or image so convincing that it becomes indistinguishable from reality within seconds. What began as a novelty in film and entertainment has, in the space of a few years, become a vector for financial fraud, non-consensual intimate imagery, political disinformation, and reputational sabotage. India’s legal system, long anchored in the Information Technology Act, 2000, found itself confronting a category of harm the statute never anticipated: content that is not stolen or defamatory in the traditional sense, but entirely fabricated, and yet capable of causing identical, if not greater, damage. This gap sat at the centre of Indian cyberlaw discourse for several years, with courts relying on borrowed doctrines of privacy, defamation, and personality rights to improvise remedies on a case-by-case basis.
The Government of India addressed this gap directly through the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified on 10 February 2026 and made operative from 20 February 2026. For the first time, Indian law defines and regulates “Synthetically Generated Information” (SGI) as a distinct legal category, imposing a three-hour takedown obligation for the most harmful categories of deepfakes, mandatory labelling of AI-generated content, and expanded traceability duties on intermediaries. This article examines the legal architecture behind this amendment, situates it within the constitutional and judicial developments that preceded it, and critically evaluates whether the new regime achieves a workable balance between platform accountability, victim protection, and free expression.
Legal Framework Governing Synthetic Media in India
Prior to 2026, no Indian statute expressly used the term “deepfake” or “synthetically generated content.” Victims and enforcement agencies had to rely on a patchwork of provisions never designed for AI-generated harms:
The Information Technology Act, 2000 provided the underlying framework of intermediary due diligence (Section 79) and offences relating to identity theft (Section 66C) and impersonation using a computer resource (Section 66D), but these provisions presumed a human actor manipulating existing material, not a machine generating wholly synthetic content. The Bharatiya Nyaya Sanhita, 2023, which replaced the Indian Penal Code, carried forward comparable offences — cheating by personation, forgery, and outraging the modesty of a woman — but again without specific reference to algorithmically generated media. The Digital Personal Data Protection Act, 2023 (DPDP Act) added a layer of protection insofar as biometric or voice data used to train models without consent could constitute unlawful processing of personal data, though it does not address the downstream synthetic output itself. Constitutionally, Article 21’s guarantee of the right to life and personal liberty, as expanded to include the right to privacy in Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1, supplied the doctrinal foundation on which courts built ad hoc remedies against deepfakes even before any dedicated statute existed.
The IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 closes this gap by introducing Rule 2(1)(wa), which defines Synthetically Generated Information as any audio, visual, or audio-visual content that is artificially or algorithmically created, generated, modified, or altered such that it reasonably appears authentic. Within this umbrella, the Rules identify “deepfakes” — impersonation content, fabricated videos or audio, forged documents, and deceptive synthetic news — as a regulated subset attracting heightened obligations. The amendment imposes four principal duties on intermediaries:
First, a mandatory labelling requirement, under which any SGI distributed through an intermediary must carry a visible, permanent label or watermark identifying it as AI-generated, applicable to text, image, audio, and video alike. Second, a three-hour takedown obligation for the narrow category of SGI that is sexually explicit, defamatory, impersonates a real person for fraud, or is likely to incite violence — the shortest statutory takedown window prescribed by any jurisdiction globally. Third, enhanced traceability duties requiring platforms to retain records sufficient to identify the first originator of flagged synthetic content, extending the traceability regime first introduced for messaging platforms under the 2021 Rules. Fourth, a conditional safe harbour under the newly inserted Rule 2(1B), which clarifies that an intermediary’s voluntary removal of SGI, whether through human review or automated classifiers, will not itself be treated as an exercise of editorial control that could jeopardise its safe harbour under Section 79 of the IT Act — a provision evidently designed to avoid the “moderator’s dilemma” that has vexed platforms in other jurisdictions.
Non-compliance carries a specific consequence: an intermediary that fails to label content correctly or misses the three-hour takedown window loses the safe harbour protection under Section 79(2), exposing it to liability as though it had itself created or published the offending material.
