Published On: October 15, 2026
Authored By: Vaidehi Pandey
University of Nottingham
Deepfakes gained a great deal of attention when an AI-generated video of Rashmika Mandanna, a popular Indian actress, circulated across social media in November 2023.[1] In October 2025, the Ministry of Electronics and Information Technology (MeitY) announced that deepfakes can be categorised as synthetically generated information (SGI), defined as content that is “artificially or algorithmically created, generated, modified or altered” using a computer resource “in a manner that appears reasonably authentic or true”.[2] If an individual finds a sexually explicit video of themselves that they did not consent to, it is potentially a relevant sexual abuse offence. While Indian law punishes harmful online sexual content, its categorisation is fragmented across privacy, obscenity, voyeurism, sexual harassment, identity and intermediary regulation.[3] This fragmentation creates a gap in the legal system and raises the question: where are victims of deepfake or SGI-created content supposed to seek justice? Does the legal system need to create reforms, or is it able to find sustainable loopholes to protect victims of such abuse?
The primary statute relevant to sexual abuse cases involving adults is the Bharatiya Nyaya Sanhita, 2023 (BNS), which replaced the Indian Penal Code.[4] Section 77 of the BNS criminalises watching, capturing or disseminating an image of a woman engaged in a private act. Explanation 1 covers the capture of an image or video of any act that would not ordinarily be done in public, while Explanation 2 outlines circumstances in which dissemination is an offence even if the victim consented to the capture. However, the crucial difference between voyeurism and deepfakes is that deepfakes are entirely fabricated; the individual did not commit any private act that was captured, and hence voyeurism cannot legally punish this offence. Under section 75, sexual harassment is established when a man, under section 75(1), makes physical contact and advances involving unwelcome and explicit sexual overtures, demands or requests sexual favours, shows pornography against the will of a woman, or makes sexually coloured remarks. In the case of deepfakes, does the legal system expect the creator to have communicated directly with the victim in order to establish sexual harassment? Deepfakes are media circulated online, and in many circumstances women never come across the creator of such content; hence the requirements of section 75 cannot punish the offender in a deepfake case. Deepfake cases are primarily cases that aim to outrage the modesty of the victim. Section 74 of the BNS deals with modesty, stating that “whoever assaults or uses criminal force to any woman, intending to outrage or knowing it to be likely that he will thereby outrage her modesty, shall be punished with imprisonment”. While this section is reliable in cases of sexual violence, digital images do not involve any physical assault or criminal force, so can a law designed around physical conduct adequately respond to sexual violence online?
Minors are also affected by such deepfakes. The Protection of Children from Sexual Offences Act, 2012 (POCSO) was created to deal with instances of sexual abuse faced by minors below the age of 18.[5] Section 11 of POCSO defines sexual harassment of a child, and section 11(v) covers threatening to use, in any form of media, a real or fabricated depiction through electronic or digital means of any part of the body of the child or the involvement of the child in a sexual act. Under section 12, such conduct is punishable with imprisonment of either description for a term which may extend to three years, and the offender is also liable to a fine. On these grounds, one can argue that while the law for adults may not have a section dedicated primarily to fabricated depictions, the law punishing crimes against minors is more elaborate in addressing such events.
However, since deepfakes are an online phenomenon, the Information Technology Act, 2000 (IT Act) must also be consulted.[6] Section 66E, which punishes violation of privacy, applies to any person who “intentionally or knowingly captures, publishes or transmits the image of a private area of any person without his or her consent, thereby violating the privacy of that person”. The legal system depends heavily on legal vocabulary and the intent of the offender. The word “capture” requires a person to have done an act that was captured. A synthetic image cannot involve capturing the victim’s private parts at all; somebody can take an ordinary picture of a person’s face and a random nude body to AI-forge an image that has nothing to do with the woman. Therefore, can a statute against unauthorised capture or transmission successfully protect the rights of an individual when the imagery never physically existed?
Section 67 of the IT Act provides for punishment for publishing or transmitting obscene material in electronic form, and section 67A outlines the punishment for publishing sexually explicit acts online. While the distribution of deepfakes can be treated as a punishable offence under the IT Act, the focus there is not on the violation of the person’s autonomy and identity. A sexually explicit deepfake may be established as harmful and fabricated, but the question is not only whether the circulation of pornography is wrong; it is. What is damaged by the circulation of such content is the non-consensual use of an individual’s identity. Sections 67 and 67A punish circulation, not creation, and it is crucial to notice the distinction, as the circulation of content that is not even true can damage multiple parts of a victim’s life.
