Author: Seleste Rose Nethagani  |  Edited by: LLM Advocates Team

A video surfaces online showing your CEO endorsing a competitor’s product. A voice recording allegedly captures your company’s confidential negotiations. An image falsely depicts your employee in a compromising situation. All three are fake but by the time you realize it, the damage is already done.

This is no longer science fiction. Deepfake technology has become cheap, accessible and increasingly difficult to detect. For businesses in India, the problem is immediate: deepfakes can destroy reputations, trigger market panic, expose sensitive information and create legal liability all before your legal team has time to respond. Yet India’s legal framework, built largely before synthetic media became a widespread threat, leaves critical gaps in protection.

Public concern around deepfakes intensified in India following the viral circulation of manipulated videos involving public figures and celebrities, including the widely discussed deepfake video involving actress Rashmika Mandanna in 2023. The incident renewed debates around consent, impersonation and the adequacy of India’s cyber law framework.

Understanding where Indian law stands today, and where it’s falling short, is no longer optional for compliance-conscious organizations.

The Problem: Deepfakes and Synthetic Media in India

Deepfakes synthetic media created or manipulated using artificial intelligence techniques like deep learning have moved beyond celebrity face-swaps and meme culture. They’re being weaponized in India for election interference, corporate surveillance, financial fraud, sexual exploitation and harassment campaigns.

The problem complexes because there is no single, coherent statutory framework specifically addressing synthetic media. Instead, courts and regulators are stretching decades-old laws designed for traditional media to cover deepfakes. This creates uncertainty, enforcement delays and, crucially, significant enforcement gaps.

What Does Current Indian Law Actually Cover?

India’s primary legal tools for addressing deepfakes exist across three areas namely criminal law, data protection and platform regulation.

The Criminal Law Approach

The Information Technology Act, 2000 remains the primary federal statute governing digital offences. Section 66D addresses cheating by impersonation in cyberspace, while Section 66E deals with unlawful publication of private images. However, neither provision explicitly contemplates AI-generated synthetic media. Courts have had to interpret these sections broadly to accommodate deepfakes.

More relevant are provisions of the Indian Penal Code (IPC). Section 499 (defamation) and Section 500 (punishment for defamation) can apply to deepfakes that damage reputation, though the plaintiff must typically prove the deepfake was created with intent to harm. Section 509 (outraging modesty through word, sound, gesture or act) has been invoked in cases involving synthetic intimate imagery. Critically, these require proof of mens rea which complicates prosecution where a deepfake spreads virally but its creator’s intent is unclear.

The Bharatiya Nyaya Sanhita, 2023 (BNS), which replaces the IPC from a future date, retains similar provisions under slightly reorganized sections, but does not introduce comprehensive deepfake-specific offences.

Data Protection and Privacy

The Digital Personal Data Protection Act, 2023 (DPDPA) provides limited indirect protection. It governs collection and processing of personal data, but synthetic media creation doesn’t strictly “process” personal data in the traditional sense it creates new, fake content using personal attributes (faces, voices, likenesses). The DPDPA’s applicability to deepfakes remains uncertain and likely requires regulatory clarification. The Information Technology Rules, 2021 (specifically rules around intermediary conduct) impose certain obligations on platforms to remove illegal content, including non-consensual intimate imagery. However, these rules lack deepfake-specific takedown protocols or AI detection requirements.

The Regulatory Landscape: What’s Actually Being Done

India does not currently have a dedicated deepfakes law. However, there are emerging signals.

In May 2023, India’s Ministry of Electronics and Information Technology (MeitY) released a “Responsible AI for All” framework, which acknowledges AI-generated content as a regulatory concern but stops short of prescriptive legal requirements. Some state governments (notably Maharashtra) have issued advisory guidelines on deepfakes in relation to election security, but these lack statutory force.

The Supreme Court has begun addressing deepfakes. In a notable observation in 2024, the Court acknowledged the difficulty of distinguishing authentic from synthetic media and suggested the need for legislative intervention effectively signaling that courts alone cannot solve this problem.

Internationally, India lags behind developing legal responses. The European Union’s AI Act includes provisions on high-risk AI systems, with mandatory conformity assessments for systems used in law enforcement and justice. The UK, US and some other democracies have proposed or enacted deepfake-specific legislation. India has neither.

Where the Law Breaks Down: Practical Implications for Businesses

The absence of clear legislation creates three critical problems for businesses operating in India. A company that discovers a deepfake of its CEO cannot be certain which law applies, what standard of proof is required, or whether a criminal or civil remedy is more practical. A business that hosts user-generated content cannot easily determine what deepfake detection and removal measures are legally required versus recommended. A content creator risks legal jeopardy without knowing the precise boundaries of acceptable synthetic media creation.

