Making or sharing a deepfake is not a separately named crime in India, but it is punishable whenever its content or purpose falls within an existing offence: a fake sexual video under Section 67A of the Information Technology Act, 2000 (up to five years and a ₹10 lakh fine, seven years on a repeat conviction), a cloned voice used to cheat under Section 66D of that Act and Section 319 of the Bharatiya Nyaya Sanhita, 2023 (BNS), and a damaging fake clip as defamation or forgery. Since 20 February 2026, the IT Rules as amended by the Ministry of Electronics and Information Technology (MeitY) also regulate “synthetically generated information” directly, with mandatory labels on AI content and a two-hour deadline for removing morphed intimate images after a complaint. A victim should preserve the evidence, report the matter to the cybercrime authorities on cybercrime.gov.in or at a police station, complain to the platform and seek legal advice. As for the question in the title, the IT Act is not enough on its own, but with its 2026 Rules and the BNS it now reaches most deepfake harms; the gaps that remain are assessed at the end of this guide.
Deepfakes and Indian law at a glance
- Is it illegal? There is no offence called “deepfake” and no blanket ban; making or sharing one is punishable when its content or use falls within an offence under the IT Act, 2000, the BNS or the POCSO Act, 2012.
- The 2026 rules: the IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E), 10 February 2026), in force from 20 February 2026, define “synthetically generated information” and require labels and permanent metadata.
- Takedown deadlines: 2 hours after a complaint about intimate, nude, sexual or impersonating content, including artificially morphed images; 3 hours after a court order or an authorised officer’s written intimation; 36 hours for most other removal complaints (such as obscene, impersonating or patently false content).
- Maximum punishment for obscene and sexual deepfakes: sexually explicit material – up to 5 years and ₹10 lakh fine on a first conviction, 7 years and ₹10 lakh on a later one (Section 67A IT Act), the same for material depicting children (Section 67B); obscene material – up to 3 years and ₹5 lakh, 5 years and ₹10 lakh on a later conviction (Section 67).
- Impersonation and fraud: Section 66D IT Act – up to 3 years and ₹1 lakh fine; Section 319(2) BNS (formerly Section 419 IPC) – up to 5 years, or fine, or both.
- Where to report: cybercrime.gov.in (“Report and Track” gives a reference number; child sexual abuse or rape content can also be reported anonymously), helpline 1930 for financial fraud, any police station (Section 173 BNSS), the platform’s Grievance Officer and then the Grievance Appellate Committee within 30 days.
- Courts: the Delhi High Court has restrained AI and deepfake misuse of a person’s name, image, likeness and voice – Anil Kapoor (20 September 2023), Aishwarya Rai Bachchan (9 September 2025), Karan Johar (17 September 2025).
- Still missing: a statutory offence of making a harmful deepfake; the 2026 Rules bind platforms, not creators; the DPDP Act’s duties and penalties start only on 13 May 2027.
Originally written by Chaksham Kumar Das; reviewed and updated by Century Law Firm, Delhi – October 2026. Statutory references are to the Acts and Rules as in force on that date. The IT Act, the BNS, BNSS and BSA, the POCSO Act and the DPDP Act are quoted from India Code, the 2026 amendment of the IT Rules from the Gazette of India and MeitY’s consolidated text, and the court orders from the Delhi High Court’s and the Supreme Court’s own copies.
What is a deepfake? The plain meaning and the legal definition
A deepfake is a photo, video or voice recording created or altered with artificial intelligence so that a real person appears to say or do something they never said or did, or an event that never happened appears genuine. Face-swap videos, cloned voices on phone calls and “morphed” photos that put someone’s face on another body are all forms of it.
No Indian statute uses the word, but since 20 February 2026 the IT Rules, 2021 define “synthetically generated information” (rule 2(1)(wa)) as audio, visual or audio-visual information “which is artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that such information appears to be real, authentic or true” and depicts a person or event as indistinguishable, or likely to be perceived as indistinguishable, from a real one. Because it includes content “modified or altered”, the definition covers a morphed photo as well as a video generated from scratch, and the Rules name “artificially morphed images” expressly (rule 3(2)(b)). Excluded are good-faith editing, colour adjustment or compression that does not materially alter the original’s meaning; good-faith documents, presentations and educational or research material that create no false document or record; and uses solely for accessibility, translation or searchability.