The amendment also aligns criminal references from the repealed Indian Penal Code to the Bharatiya Nyaya Sanhita, 2023, so that offences such as cheating by personation, forgery for the purpose of cheating, and the publication of sexually explicit material without consent apply equally where the underlying act or image is synthetically generated rather than merely doctored from real material. This alignment matters because, prior to the amendment, prosecutors often had to argue by analogy that a wholly fabricated image or video still fell within the ambit of provisions drafted with manipulated real photographs in mind. The 2026 Rules remove that interpretive uncertainty by expressly stating that references to information under unlawful-activity provisions include synthetically generated information, effectively closing what commentators had called the authenticity loophole in Indian cyber-criminal law.
A further dimension of the framework concerns children. Where SGI depicts a minor in a sexually explicit or exploitative manner, the amendment requires platforms to apply the same zero-tolerance technical measures already mandated for child sexual abuse material under the 2021 Rules, regardless of whether the depicted minor is real or entirely computer-generated. This closes a particularly dangerous gap, since offenders had previously argued that wholly synthetic depictions of fictitious minors fell outside statutory definitions keyed to actual identifiable children.
Main Analysis: Judicial Foundations and Emerging Case Law
The 2026 Rules did not emerge in a vacuum. Indian courts had already been developing, through common law and constitutional reasoning, the doctrinal tools that the legislature ultimately codified.
The starting point remains R. Rajagopal v. State of Tamil Nadu, (1994) 6 SCC 632, in which the Supreme Court first recognised a common law right to privacy that protects an individual from unauthorised publication of matters concerning their personal life. Although decided decades before generative AI existed, its reasoning — that publication of private facts without consent is actionable independent of truth or falsity — has been repeatedly invoked in deepfake litigation to argue that even fabricated content, if it purports to depict a real person, causes the same dignitary harm as an unauthorised true disclosure.
Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1 elevated privacy to a fundamental right under Article 21, holding that informational privacy — control over the dissemination of personal data and one’s own image — forms part of individual dignity and autonomy. This judgment supplied the constitutional anchor for subsequent High Court orders restraining deepfake misuse, since a synthetic depiction of a person necessarily implicates their control over their own image and likeness.
Shreya Singhal v. Union of India, (2015) 5 SCC 1, though concerned with striking down Section 66A of the IT Act for being unconstitutionally vague, remains directly relevant to the 2026 amendment’s takedown regime. The Court held that any restriction on online speech must be narrowly tailored and provide clear, objective standards to avoid arbitrary censorship. Critics of the three-hour takedown rule have already begun invoking Shreya Singhal’s proportionality framework to question whether “likely to incite violence” is defined with sufficient precision to survive constitutional scrutiny, or whether it repeats the vagueness that doomed Section 66A.
The most direct precursor to the 2026 framework is Anil Kapoor v. Simply Life India & Ors., decided by the Delhi High Court in September 2023. Justice Prathibha M. Singh granted an ex-parte, omnibus injunction restraining sixteen named defendants, and unknown persons at large, from using the actor’s name, voice, image, or likeness through AI tools, face-morphing, or deepfake technology for commercial gain. The Court held that dilution and tarnishment of a celebrity’s persona through such misuse constitute actionable torts, and directly linked personality rights to the privacy jurisprudence of Puttaswamy and Rajagopal. Significantly, the order also directed domain registrars to take down infringing websites, foreshadowing the traceability and rapid takedown obligations that the 2026 Rules would later impose as a general statutory requirement rather than a case-specific remedy. Comparable interim relief was earlier granted to Amitabh Bachchan in 2022 against unauthorised commercial use of his persona, and to singer Arijit Singh by the Bombay High Court in 2024, restraining platforms from using AI tools to mimic his voice and name without consent. Together, these decisions reflect a judiciary that had, by 2024, already accepted personality rights and informational privacy as sufficient grounds to restrain synthetic media misuse, well before Parliament supplied a statutory vocabulary for the harm.
