Published on: 9th July 2026
Authored by: Divya Soni
Jaipur National University
Abstract
This article provides a critical analysis of India’s evolving legal framework governing deepfakes and artificial intelligence-generated synthetic media between 2025 and 2026.[1] As deepfakes expand from simple facial manipulation to complex voice cloning and full-body movement synthesis, they present serious challenges to public safety, electoral integrity, and individual privacy rights.[1][2][3] This study evaluates the current landscape, examining the gaps within Section 79 of the Information Technology Act, 2000, and the introduction of Sections 320 and 336 of the Bharatiya Nyaya Sanhita, 2023.[10] By assessing these domestic provisions alongside constitutional principles established in landmark rulings like Puttaswamy and Shreya Singhal, the paper highlights the tension between regulatory enforcement and free expression under Article 19(1)(a).[4][5] Finally, it offers a tiered model for platform liability calibration, automated content moderation standards, and cross-border institutional cooperation to build a comprehensive, rights-conscious regulatory framework for the digital era.
I. Introduction
Synthetic media generated through artificial intelligence, commonly known as deepfakes, allow for the creation of realistic digital manipulations that depict individuals engaging in actions or uttering statements that never occurred.[1] These deceptive fabrications rely on sophisticated deep learning architectures that map facial characteristics, vocal frequencies, and full-body behavioral movements with high precision.[1] One common methodology utilizes Generative Adversarial Networks (GANs), which pit a generative system against a discriminative system to refine the forgery until it becomes virtually indistinguishable from authentic footage.[1] Another approach leverages autoencoders to reconstruct human expressions by extracting patterns from extensive datasets of authentic imagery.[1] Statistical data highlights the rapid expansion of this technology, showing that a global volume of fifteen thousand clips recorded five years ago has grown into millions of synthetic fabrications generated annually.[1] This acceleration stems from the democratization of open-source creation tools and a sharp decline in computational costs, allowing users without specialized technical expertise to generate high-fidelity forgeries on consumer-grade hardware.[1] Consequently, the traditional reliance on visual verification has been undermined, creating a landscape where seeing is no longer believing.[1]
With an online population exceeding 900 million users, India’s digital ecosystem is highly vulnerable to the rapid spread of synthetic misinformation.[2] During the 2024 Maharashtra legislative elections, a deepfaked video of a senior political leader accumulated 2.3 million views via WhatsApp within forty-eight hours, falsely depicting him making inflammatory statements that caused localized civil unrest across three distinct administrative districts.[2] Similarly, non-consensual intimate imagery (NCII) deepfakes targeting women have proliferated across encrypted communication networks.[3] Reports from the National Center for Missing & Exploited Children (NCMEC) India Division indicate that over fifty thousand cases were documented, primarily impacting women between the ages of eighteen and thirty-five, causing severe psychological trauma, social ostracization, and career disruption.[3] Despite watchdogs identifying forty-seven distinct deepfake interventions during election cycles, only eight led to formal legal penalties, illustrating a wide enforcement gap.[10] India currently lacks a comprehensive, unified statute dedicated to regulating synthetic media, leaving prosecutors dependent on fragmented provisions like Section 336 of the Bharatiya Nyaya Sanhita, 2023, which often falls short when dealing with advanced digital manipulations.[10]
II. Existing Legal Framework: Fragmentation and Critical Gaps
India’s current strategy for regulating deepfakes relies on a patchwork of legacy laws enacted before the advent of advanced generative artificial intelligence. The Information Technology Act, 2000 (IT Act) provides basic mechanisms to counter digital impersonation under Section 66C, which mandates a maximum three-year prison term and a fine of up to 100,000 rupees for identity theft.[10] However, prosecuting cases under Section 66C requires proving fraudulent or dishonest intent, a high evidentiary standard that is difficult to meet when deepfakes are used for targeted harassment, reputational damage, or ideological subversion without a direct financial motive.[10] Similarly, Section 66D of the IT Act penalizes cheating by personation using computer resources, but its application remains limited to scenarios involving tangible economic fraud.[10] Because these provisions focus heavily on commercial scams, they struggle to address generative forgeries designed primarily to cause social chaos, erode institutional trust, or inflict emotional distress.[10]