However, there is a crucial question that legislation does not answer. What is the law regulating: the dissemination of the content or its creation? The existing provisions can be used to some extent once the content has been published or transmitted, but why aren’t there stronger regulations when the harm begins at the non-consensual sexual appropriation of someone’s identity? An individual’s rights in India are protected by the Constitution. A citizen’s rights to privacy and dignity are protected under Article 21, which guarantees that no person shall be deprived of life or personal liberty except according to procedure established by law. In Justice K.S. Puttaswamy (Retd.) v. Union of India,[7] a retired Karnataka High Court judge challenged the Aadhaar scheme. The Court established that privacy is not just secrecy; it also encompasses autonomy, dignity and control over personal information and personhood. On those grounds, if privacy includes decisional autonomy and control over personal information and identity, isn’t a deepfake a breach of each individual’s constitutional right, even though the sexual act never occurred? The Court laid down a three-fold proportionality test to determine whether a particular state restriction is a breach of privacy.
The IT Rules require all SGI content to be labelled as “AI-generated”, which makes the content traceable through metadata.[8] Platforms are also required to remove unlawful deepfakes or non-consensual explicit images within two to three hours of receiving a court directive. Furthermore, Sections 66C, 66D and 66E criminalise identity theft and AI-based fraud. While these regulations are in place, do they pass the three-fold test? Stage one refers to the legality of such restrictions; deepfake cases do not have a particular legislative statute governing the creation or circulation of such content. Sections 66E, 67 and 67A are laws on violations of privacy and obscenity, and Sections 66C and 66D on identity theft and cheating were not drafted with deepfakes in mind. In Puttaswamy, the Court required “legality” to mean laws that are accessible and precise, which deliver justice without the risk of misinterpretation. However, the fragmented nature of outdated law, when compiled together to create a rule to punish such crimes, creates ambiguity and threatens the authenticity of the legal system. In stage two, the legitimate aim is studied. While a two-to-three-hour window to take down such content may seem fast, these hours are plenty for such content to be downloaded, reposted and shared, and to affect the victim’s life.
Additionally, a critical factor to recognise is India’s governing system: a democracy. Constitutionally, under Article 21, the right to privacy remains a fundamental right of every citizen of India. While the State might use these two-to-three-hour takedown requirements to help victims of deepfakes get justice, it is naturally also able to use them as a method of increasing online policing, shifting significantly from the legitimate aim. While some regulations may have legitimate grounds for success, some laws could lead to the failure of a democratic right. Finally, in the third stage, it can be argued that the legal regulations are under-inclusive and over-inclusive at the same time. They are under-inclusive because they struggle to punish creators and other perpetrators; the victim could get their video taken down from major platforms, but the content that has already circulated has caused damage. When the victim seeks legal justice, they will meet fragmented laws that struggle to trace decentralised AI tools. The regulations are also over-inclusive because these restrictions risk violating the mandates of privacy and speech, prioritising “justice” through aggressive policing.
The Delhi High Court was presented with a case on January 13, 2026, in X & Anr. v. John Doe & Ors.,[9] concerning the hosting and circulation of explicit, morphed and AI-generated content. The names of the individuals involved were kept confidential given the nature of the content. Under Order XXIII Rule 3 of the Code of Civil Procedure, 1908, the defendants agreed to enforce takedown permanently, and keeping a civil suit active after enforcement of the takedown served no practical purpose; however, the psychological and identity damage caused by such cases leaves victims traumatised. Similarly, in Ravi Shankar v. John Doe(s),[10] the Court was able to respond to the AI-generated impersonation of an influential spiritual leader through existing personality rights and privacy jurisprudence, demonstrating that the law is adaptable; however, judicial adaptability does not equate to statutory adequacy. In John Doe cases, the burden is on the plaintiff to prove that the circulation of the content impacts them negatively, but shouldn’t there be a system that can find the creators of such content and hold them accountable, leaving the burden of proof on them?
Deepfakes are more than privacy breaches; they also conflict with one’s personality rights. Courts have started applying more doctrines in their decision-making, such as privacy, dignity, reputation, personality rights, injunctions and intermediary obligations. When AI has been developed to morph face, voice, mannerisms, body and identity, the courts must question why an online tool is able to replicate your likeness. In Titan Industries Ltd. v. Ramkumar Jewellers,[11] Titan sued a local jewellery shop for using Amitabh and Jaya Bachchan’s photographs to advertise. The legal rule established was that personality rights can be claimed when two requirements are met: identification, meaning the defendant used identifiable features of a celebrity, such as their face, image or persona; and commercial gain, meaning the profit made from the advertisement. Similar circumstances arose in Anil Kapoor v. Simply Life India & Ors.,[12] when Anil Kapoor sought protection for his entire persona, including his voice, his body and even his famous tagline “Jhakaas”, against the use of AI tools to make content for commercial profit. However, in deepfake cases involving non-celebrities, the identification stage would not be met, so do these rights adequately protect victims of sexual deepfakes whose primary injury is to dignity rather than commercial loss?