The 2026 Rules have themselves already generated fresh litigation. Pending proceedings in X Corp v. Union of India before the Karnataka High Court examine whether the government’s expanded blocking powers under the amended Rule 3(4), which permits binding takedown directions without a prior public complaint, exceed the procedural safeguards mandated in Shreya Singhal and Anuradha Bhasin v. Union of India, (2020) 3 SCC 637 for restricting online speech. The outcome of this litigation will likely determine the durability of the takedown regime as currently framed.
It is worth noting that Indian courts had, even before any of these celebrity-driven suits, begun extending similar protection to non-celebrities on ordinary tort principles, holding that any individual, and not only a person of public standing, possesses an actionable interest in preventing unauthorised synthetic depictions of their likeness. South Indian superstar Rajinikanth likewise secured interim protection restraining the unauthorised commercial use of his image, voice, and mannerisms, an order frequently cited alongside the Bachchan and Kapoor rulings as forming a consistent judicial trilogy on personality rights in the AI era. Read together, these decisions demonstrate a doctrinal continuity: courts were already treating fabricated depictions as functionally equivalent to unauthorised disclosures of private fact under Rajagopal, and to violations of informational autonomy under Puttaswamy, well before Parliament supplied the vocabulary of “synthetically generated information.” The 2026 Rules can therefore be read less as an innovation and more as a codification of a judicially settled principle, extended for the first time to protect ordinary citizens who lack the resources to obtain an ex-parte celebrity injunction.
Critical Analysis and Evaluation
The IT Amendment Rules, 2026 represent a significant legislative achievement in naming and regulating a harm that Indian law had, until now, only approached obliquely. However, the framework carries several unresolved tensions.
The three-hour takedown window, while protective of victims, imposes a disproportionate compliance burden on smaller intermediaries that lack the round-the-clock legal and technical infrastructure of large platforms. Regional and vernacular platforms, which often serve the very demographic most vulnerable to deepfake-enabled fraud, may struggle to meet this timeline, potentially pushing them toward over-removal of borderline content simply to avoid losing safe harbour — a phenomenon sometimes described as collateral censorship.
The reliability of detection technology remains a genuine constraint. Automated classifiers deployed to identify unlabelled SGI have already misidentified genuine satirical content as synthetic in several reported instances, raising the risk that legitimate parody and political commentary, both protected forms of speech, are swept into the takedown regime alongside genuinely harmful deepfakes. This tension sits uneasily with the proportionality standard the Supreme Court articulated in Shreya Singhal, and is precisely the constitutional question now before the Karnataka High Court.
There is also an accountability gap concerning victim redress. The Rules focus almost entirely on intermediary obligations — labelling, takedown, and traceability — but do not create a standalone compensation mechanism for individuals harmed by deepfakes, leaving victims to pursue civil suits for damages under tort principles borrowed from Rajagopal and the Anil Kapoor line of cases, a route that remains slow, expensive, and inaccessible to most ordinary citizens who are not celebrities with the resources to secure ex-parte injunctions.
Jurisdictionally, the Rules bind intermediaries operating in India, but a significant proportion of generative AI tools and hosting infrastructure used to create and disseminate deepfakes are based overseas. Absent a mutual legal assistance framework calibrated specifically for synthetic media, the three-hour deadline may prove effective against India-facing platforms while doing little to reach the upstream tools generating the content in the first place.
Finally, the overlap between the SGI regime and the DPDP Act, 2023 remains legislatively unclear. Where a deepfake is generated using an individual’s voice or facial data scraped without consent, both statutes are potentially engaged, yet neither cross-references the other, creating uncertainty over which regulator — the Data Protection Board or MeitY — has primary jurisdiction, and under which timeline a complainant should proceed.