The danger lies in misuse: a fabricated video of a student or professional in a compromising situation can spread through messaging groups within hours; fake sexual images can be made of anyone, often without the victim knowing; a cloned voice of a company head or relative can be used to demand an urgent transfer; and invented clips of politicians or religious leaders can mislead voters or inflame communities.
Is making or sharing a deepfake illegal in India? Is it banned?
There is no blanket ban, and creating synthetic content is not an offence in itself – the 2026 Rules expect lawful synthetic content to be labelled, not removed. A deepfake becomes illegal because of what it shows and what it is used for. The Rules require platforms with AI tools to warn users that creating unlawful synthetic content “may attract penalty or punishment as may be applicable under any law for the time being in force”, naming among others the IT Act, the BNS, the POCSO Act, 2012, the Representation of the People Act, 1951 and the Indecent Representation of Women (Prohibition) Act, 1986 (rule 3(1)(ca)(i)). Sharing is covered as well as making, because most of these offences punish whoever “publishes or transmits”, “disseminates” or “circulates” the material.
Fake nude or sexual images and videos
Sections 67 and 67A of the IT Act punish whoever “publishes or transmits or causes to be published or transmitted” obscene or sexually explicit material in electronic form, so a fake nude or sexual video of a real person can fall under them; Section 294 BNS (formerly Section 292 IPC) also covers obscene content “in electronic form”. Section 66E – publishing “the image of a private area of any person without his or her consent” – may apply, but it was written for real images, and whether it reaches a wholly synthetic image has not been settled by any judgment relied on here. Voyeurism under Section 77 BNS (formerly Section 354C IPC) fits where a real intimate image of a woman is captured or disseminated, for example a genuine intimate photo or video used as the base of a deepfake (an ordinary face photo is not enough), even if she consented to its being taken (Explanation 2); stalking a woman by monitoring her internet use (Section 78 BNS, formerly Section 354D IPC) and intruding upon her privacy (Section 79 BNS, formerly Section 509 IPC) may also apply.
Voice clones, fake video calls and money fraud
A cloned voice of a boss or relative asking for money, or a fake video call by someone posing as an official, fits Section 66D of the IT Act, which punishes whoever “by means of any communication device or computer resource cheats by personating”, and is cheating by personation under Section 319(2) BNS (formerly Section 419 IPC). If money or property is handed over, Section 318(4) BNS (formerly Section 420 IPC) applies, and misuse of someone’s password or “any other unique identification feature” is identity theft under Section 66C. Report money losses at once on 1930; similar scams are explained in our guide to the “digital arrest” fraud.
Fake clips that damage reputation, and fake documents
Defamation under Section 356 BNS (formerly Sections 499 and 500 IPC) covers imputations made “by signs or by visible representations”, which can include a fake video. Because Section 336(1) BNS includes making a “false electronic record”, a deepfake can also be forgery – to harm reputation (Section 336(4), formerly Section 469 IPC) or to cheat, as with a fake bank statement or identity card (Section 336(3), formerly Section 468 IPC) – and using it as genuine is an offence under Section 340(2) (formerly Section 471 IPC). Defamation is non-cognizable, and a court takes it up only on a complaint by the person aggrieved (Section 222 BNSS, formerly Section 199 CrPC), so criminal defamation is pursued by a complaint to a Magistrate, not an FIR; forgery to harm reputation or to cheat (Section 336(4) and (3)) is cognizable. Civil remedies are explained in our guide to defamation law in India.
Threats and blackmail
A threat to release a fake intimate video unless the victim pays is already an offence when it is made: putting a person in fear of injury in order to commit extortion carries up to two years, or fine, or both, and is cognizable (Section 308(3) BNS, formerly Section 385 IPC). If money is actually obtained, it is extortion under Section 308(2) BNS, formerly Section 384 IPC (up to seven years, or fine, or both), whose own illustration is a person who “threatens to publish a defamatory libel concerning Z unless Z gives him money”. Other threats are criminal intimidation under Section 351 BNS (formerly Sections 503, 506 and 507 IPC), with up to seven years for a threat “to impute unchastity to a woman”; criminal intimidation is non-cognizable, so on its own the police need a Magistrate’s order to investigate it (Section 174(2) BNSS).
