Published On: July 11, 2026
Authored By: Layan Fathima
CUSAT
Introduction
Artificial Intelligence (AI) is now a major part of everyday life. From content creation and improved business models to educational tools and routine tasks, AI shapes the way we interact with technology. Alongside these benefits, however, new problems have emerged. Chief among them is the growth of deepfakes, digital depictions of video, image, or audio content that closely resemble reality. Over time, a more troubling picture has come into focus: deepfakes have been used to spread false information, damage reputations, facilitate identity theft, generate financial gain through fraud, and manipulate public opinion.
India has seen a marked rise in deepfake incidents in recent years, with celebrities and political leaders frequently at the centre of controversies playing out on social media. This trend raises serious concerns for privacy, public trust, and the authenticity of online content. In response, the Government of India, through the Ministry of Electronics and Information Technology (MeitY), notified amendments to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021[1] on 10 February 2026, which came into effect on 20 February 2026. Through measures including mandatory labelling, traceability requirements, and expedited takedown procedures, the government aims to build a safer digital space while continuing to support technological innovation.
This framework marks a significant step in the evolution of India’s digital governance, and it raises important legal and constitutional questions, particularly around privacy, free speech, and intermediary liability[2] , that remain at an early stage of development. The real value of the new policy will only become clear as these questions are worked through in practice.
The Need to Regulate and Understand Deepfakes
At their core, deepfakes are produced using machine learning models trained on large sets of image, voice, and video data.[3] These models are capable of generating synthetic audio-visual material that closely resembles genuine human footage.
Deepfakes pose risks that go far beyond the generation of fake news. Synthetic images or videos can be used to disgrace individuals, conduct fraud schemes, facilitate identity theft, or create widespread public misinformation and confusion. They also pose a significant risk to democratic governance: a fabricated speech or video released during an election campaign could influence voter behaviour[4] and erode public trust in institutions.
One particularly alarming feature of deepfakes is their exploitation of the public’s trust in visual and audio evidence. Photographs, audio, and video recordings have traditionally been accepted as factual representations of reality; however, advances in deepfake technology mean that content which appears genuine may in fact be artificially constructed. Until 2026, India relied on a combination of the Information Technology Act 2000,[5] intermediary regulations, and general criminal provisions to address online harms of this kind.
Key Characteristics of the 2026 Regulatory Framework
Mandatory Labelling of AI-Generated Content
Perhaps the most significant element of the new regime is mandatory labelling. Social media platforms and other online intermediaries are now required to provide a conspicuous disclosure so that any user viewing synthetic content can identify it as such.
The rationale is primarily one of transparency.[6] Without labelling, users may unknowingly rely on fabricated content when forming judgments, beliefs, or opinions. Labelling ensures that users understand when content has not genuinely been generated by the person it appears to depict.
The rules implicitly acknowledge that artificial intelligence can be put to positive use when properly deployed; however, for labelling to be effective, labels must be both clear and difficult to remove.
The Three-Hour Takedown Rule
Another key component of the new framework is the requirement that certain categories of unlawful deepfake or synthetically generated content be removed within three hours[7] of an intermediary receiving a lawful government or court order or notice. This is a substantial reduction from the 36-hour window that applied under the earlier rules, and it drastically compresses platforms’ response time for the most serious categories of harmful content, with an even shorter two-hour window applying to particularly sensitive material such as non-consensual intimate imagery.
Harmful content can spread rapidly and may be viewed by millions of users before a platform is able to act. Where such content involves non-consensual intimate imagery, financial scams, or misleading political messaging, even a brief delay can have severe consequences for victims or for the public at large.
The rapid-response requirement is intended to prevent wider harm by quickly limiting the reach of unlawful deepfake content. At the same time, the rule has drawn considerable criticism, since determining whether content is genuinely unlawful often requires a nuanced legal and factual assessment that such a short timeframe may not allow. Critics also worry that the three-hour deadline could encourage platforms to remove content pre-emptively, without a thorough review, thereby restricting legitimate speech.[8]
Traceability and Metadata Requirements
The new framework also places considerable emphasis on accountability through traceability and metadata requirements.[9] Platforms are expected to maintain clear logs and records indicating the origin of synthetic media and the technology used to create it.
Anonymously produced deepfakes are often extremely difficult to trace back to a responsible party. Traceability requirements are intended to help investigators and law enforcement determine how fake media was created, making it easier to identify and act against wrongdoers.[10]
Significance of the 2026 Legislation
The 2026 amendments are significant as the first dedicated legal framework to regulate deepfakes in India.[11] The legislation adopts a risk-based approach grounded in transparency, accountability, and the swift removal[12] of dangerous content, seeking to strike a balance between innovation and protection while placing greater responsibility on intermediaries to actively combat the spread of harmful content. Taken as a whole, the legislation represents a meaningful step forward in the governance and liability of digital platforms in India.