A more durable framework would benefit from three reforms: first, a graduated compliance timeline scaled to intermediary size, similar to the SSMI/non-SSMI distinction already used elsewhere in the 2021 Rules; second, an independent appellate or review mechanism to audit contested takedowns, insulating the process from allegations of political misuse; and third, a dedicated, low-cost victim compensation and grievance redressal channel, rather than relying exclusively on civil litigation modelled on celebrity personality-rights suits that are ill-suited to the ordinary citizen.
A related concern is enforcement capacity within the criminal justice system itself. Even where the Bharatiya Nagarik Suraksha Sanhita, 2023 provides a procedural pathway for registering complaints and the Bharatiya Nyaya Sanhita supplies the substantive offence, police stations across India remain unevenly equipped to investigate digitally fabricated evidence, verify provenance metadata, or examine forensic watermarking. Without parallel investment in cyber-forensic training at the state and district level, the statutory three-hour takedown obligation on platforms may outpace the practical ability of law enforcement to actually apprehend and prosecute the individuals who create unlawful synthetic content in the first place, leaving the burden of remedy concentrated almost entirely on private intermediaries rather than shared with the state’s own investigative machinery.
Finally, the labelling mandate itself invites a subtler risk: over time, as SGI labelling becomes routine and visually unobtrusive, users may develop a habituated indifference to the very warning the label is meant to convey, a phenomenon well documented in consumer-protection literature on mandatory disclosure regimes. Regulators would do well to pair the labelling requirement with periodic public-awareness campaigns, as some commentators have already proposed, so that the legal obligation to label synthetic content translates into genuine downstream vigilance among ordinary users rather than a box-ticking exercise for platforms.
Conclusion
India’s IT Amendment Rules, 2026 mark the definitive end of an interpretive era in which deepfake victims had to borrow doctrines of privacy and personality rights never designed for algorithmically generated harm. By formally defining Synthetically Generated Information and attaching enforceable obligations — labelling, rapid takedown, traceability, and a calibrated safe harbour — the amendment gives India one of the most detailed statutory responses to synthetic media anywhere in the world. Yet codification alone does not resolve the underlying tension between rapid content removal and free expression, nor does it guarantee redress for victims who lack the resources of a Bollywood celebrity. The framework’s ultimate legitimacy will be tested not in the text of the Gazette notification, but in how the Karnataka High Court, and the courts that follow, reconcile the three-hour mandate with the proportionality standard laid down in Shreya Singhal, and in whether Parliament follows this intermediary-focused regime with the victim-centred compensation architecture it currently lacks.
References
Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1.
R. Rajagopal v. State of Tamil Nadu, (1994) 6 SCC 632.
Shreya Singhal v. Union of India, (2015) 5 SCC 1.
Anuradha Bhasin v. Union of India, (2020) 3 SCC 637.
Anil Kapoor v. Simply Life India & Ors., CS(COMM) 652/2023, Delhi High Court (order dated 20 September 2023).
The Information Technology Act, 2000.
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, G.S.R. 120(E), notified 10 February 2026.
The Bharatiya Nyaya Sanhita, 2023.
The Digital Personal Data Protection Act, 2023.
LiveLaw, “Deepfakes, Due Diligence and the Good Samaritan Paradox,” available at https://www.livelaw.in/law-firms/law-firm-articles-/deepfakes-due-diligence-indias-2026-it-amendment-rules-resolve-global-platform-liability-debate-530344
Vaish Associates Advocates, “Regulation of AI-Generated/Deepfake Content and Synthetically Generated Information (SGI) In India,” available at https://www.vaishlaw.com/regulation-of-ai-generated-deepfake-content-and-synthetically-generated-information-sgi-in-india/
Mondaq, “IT Rules 2026 Deepfake Regulation: Three Hour Takedowns and AI Labelling Obligations,” available at https://www.mondaq.com/india/new-technology/1760554/it-rules-2026-deepfake-regulation-three-hour-takedowns-and-ai-labelling-obligations
MediaNama, “Understanding India’s Deepfake Content Rules,” available at https://www.medianama.com/2026/04/223-last-call-understanding-india-deepfake-content-rules-april-3/