Fake news, communal clips and false information
Section 353 BNS (formerly Section 505 IPC) punishes whoever “makes, publishes or circulates any statement, false information, rumour, or report, including through electronic means” to cause public alarm, incite one community against another or promote enmity between groups – the main provision against false information online. Section 66A of the IT Act cannot be used: the Supreme Court struck it down in Shreya Singhal v. Union of India on 24 March 2015, it was omitted from the Act with effect from 30 November 2023, and on 12 October 2022 the Court directed that “no citizen can be prosecuted for alleged violation of offence under Section 66A”. As that order requires, readers should note that the provisions of Section 66A have been found by the Supreme Court to be violative of the Constitution of India.
Children
Section 67B of the IT Act covers not only publishing child sexual material but also whoever “creates text or digital images” depicting children in an obscene, indecent or sexually explicit manner – on its words, not only recordings of real abuse. Storing such material is punishable under Section 15 of the POCSO Act, 2012; see our guide to the POCSO Act.
Satire, parody and lawful uses
Films, dubbing, education and clearly labelled AI art remain lawful, and in the Karan Johar case (17 September 2025) the Delhi High Court declined to take down links it regarded as parody, caricature and lampooning while restraining derogatory and obscene misuse. The line is crossed when the content deceives people about who someone is or what they did, invades privacy, is obscene, or is used to cheat, threaten or defame.
Prepared by Century Law Firm from the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023, the POCSO Act, 2012, the IT Rules, 2021 as amended in 2026 and ECI Press Note No. ECI/PN/72/2024.
Does the IT Act, 2000 cover deepfakes?
The Information Technology Act, 2000 was written long before deepfakes and mentions neither them nor artificial intelligence. Its offences are framed in general terms – “any material”, “any communication device or computer resource” – and the Government’s position, in a Rajya Sabha reply published by PIB on 4 April 2025, is that the Act and its rules apply to “any information that is generated using Artificial Intelligence”. So the Act covers deepfakes, but only through its existing offences (Sections 66C to 67B, in the table below) and its rules, not through any offence aimed at deepfakes as such.
Beyond those offences, Section 43 makes a person who without permission accesses a computer or “downloads, copies or extracts any data” from it liable to compensate the person affected; Section 69A lets the Central Government direct the blocking of information on grounds such as public order; and Section 79 gives intermediaries – any person who on behalf of another “receives, stores or transmits” a record, including internet service providers and search engines (Section 2(1)(w)) – a safe harbour from liability for third-party content. That protection is lost if the intermediary, on actual knowledge or government notification, “fails to expeditiously remove or disable access to that material” (Section 79(3)(b)), or does not observe the IT Rules (rule 7) – which is how the 2026 deepfake duties are enforced.
Section 75 applies the Act to an offence committed outside India “by any person irrespective of his nationality” where the conduct “involves a computer, computer system or computer network located in India”. Under Section 77B, offences punishable with three years or more are cognizable and those punishable with three years are bailable, so Sections 66C, 66D and 66E are cognizable and bailable, while Section 67A (five years) is cognizable and is not made bailable by Section 77B. Offences under the Act are investigated by an officer not below the rank of Inspector (Section 78), and a court “shall not compound any offence” committed “against a child below the age of 18 years or a woman” (Section 77A).
Deepfake offences and punishments in India: the table
One deepfake can attract several provisions at once – a fake sexual video used to extort money may involve Sections 67A and 66E of the IT Act and Sections 351 and 308 BNS. The maximum punishments below are as printed in each Act; the firm’s IPC to BNS comparison tool compares each BNS section with the old IPC section. Under the First Schedule to the BNSS, criminal intimidation (Section 351), defamation (Section 356) and the offence in Section 353(1) are non-cognizable: the police cannot investigate them without a Magistrate’s order (Section 174(2) BNSS, formerly Section 155(2) CrPC), unless the case also involves a cognizable offence, in which case the whole case is treated as cognizable (Section 174(4)).