The introduction of the Bharatiya Nyaya Sanhita, 2023 (BNS) represents an early attempt to update the penal code for the digital age. Identity deception is addressed under Section 320, while Section 336 explicitly brings the creation and distribution of malicious synthetic media under criminal liability, making India an early adopter of direct deepfake regulations among major democratic nations.[10] Section 336 prescribes a maximum five-year term of imprisonment and a fine of up to 500,000 rupees for individuals who forge or disseminate altered digital images or videos to deceive, insult, or injure a citizen.[10] However, the statutory language lacks judicial clarity regarding non-commercial, consensual parodies or deepfakes created with the subject’s permission.[10] Ambiguities also persist regarding whether secondary sharers, who forward a deepfake without explicit knowledge of its synthetic nature, can be held liable under the current definition of criminal intent.[10]
Furthermore, while unauthorized biometric harvesting and facial scanning violate data protection standards under the Digital Personal Data Protection Act, 2023, its regulatory mechanisms apply only during the initial collection phase, failing to provide remedies once a dataset has been transformed into a new synthetic output.[10] On the intermediary front, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, require platforms to remove clearly unlawful content within thirty-six hours of notification.[5][10] This approach faces practical limitations, as analytical data shows that eighty-nine percent of viral deepfake campaigns achieve peak reach within the first twelve hours of upload.[10] Consequently, reactive removal processes provide little remedy, operating as an administrative fix after widespread reputational or social damage has already occurred.[10]
III. Constitutional Tensions and Enforcement Realities
The regulation of generative AI sits at the center of complex constitutional tensions between individual privacy rights and protected freedoms of speech. Although not explicitly textually stated, the right to privacy was recognized as a fundamental constitutional guarantee under Article 21 by a nine-judge bench in Justice K.S. Puttaswamy v. Union of India.[4] The Court ruled that informational privacy, bodily autonomy, and control over one’s personal identity are essential components of human dignity.[4] Non-consensual deepfakes, particularly explicit fabrications, directly violate these principles by stripping individuals of control over their digital identities and inflicting severe dignity harms that go far beyond simple data misuse.[3][4]
Conversely, broad anti-deepfake regulations risk infringing upon the right to free expression guaranteed under Article 19(1)(a). Overly broad legal definitions can inadvertently suppress legitimate creative expressions, including political satire, digital art, cinematic visual effects, and educational research tools.[10] In Shreya Singhal v. Union of India, the Supreme Court established that digital intermediaries are protected under safe harbor doctrines and cannot be held liable for user-generated content unless they possess actual knowledge via a formal judicial or administrative order.[5] Mandating proactive, automated deepfake filtering systems could force intermediaries to over-censor user uploads to avoid corporate liability, violating the proportionality standards set in Anuradha Bhasin v. Union of India, which require that state-imposed restrictions on speech be narrow, necessary, and cause the least possible harm to constitutional freedoms.[6]
Developing effective enforcement mechanisms requires clear rules that separate harmful fabrications from safe digital creations. Current deepfake detection software operates with an approximate ninety percent accuracy rate under controlled testing conditions, but this drop below seventy-five percent when facing advanced anti-forensic techniques, making it difficult to establish definitive proof of manipulation in court.[7] Identifying the original creators also remains a major challenge, as malicious actors frequently use encrypted routing protocols, decentralized platforms, and cross-border hosting networks to evade detection, causing prolonged delays in international law enforcement cooperation while the targeted content continues to spread online.[10]
IV. Platform Liability and Safe Harbour Recalibration
The traditional safe harbor framework established under Section 79 of the IT Act struggles to contain the rapid spread of generative forgeries.[5] Because deepfakes can achieve massive viral reach within a twelve-hour window, the standard thirty-six-hour removal timeline under current intermediary guidelines is often too slow to prevent widespread damage.[5][10] Furthermore, because platforms are not legally required to monitor content proactively, their recommendation algorithms often amplify sensational synthetic media due to high user engagement, allowing harmful fabrications to spread widely before a formal take-down order is issued.[10] This problem is worsened by rigid legal categories that fail to differentiate between different types of synthetic media, treating non-consensual explicit deepfakes and minor political parodies under the same procedural framework.[10]
Relying solely on automated screening systems also introduces significant risks of algorithmic bias and over-censorship. Research into automated content moderation systems shows that computer vision algorithms exhibit high error rates when analyzing overlapping demographic indicators, which can lead to the disproportionate silencing of minority voices and public interest whistleblowers.[8] Automated moderation tools deployed by major platforms have been found to flag content critical of state institutions at significantly higher rates than content produced by powerful political entities, turning automated safety checks into tools for censorship.[8] To address these risks, India needs a recalibrated safe harbor framework that establishes tiered removal timelines based on the severity of the harm: a strict twelve-hour window for non-consensual intimate imagery, a twenty-four-hour timeline for verified electoral misinformation during active voting cycles, and a thirty-six-hour standard for general complaints, alongside requiring large intermediaries to deploy localized detection models capable of maintaining low error rates.[10]