Privacy and Data Protection Issues
Central to the entire debate over deepfakes is the unauthorised use of an individual’s image, voice, or personal information, a privacy dimension that remains critically important to the discussion.
India’s data protection framework requires a lawful basis for processing personal data and emphasises informed consent.[13] Using an individual’s personal data to train an AI model without consent will accordingly be treated as a violation. The Supreme Court’s decision in Justice K.S. Puttaswamy (Retd.) v. Union of India[14] affirmed privacy as a fundamental right under Article 21[15] of the Constitution, a right that deepfakes can violate by undermining an individual’s informational privacy, personal integrity, and autonomy through their depiction in fabricated scenarios. The 2026 amendments therefore build on this existing constitutional privacy framework to protect citizens against emerging forms of technological harm.
Free Speech and Constitutional Challenges
Despite its stated aims, the framework has drawn criticism from legal experts, technologists, and free speech advocates alike. While most would agree that deepfakes pose a genuine risk of harm, some are concerned about the framework’s potential effect on freedom of expression.
Article 19(1)(a)[16] of the Constitution guarantees citizens the right to freedom of speech and expression. Not all AI-generated media is malicious; it can equally be used for productive purposes such as comedy, satire, artistic expression, research, education, or political commentary.
Critics argue that strict compliance requirements may push platforms to remove content simply to avoid legal exposure, potentially leading to the improper removal of constitutionally protected expression.[17] This concern is heightened by the three-hour takedown rule, given the limited time available for platforms to act. Smaller platforms, which often lack dedicated legal teams, may be especially likely to remove content pre-emptively rather than conduct a detailed legal assessment. Balancing free speech protections against the need to combat harmful deepfakes therefore remains a significant challenge.
Intermediary Liability and Enforcement Challenges
While the framework is aimed at effective governance of synthetic media, its successful enforcement may be complicated by two significant issues: platform capacity and the pace of technological change. The legislation places substantial obligations on digital platforms[18] to moderate content, apply identification labels, maintain traceability records, and process complaints within the prescribed timeframes. Larger platforms may have the resources needed to meet these compliance standards, but smaller firms may struggle[19] to afford the technology or personnel required to comply. Given the pace of advances in AI, it is also possible that both governments and platforms will struggle to keep up over time.
Comparative Perspective
India’s effort to regulate the production and distribution of deepfakes is not an isolated one. China, for example, has enforced measures[20] requiring explicit labelling of synthetic media, broadly aligning with India’s emphasis on transparent and accountable disclosure. Notably, however, India’s three-hour takedown window for harmful deepfake content is among the shortest currently imposed anywhere in the world,[21] reflecting a particularly rapid and reactive regulatory stance.
Conclusion
The 2026 Deepfake and AI Regulation framework introduced by the Indian government represents a significant step forward in managing the challenges posed by generative artificial intelligence and synthetic media. Its emphasis on core mechanisms, transparency through labelling, traceability for accountability, and the expedited removal of harmful content, reflects a considered approach to mitigating risk while preserving beneficial uses of the technology. At the same time, the framework calls for careful scrutiny of its implications for privacy, freedom of expression, intermediary responsibility, and practical enforcement. Effective policymaking in this area must balance technological innovation with the protection of fundamental rights and democratic principles. The ultimate effectiveness of the 2026 framework will depend on how it is implemented and adapted over time, not as a fixed set of rules, but as a dynamic foundation for India’s evolving approach to AI governance.
References
[1] Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026 (India).
[2] Constitution of India, art 19(1)(a); Constitution of India, art 21.
[3] Robert Chesney and Danielle Citron, ‘Deep Fakes and the New Disinformation War’ (2019) 107 Foreign Affairs 147.
[4] World Economic Forum, ‘Deepfakes and Disinformation’ (2024).
[5] Information Technology Act 2000 (India).
[6] OECD, ‘Artificial Intelligence and Transparency Requirements’ (2023).
[7] Ministry of Electronics and Information Technology, Government of India, Guidelines on the Regulation of Synthetically Generated Information and Deepfakes (2026).
[8] Constitution of India, art 19(1)(a).
[9] Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026 (India).
[10] Law Commission of India reports and cybersecurity policy literature.
[11] Government of India policy documents on AI governance.
[12] OECD, ‘Recommendation of the Council on Artificial Intelligence’ (2019).
[13] Digital Personal Data Protection Act 2023 (India).
[14] Justice K.S. Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.
[15] Constitution of India, art 21.
[16] Constitution of India, art 19(1)(a).
[17] Shreya Singhal v Union of India (2015) 5 SCC 1.
[18] Information Technology Act 2000 (India); Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules 2026 (India).
[19] OECD, ‘Digital Economy Outlook’ (2024).
[20] Measures for the Administration of Internet Information Services Deep Synthesis (China, 2023).
[21] Comparative analysis of global AI and deepfake regulations.