| Provision | What it covers | Maximum punishment |
|---|---|---|
| Section 66C, IT Act | Fraudulent use of another’s password, electronic signature or other unique identification feature | 3 years and fine up to ₹1 lakh |
| Section 66D, IT Act | Cheating by personation using a communication device or computer resource | 3 years and fine up to ₹1 lakh |
| Section 66E, IT Act | Capturing, publishing or transmitting the image of a person’s private area without consent | 3 years, or fine up to ₹2 lakh, or both |
| Section 67, IT Act | Obscene material in electronic form | 3 years and ₹5 lakh; repeat: 5 years and ₹10 lakh |
| Section 67A, IT Act | Sexually explicit material | 5 years and ₹10 lakh; repeat: 7 years and ₹10 lakh |
| Section 67B, IT Act | Material depicting children sexually, including creating such digital images | 5 years and ₹10 lakh; repeat: 7 years and ₹10 lakh |
| Section 15, POCSO Act, 2012 | Storing pornographic material involving a child | Fine of at least ₹5,000 (₹10,000 on repeat) for failing to delete or report with intent to share; 3 years, or fine, or both, if kept to transmit or distribute; 3 to 5 years, or fine, or both, if commercial (5 to 7 years and fine on repeat) |
| Section 77, BNS (formerly Section 354C IPC) | Voyeurism: capturing or disseminating the image of a woman in a private act | 1 to 3 years and fine; repeat: 3 to 7 years and fine |
| Section 78, BNS (formerly Section 354D IPC) | Stalking, including monitoring a woman’s internet use | 3 years and fine; repeat: 5 years and fine |
| Section 79, BNS (formerly Section 509 IPC) | Insulting a woman’s modesty or intruding upon her privacy | 3 years’ simple imprisonment and fine |
| Section 294, BNS (formerly Section 292 IPC) | Obscene material, including content in electronic form | 2 years and ₹5,000; repeat: 5 years and ₹10,000 |
| Section 295, BNS (formerly Section 293 IPC) | Obscene objects to a child | 3 years and ₹2,000; repeat: 7 years and ₹5,000 |
| Section 308(3), BNS | Putting a person in fear of injury in order to commit extortion (the threat itself) | 2 years, or fine, or both |
| Section 308(2), BNS | Extortion (property actually obtained) | 7 years, or fine, or both |
| Section 318(4), BNS (formerly Section 420 IPC) | Cheating and inducing delivery of property | 7 years and fine |
| Section 319(2), BNS (formerly Section 419 IPC) | Cheating by personation | 5 years, or fine, or both |
| Section 336(3), BNS (formerly Section 468 IPC) | Forgery, including of an electronic record, for cheating | 7 years and fine |
| Section 336(4), BNS (formerly Section 469 IPC) | Forgery to harm reputation | 3 years and fine |
| Section 340(2), BNS (formerly Section 471 IPC) | Using a forged electronic record as genuine | As for the forgery itself |
| Section 351, BNS (formerly Sections 503, 506 and 507 IPC) | Criminal intimidation (non-cognizable) | 2 years, or fine, or both; 7 years, or fine, or both, for threats of death, grievous hurt or to impute unchastity to a woman, among others; up to 2 years more if anonymous |
| Section 353, BNS (formerly Section 505 IPC) | False information or rumour causing public mischief or enmity | 3 years, or fine, or both; 5 years and fine in a place of worship |
| Section 356(2), BNS (formerly Section 500 IPC) | Defamation (non-cognizable; complaint by the person defamed) | 2 years’ simple imprisonment, or fine, or both, or community service |
The IT Rules, 2021 as amended in 2026: India’s deepfake regulation
The latest deepfake regulation in India is the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified by MeitY under Section 87 of the IT Act as G.S.R. 120(E) on 10 February 2026 and in force from 20 February 2026 (corrigendum G.S.R. 148(E) of 26 February 2026). They amend the IT Rules, 2021 (G.S.R. 139(E), 25 February 2021) and follow MeitY’s advisory of 26 December 2023 which, in PIB’s words, “targets the growing concerns around misinformation powered by AI – Deepfakes”. The Rules bind intermediaries, not the individuals who make deepfakes, whose liability comes from the IT Act, the BNS and the other laws above.