V. Comparative Approaches and Regulatory Recommendations
International approaches to regulating generative artificial intelligence offer useful models for domestic policy. The European Union AI Act organizes applications by risk levels, applying light transparency rules to benign creative media while imposing strict human oversight, mandatory risk documentation, and clear watermarking requirements on high-risk synthetic modifications that threaten public welfare or civil rights.[10] In contrast, the United States lacks a unified federal deepfake statute, relying instead on state-level legislation where twenty-one states have criminalized non-consensual explicit deepfakes with penal terms of up to five years, highlighting a growing consensus around targeting specific harms rather than the underlying technology.[10]
India can benefit from a hybrid model that combines targeted criminal provisions with global technical standards. A new specialized statute should clearly define synthetic media as any digital asset generated or modified via artificial intelligence that realistically depicts an individual engaging in behavior they did not perform, using a standard based on whether the output would deceive a reasonable observer.[10] Penalties should scale with the severity of the harm, applying a maximum five-year sentence for reputational defamation and up to ten years for deepfakes targeting electoral processes, public health infrastructure, or non-consensual explicit media, while maintaining clear exemptions for satire, artistic expression, and academic research provided the content is clearly labeled as synthetic.[10] Intermediaries must also be required to integrate standard cryptographic provenance frameworks, such as the Coalition for Content Provenance and Authenticity (C2PA) protocol, to ensure transparency and accountability.[10]
To support enforcement, India should establish a specialized agency within the Ministry of Home Affairs, staffed with digital forensics experts to standardize evidence collection and provide qualified testimony in court, while coordinating with international bodies like Interpol to trace cross-border digital operations.[10] The judiciary should also be empowered to issue ex-parte injunctions within seventy-two hours to halt the viral spread of harmful deepfakes before a full trial.[10] Finally, the Ministry of Information and Broadcasting should implement national digital literacy campaigns to train citizens in basic media verification techniques, such as reverse-image searching and spotting visual inconsistencies, which research shows can significantly reduce public vulnerability to digital deception.[10]
VI. Conclusion
India is at a critical juncture in shaping its digital governance framework. The rapid spread of malicious deepfakes has caused documented harm to personal reputations, electoral integrity, and public trust, showing that the dangers of synthetic media are a present reality rather than a distant concern.[2][3] However, rushing to criminalize all forms of synthetic media could give state authorities excessive power to suppress political dissent and creative expression.[10] A balanced regulatory framework must target high-impact harms like non-consensual explicit media, electoral subversion, and public health misinformation without restricting technological innovation or free speech, guided by constitutional principles of privacy, proportionality, and freedom of expression.[4][6][10]
While Section 336 of the BNS is an encouraging initial step, a patchwork of legacy laws is insufficient to address the unique challenges of generative artificial intelligence.[10] India requires a specialized, agile legal framework built specifically for digital realities, combining technical forensic tools with clear administrative processes and international enforcement cooperation.[10] As the country refines its approach between 2025 and 2026, it has the opportunity to help build global models for AI governance, proving that digital security and constitutional freedoms can be protected together through balanced, comprehensive legislation.[10]
References
[1] Sensity Ltd., Deepfakes Detection Report 2024: The Democratization of Synthetic Media (2024).
[2] Maharashtra Election Commission, Incident Report on Synthetic Media Manipulation during the Legislative Assembly Elections, Ref. ECM/2024/DFK-847 (Mar. 2024).
[3] National Center for Missing & Exploited Children (NCMEC) India Division, Quarterly Analytical Report on Non-Consensual Intimate Imagery Abuse (Q2 2024).
[4] Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1.
[5] Shreya Singhal v. Union of India, (2015) 5 SCC 1.
[6] Anuradha Bhasin v. Union of India, (2020) 3 SCC 637.
[7] Y. Li et al., Exposing Deep Fakes Using Inconsistent Head Poses, IEEE International Conference on Acoustics, Speech and Signal Processing (2025).
[8] Joy Buolamwini & Timnit Gebru, Gender Shades: Intersectional Accuracy Disparities in Commercial Gender Classification, 81 PROC. MACHINE LEARNING RES. 1 (2018).
[9] Information Technology Act, 2000, No. 21 of 2000, India Code (2000).
[10] Bharatiya Nyaya Sanhita, 2023, No. 45 of 2023, India Code (2023).