Litigation under defamation or obscenity provisions is slow. Civil suits can take 3-5 years in Indian courts. Criminal investigation under the IPC requires police cooperation and competency in technical matters that many police departments lack. Meanwhile, deepfakes spread globally within hours in fact within minutes. By the time a court order is issued, the reputational and financial damage is irreversible. Individuals harmed by deepfakes lack statutory right to speedy takedown. They must either rely on platform terms of service (inconsistently enforced) or pursue expensive litigation. There is no statutory “right to be forgotten” specific to deepfakes, as exists in some EU jurisdictions.

Social media platforms operating in India must comply with IT Rules 2021, but these rules were not written with deepfakes in mind. Platforms struggle with policy questions: Is removing an obviously-fake deepfake a violation of free speech? Can platforms refuse to remove a deepfake shared for political commentary? Must platforms detect synthetic media proactively, or only upon complaint?

The Business Risk: Why This Matters to Your Compliance Strategy

First, reputational risk. A single deepfake of company leadership can trigger stock volatility, customer loss and brand damage before the company can issue a statement or pursue legal action. Insurance coverage for reputational harm from deepfakes is rare and often excludes “cyber” incidents.

Second, IP and trade secret risk. Deepfakes can be used to extract commercial information (falsely recording confidential meetings or negotiations) or to misappropriate brand identity for counterfeit products. The law’s current framework copyright, trade secrets, trademark does not neatly address synthetic infringement.

Third, employment and harassment risk. Synthetic intimate imagery used for harassment or coercion creates liability for employers under sexual harassment laws, even though the employer did not create the deepfake. The law increasingly holds employers responsible for addressing such content in the workplace.

What India’s Regulatory Framework Should Include (And What’s Missing)

Transparency and Disclosure Requirements: Mandating that creators disclose when content is synthetic, particularly in contexts where authenticity matters (elections, finance, news).

Rapid Takedown Procedures: Streamlined processes for victims to request removal, with platform liability for failures to act expeditiously (like the EU’s Digital Services Act).

Technical Standards: Requirements for platforms to implement AI-based detection and labeling of synthetic media, with regulatory oversight of these systems (Something newly introduced on Instagram)

Targeted Criminalization: Specific offences for deepfakes created to incite violence, defraud, sexually exploit or interfere with elections, without blanket criminalization of all synthetic media creation.

Consumer Protection: Explicit protection for individuals against non-consensual intimate imagery, with criminal penalties.

India’s current approach relying on existing criminal and civil statutes is reactive, slow and unevenly applied.

Practical Compliance Steps for Organizations Today

While India develops its legal framework, organizations should not wait. First, adopt an internal deepfake response protocol. Identify your legal team’s lead contact for synthetic media issues, establish procedures for rapid threat detection, and plan communication responses. Have your media and communications team understand the difference between authentic and obvious synthetic content. Second, implement monitoring and detection measures. Simple image reverse-search tools can identify where synthetic content of your company is spreading. More sophisticated AI-based detection tools (still imperfect but improving) exist for organizations with significant digital footprint or stock price sensitivity. Third, audit your data security practices. Deepfakes often require personal data to be created photographs, audio, video. Minimize unauthorized collection and storage of such data through your DPDPA compliance program. Fourth, review your platform and content policies. If you operate a platform or user-generated content service, clarify your policy on synthetic media. Do not assume current moderation tools catch deepfakes they often do not. Fifth, consult on incident response and insurance. Work with your insurer to understand what coverage exists (or does not) for deepfake-related harm. Develop a legal response plan with your counsel before a crisis occurs.

Key Takeaways

  • Indian law does not specifically address deepfakes. Courts are stretching existing criminal and civil provisions, creating uncertainty and enforcement gaps.
  • Liability is unclear. Creators, platforms and victims lack clear guidance on legal responsibilities and remedies.
  • Enforcement is slow. Traditional litigation timelines render legal action ineffective for countering rapidly-spreading synthetic media.
  • Regulatory action is imminent but not yet realized. India’s government and courts acknowledge the problem. New legislation is likely within the next 18-36 months.
  • Businesses face real, immediate risk. Until regulation arrives, organizations must implement their own detection, response and prevention measures.

Looking Forward

India’s silence on deepfakes is temporary, not permanent. The government’s acknowledgment that legislative intervention is needed signals that deepfake-specific regulation is coming. When it does whether through amendments to the IT Act, a standalone law or revisions to the BNS expect requirements around disclosure, platform liability and rapid takedown.

The organizations best positioned when that regulation arrives will be those that have already implemented sound practices, understood their legal exposure, and developed incident response capabilities. The legal landscape may be unclear today. But the business imperative is not.

Keywords

  • Deepfakes India law
  • AI content regulation India
  • Synthetic media legal framework
  • Deepfake legal liability India
  • India deepfake legislation