AI tools on platforms: block unlawful deepfakes, label the rest
An intermediary that “offers a computer resource which may enable, permit, or facilitate” the creation or sharing of synthetic content must deploy “reasonable and appropriate technical measures, including automated tools” so that users cannot create or share unlawful synthetic content – in particular child sexual abuse material, non-consensual intimate imagery and obscene content, false documents or electronic records, material on explosives or arms, and content that “falsely depicts or portrays a natural person or real-world event by misrepresenting, in a manner that is likely to deceive, such person’s identity, voice, conduct, action, statement, or such event as having occurred” (rule 3(3)(a)(i)). All other synthetic content must be “prominently labelled” – on screen, or for audio by “a prominently prefixed audio disclosure” – and embedded, “to the extent technically feasible”, with permanent metadata including a unique identifier of the tool; the intermediary must not enable the label or metadata to be modified, suppressed or removed (rule 3(3)(a)(ii) and (b)).
Large platforms, user warnings and the offender’s identity
A significant social media intermediary must, before content is published, require users to declare whether it is synthetically generated, verify the declaration by technical measures and label content confirmed to be synthetic; if it “knowingly permitted, promoted, or failed to act upon” unlawful synthetic content, it is deemed to have failed in due diligence (rule 4(1A)). It must also use technical measures, with human oversight, to identify depictions of rape or child sexual abuse and exact copies of content already removed on a court order or government intimation (rule 4(4)). Platforms with AI tools must warn users that misuse may lead to removal, suspension of the account and “identification of such user and disclosure of the identity of the violating user to the complainant” where the complainant is the victim, in accordance with applicable law (rule 3(1)(ca)).
How fast must a deepfake be removed?
| What starts the clock | Deadline now | Before 20 February 2026 |
|---|---|---|
| A court order, or a reasoned written intimation from an authorised officer (Joint Secretary level, or not below Deputy Inspector General for the police) stating the legal basis and the URL – rule 3(1)(d) | 3 hours | 36 hours |
| A complaint by the person shown, or someone on their behalf, about content exposing their private area, showing nudity or a sexual act, or impersonating them, including artificially morphed images – rule 3(2)(b) | 2 hours | 24 hours |
| A complaint seeking removal of other prohibited content under rule 3(1)(b), such as obscene, impersonating or patently false content – rule 3(2)(a)(i) | 36 hours | 72 hours |
| Any other complaint to the Grievance Officer – rule 3(2)(a)(i) | Acknowledge in 24 hours; resolve in 7 days | 15 days |
Removed material must be preserved for 180 days (rule 3(1)(g)), and information given to an authorised investigating agency within 72 hours of a written order (rule 3(1)(j)). A person aggrieved by the Grievance Officer’s decision, or whose complaint is not resolved in time, may appeal to the Grievance Appellate Committee “within a period of thirty days”; the Committee works online, at gac.gov.in, and endeavours to decide within thirty calendar days (rule 3A).
What to do if a deepfake of you is posted online
The answer to the common exam question – what legal action can a victim of image morphing or deepfakes take? – is to report the incident to the cybercrime department and seek legal advice. In practice, act on several fronts at once, because the platform’s deadline, the police case and any court case run independently.
Prepared by Century Law Firm from the IT Rules, 2021 as amended by G.S.R. 120(E) of 10 February 2026, the Bharatiya Nagarik Suraksha Sanhita, 2023 and the National Cyber Crime Reporting Portal.
Steps 1 and 2: save the evidence, then complain to the platform
Before asking for removal, record the link (URL) of each post, screenshots showing the account name, date and time, the image or video, chat transcripts and the suspect’s number or profile – the items the National Cyber Crime Reporting Portal itself lists as evidence – and do not forward the content. Then use the platform’s reporting tool or write to its Grievance Officer. If the content shows you nude or in a sexual act, exposes your private area or impersonates you, including artificially morphed images, say so: the platform must take all reasonable and practicable measures to remove it within two hours of a complaint by you “or any person on his behalf” (rule 3(2)(b)).
Step 3: report on cybercrime.gov.in, and call 1930 if money is involved
The National Cyber Crime Reporting Portal (राष्ट्रीय साइबर अपराध रिपोर्टिंग पोर्टल) of the Ministry of Home Affairs has two routes: “Report Crime related to Women/ Child”, for child sexual abuse material and sexually explicit content, and “Report Other Cybercrimes”. Rape or gang-rape content can also be reported anonymously, but it is the “Report and Track” option, which needs registration with your name and a valid Indian mobile number, that gives you a reference number to follow the complaint. A complaint is “handled by the concerned State/UT police authorities” of the State or Union Territory you select, and a registered complainant receives a reference number by SMS and e-mail. “Any victim of financial cyber fraud can dial helpline number 1930” – call at once if money has been taken.