Since deepfakes have such outcomes, what are the responsibilities of online platforms in keeping these problems to a minimum? MeitY held an AI summit to discuss online content regulation, where, in question 21, it discussed which categories of unlawful SGI must be prevented under Rule 3(3)(a)(i) of the IT Rules, 2021: “intermediaries covered under Rule 3(3) must deploy reasonable and appropriate technical measures, including automated tools or other suitable mechanisms to not allow SGI that violates the law.”[13] This specifically ensured that child sexual exploitative and abuse material, non-consensual intimate imagery (NCII), obscene, pornographic, paedophilic or sexually explicit content, and any content that invades bodily privacy would be subject to regulation and stronger intermediary obligations. While these rules came into effect in February 2026, a crucial question remains: why did the Indian regulatory system take more than three years to create such critical rules on SGI content, when the Rashmika Mandanna case came out in 2023 and the relevance of online presence in this day and age was well known?
The legal system may have legislation that punishes offenders for sexual abuse; however, deepfakes are a prominent tool of abuse for which there is no specific regulation punishing creators for their misconduct. Victims may get their content removed, but it is unjust that the compensation for the dignity they lost is limited simply because of loose regulation. One reform that would significantly improve the system is to legally define synthetic sexual imagery. Creating a statutory definition for a crime authenticates not just the legal grounds but also assures victims that their lived experience is validated by the law. Creating a specific offence is necessary when the frequency of such crimes is increasing without consequences. Rather than enforcing a mix of Sections 66E and 67A of the IT Act, the BNS and defamation law, a specific offence for the non-consensual creation or dissemination of sexual deepfakes would help provide justice to victims sooner and significantly reduce the frequency of such cases. Lastly, the primary objective of protecting an individual’s dignity and identity rights requires reducing the time it takes to realise the problem and issue a takedown. The victim should not have to approach the police, the platform and lawyers, and finally appeal to court, to get the content removed from social media. Instead, there should be a rapid takedown mechanism, preservation of evidence to ensure that the damage does not spread further, and notification to the victim that their content is being circulated, so that they are aware of the problem and can quickly approach the police. A limit on repeatedly sharing and uploading content once it has been flagged should also be implemented. Where deliberate re-uploading continues, penalties such as account suspension or monetary fines can help reduce the problem. Hence, one can claim that while the common law is adaptable and has been able to provide some justice to victims to date, the need for reform remains prominent. Justice should not feel like a probability; it should be definite. The judicial system is the backbone of society; if it does not have answers for victims of crimes that impact the fundamental rights of a citizen, then it fails in its duty to protect its citizens.
References
[1] ‘Delhi police arrest techie from Andhra Pradesh for Rashmika Mandanna deepfake video’ The Hindu (21 January 2024) <https://www.thehindu.com/news/cities/Delhi/delhi-police-arrest-techie-from-andhra-pradesh-for-rashmika-mandanna-deepfake-video/article67760419.ece> accessed 17 August 2026.
[2] Ministry of Electronics and Information Technology, ‘Draft Amendments to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 relating to Synthetically Generated Information’ (22 October 2025) <https://www.meity.gov.in/static/uploads/2025/10/065b6deb585441b5ccdf8be42502a49c.pdf> accessed 19 August 2026.
[3] GNS Legal, ‘Unmasking Deepfakes: Legal Risks and Remedies in India & Beyond’ (2025) <https://www.gnslegal.in/unmasking-deepfakes-legal-risks-and-remedies-in-india-beyond/> accessed 19 August 2026; Biranchi Narayan P. Panda and Isha Sharma, ‘Deepfake Technology in India and World: Foreboding and Forbidding’ (Law and Humanities Quarterly Reviews, 16 July 2025) <https://www.asianinstituteofresearch.org/lhqrarchives/deepfake-technology-in-india-and-world%3A-foreboding-and-forbidding> accessed 19 July 2026.
[4] Bharatiya Nyaya Sanhita 2023, ss 74, 75, 77 <https://www.mha.gov.in/sites/default/files/250883_english_01042024.pdf> accessed 18 August 2026.
[5] Protection of Children from Sexual Offences Act 2012, ss 11, 12.
[6] Information Technology Act 2000, ss 66C, 66D, 66E, 67, 67A, 79 <https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf> accessed 18 August 2026.
[7] Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1.
[8] Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (as amended); Khurana & Khurana, ‘Deepfake Regulation in India 2025: MeitY’s Comprehensive IT Rules Amendment’ (2025) <https://www.khuranaandkhurana.com/deepfake-regulation-india-2025-meity-s-comprehensive-it-rules-amendment> accessed 18 August 2026.
[9] X & Anr. v. John Doe & Ors. CS(OS) 33/2026 (Delhi HC, 13 January 2026).
[10] Ravi Shankar v. John Doe(s)/Ashok Kumar(s) CS(COMM) 889/2025, 2025 SCC OnLine Del 6332 (Delhi HC, 26 August 2025).
[11] Titan Industries Ltd. v. M/s Ramkumar Jewellers 2012 SCC OnLine Del 2382, (2012) 50 PTC 486 (Del).
[12] Anil Kapoor v. Simply Life India & Ors. 2023 SCC OnLine Del 6914 (Delhi HC, 20 September 2023).
[13] Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, r 3(3)(a)(i) (as amended).