Step 4: lodge an FIR – at any police station, or electronically
Under Section 173(1) BNSS (formerly Section 154 CrPC), information about a cognizable offence may be given at a police station “irrespective of the area where the offence is committed”, orally or “by electronic communication” – the basis of what is called a “zero FIR”, though the Act does not use the phrase. Electronic information is taken on record once you sign it within three days, a copy of the FIR must be given to you free (Section 173(2)), and a woman reporting offences such as voyeurism or stalking has her information recorded by a woman officer. For offences punishable with three years or more but less than seven years, which covers most deepfake offences, the officer may, with a Deputy Superintendent of Police’s permission, first hold a preliminary enquiry of up to 14 days (Section 173(3)). Criminal intimidation and defamation are non-cognizable: a complaint of that kind alone is entered and the informant referred to the Magistrate (Section 174(1)), although a case that also involves a cognizable offence, such as one under Section 67A of the IT Act, is treated as cognizable (Section 174(4)). If the police refuse, send the substance of the complaint in writing by post to the Superintendent of Police, and then apply to the Magistrate (Section 173(4)). Our guide on how to file a police complaint and FIR explains the steps, and in Delhi the police station, ACP and DCP office finder shows where to go. For the firm’s criminal law practice, see criminal lawyer in Delhi.
Steps 5 to 7: appeal, go to court, take advice
If the Grievance Officer rejects the complaint or misses the deadline, appeal to the Grievance Appellate Committee within 30 days (rule 3A). A civil suit can seek an injunction – even against unknown “John Doe” defendants – against use of your name, image, likeness or voice, with orders to platforms to take down links and disclose uploaders’ details or file them with the court, and directions to registrars, MeitY and the Department of Telecommunications to lock domains and block links, as the Delhi High Court has ordered; since 20 February 2026 a platform must act on a court order within three hours of receiving it (rule 3(1)(d)), while the 2023 to 2025 orders below set their own periods. Section 43 of the IT Act gives compensation for unauthorised access to or copying of data, and on 9 February 2026, in a suo motu case on “digital arrest” frauds, the Supreme Court directed MeitY to develop a portal for Section 43 complaints within four weeks; until 13 May 2027, Section 43A also allows compensation from a company or other business (a “body corporate”) whose negligence in protecting “sensitive personal data or information” causes wrongful loss. Which provisions fit, and in what order to use these remedies, depends on the facts, so take legal advice early.
What the courts have said about deepfakes
No Supreme Court judgment on deepfakes was found in the official records checked for this update; the leading orders are from the Delhi High Court.
| Case | Court and date | What it decided |
|---|---|---|
| Anil Kapoor v. Simply Life India & Ors., CS(COMM) 652/2023 | Delhi High Court (Prathiba M. Singh J.), 20 September 2023 | Ex parte ad-interim injunction against use of the actor’s name, likeness, image, voice and persona, including through AI, deepfakes, face morphing and GIFs; domains locked; links taken down and blocked |
| Chaitanya Rohilla v. Union of India, W.P.(C) 15596/2023, with Rajat Sharma v. Union of India, W.P.(C) 6560/2024 | Delhi High Court (Division Bench), orders of 4 December 2023 to 21 November 2024 | Public interest petitions on regulating deepfakes; MeitY’s deepfake committee to consider the petitioners’ suggestions and foreign frameworks and report, preferably within three months |
| Aishwarya Rai Bachchan v. AishwaryaWorld.com & Ors., CS(COMM) 956/2025 | Delhi High Court (Tejas Karia J.), 9 September 2025 | Ex parte injunction protecting personality and publicity rights, including against generative AI and deepfakes; Google to take down URLs within 72 hours; MeitY and DoT to block within 7 days |
| Karan Johar v. Ashok Kumar/John Doe & Ors., CS(COMM) 974/2025 | Delhi High Court (Manmeet Pritam Singh Arora J.), 17 September 2025 | Injunction against commercial misuse of name, likeness, image and voice through AI, deepfakes and face morphing; parody and caricature links left alone |
| People’s Union for Civil Liberties v. Union of India | Supreme Court, 12 October 2022 | No prosecution under Section 66A, struck down in Shreya Singhal v. Union of India (24 March 2015) |
In Anil Kapoor, the Court said that “Using a person’s name, voice, dialogues, images in an illegal manner, that too for commercial purposes, cannot be permitted”, while recognising that free speech about a well-known person stays protected unless it results in tarnishment or jeopardises the person’s personality. In Aishwarya Rai Bachchan, it held that personality rights “entail the right to control and protect the exploitation of one’s image, name, likeness or other attributes” and ordered Google to file the uploaders’ subscriber information in a sealed cover. In Karan Johar – a Delhi High Court case, not a Bombay one as sometimes reported – it held that “derogatory and obscene social media videos, posts and memes would not fall within the domain of fair comment” and directed disclosure of subscriber details and the locking of two domains.
In the public interest petitions, MeitY reported on 21 November 2024 that it had “constituted a committee on the matters related to the issue of Deepfakes vide OM dated 20.11.2024”, and the Bench of Chief Justice Manmohan and Justice Tushar Rao Gedela directed the committee to consider the petitioners’ suggestions and foreign frameworks such as the European Union’s, hear stakeholders such as intermediary platforms, and report preferably within three months. Later hearings are not covered here, and the 2026 notification does not refer to the petitions.
Deepfakes in elections
On 6 May 2024 the Election Commission of India issued Press Note No. ECI/PN/72/2024 on the use of social media in election campaigning, citing among other things the Model Code of Conduct and directing political parties and their representatives to “refrain from publishing and circulating deep fake audios/videos” and to “promptly remove any such content within three hours of bringing it to their notice”. The 2026 Rules now list the Representation of the People Act, 1951 among the laws whose breach through AI tools may be punished (rule 3(1)(ca)(i)), and Sections 353 and 356 BNS apply to election deepfakes as to any others.
Deepfakes and data protection: the DPDP Act, 2023
A person’s face and voice can be personal data – “any data about an individual who is identifiable by or in relation to such data” (Section 2(t) of the Digital Personal Data Protection Act, 2023) – but the Act helps a deepfake victim little today. Its duties on Data Fiduciaries and the Data Protection Board’s penalties (up to ₹250 crore) start only on 13 May 2027, eighteen months after the notification G.S.R. 843(E) of 13 November 2025, with Section 6(9) and Section 27(1)(d) due on 13 November 2026; the DPDP Rules, 2025 (G.S.R. 846(E)) follow the same timetable. Even then, the Act will not apply to “personal data processed by an individual for any personal or domestic purpose” or to data the person concerned has made publicly available (Section 3(c)), so a deepfake made by an individual will mostly remain a matter for the criminal law and civil suits. Until 13 May 2027, Section 43A of the IT Act, which the DPDP Act will omit, remains in force. The underlying right is explained in our post on the right to privacy and the Puttaswamy judgment.
Deepfakes as evidence in court
An electronic record cannot be refused in evidence merely because it is electronic (Section 61 of the Bharatiya Sakshya Adhiniyam, 2023), and its contents may be proved under Section 63 BSA (formerly Section 65B of the Evidence Act): a copy must be accompanied “at each instance” by a certificate in the form in the Schedule, signed by the person in charge of the device “and an expert”, recording the file’s hash value. Interpreting the old Section 65B, the Supreme Court held in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (14 July 2020) that the certificate is a condition precedent for such a copy but unnecessary where the original device is produced and proved by its owner. Admissibility does not settle authenticity: the opinion of an Examiner of Electronic Evidence notified under Section 79A of the IT Act is a relevant fact (Section 39(2) BSA), fabricating a deepfake for use in a case is fabricating false evidence (Sections 228 and 229 BNS, formerly Sections 192 and 193 IPC – up to seven years and a fine of up to ₹10,000 where it is meant for a judicial proceeding), and knowingly using a forged electronic record as genuine is an offence under Section 340(2) BNS. See our guide to electronic evidence and Section 63 BSA.
How the European Union regulates deepfakes
For comparison, the EU’s Artificial Intelligence Act, Regulation (EU) 2024/1689, defines a “deep fake” as AI-generated or manipulated image, audio or video content resembling existing persons, objects, places, entities or events that “would falsely appear to a person to be authentic or truthful” (Article 3(60)). Article 50, which applies from 2 August 2026, requires AI providers to mark synthetic outputs “in a machine-readable format and detectable as artificially generated or manipulated”, and those who deploy AI to create a deep fake to “disclose that the content has been artificially generated or manipulated”, with a lighter duty for evidently artistic, satirical or fictional work. Under Article 111(4), inserted by the amending Regulation (EU) 2026/1744 of 8 July 2026, providers whose systems were already on the market before 2 August 2026 must comply with the marking duty in Article 50(2) by 2 December 2026. India’s 2026 Rules take a similar labelling approach but place the duties on intermediaries rather than on AI providers and users, and add fixed takedown deadlines.
Is the IT Act enough? An assessment
On its own, no. Together with its 2026 Rules, the BNS and the POCSO Act, the law now reaches most deepfake harms: sexual deepfakes carry up to five years (seven on repeat) and must come down within two hours of a complaint; Section 66D and Section 319 BNS fit voice and video clones closely; AI tools offered by intermediaries must block deceptive, intimate and child sexual content and label the rest; and the Delhi High Court has shown that quick injunctions and disclosure of uploaders are available. Real gaps remain:
- No deepfake offence as such. Each case must be fitted into an older provision; Section 66E and Section 77 BNS were written for real images, and a humiliating fake that is not obscene, fraudulent, threatening or defamatory may fall between provisions.
- Duties on platforms, not creators. The 2026 Rules create no offence for the maker, and do not say in terms whether every standalone AI service is an intermediary.
- Cross-border enforcement. Section 75 gives jurisdiction, but prosecuting a creator abroad depends on cooperation that Indian law alone cannot secure.
- Incomplete removal. Deadlines bind the platform that receives the complaint; copies elsewhere need separate action.
- Data protection not yet in force until 13 May 2027, and even then not for purely personal or domestic processing.
- Free speech. Any new offence must be precise: Section 66A, struck down in 2015, shows that speech offences are tested against the Constitution (readers should note that the Supreme Court has found Section 66A violative of the Constitution of India).
In our view, three changes would do most: a clearly defined offence of creating or distributing a deceptive or non-consensual deepfake of a real person, with exceptions for labelled satire, journalism, research and creative work; clear duties for AI providers whether or not they are intermediaries, as Article 50 of the EU Act imposes; and better forensic capacity for police cyber units. Whether Parliament will legislate, and when, is not stated in any official document relied on for this guide.
डीपफेक और भारतीय कानून (Deepfake Law in India) – हिंदी में
डीपफेक ऐसी फोटो, वीडियो या आवाज़ है जिसे आर्टिफिशियल इंटेलिजेंस (AI) से इस तरह बनाया या बदला जाता है कि कोई असली व्यक्ति ऐसा कहता या करता दिखे जो उसने कभी नहीं कहा या किया। भारत के किसी कानून में “डीपफेक” शब्द नहीं है और इस पर कोई सामान्य प्रतिबंध (ban) नहीं है, लेकिन डीपफेक बनाना या शेयर करना तब अपराध है जब उसकी सामग्री या उद्देश्य सूचना प्रौद्योगिकी अधिनियम, 2000 (IT Act), भारतीय न्याय संहिता, 2023 (BNS) या पॉक्सो अधिनियम (POCSO Act), 2012 के किसी अपराध में आता हो – जैसे अश्लील या यौन सामग्री, किसी का रूप धरकर ठगी, मानहानि, जालसाज़ी, धमकी या झूठी सूचना। आगे भेजने (फॉरवर्ड करने) वाला भी अपराधी हो सकता है।
अश्लील डीपफेक पर अधिकतम सज़ा: यौन रूप से स्पष्ट (sexually explicit) सामग्री को प्रकाशित या प्रसारित करने पर IT Act की धारा 67A में पहली दोषसिद्धि पर पाँच वर्ष तक का कारावास और दस लाख रुपये तक का जुर्माना, तथा दूसरी या बाद की दोषसिद्धि पर सात वर्ष तक का कारावास और दस लाख रुपये तक का जुर्माना है। अश्लील (obscene) सामग्री के लिए धारा 67 में पहली दोषसिद्धि पर तीन वर्ष तक का कारावास और पाँच लाख रुपये तक का जुर्माना, तथा बाद की दोषसिद्धि पर पाँच वर्ष तक का कारावास और दस लाख रुपये तक का जुर्माना है। प्रसार के उद्देश्य से अश्लील सामग्री बनाने पर BNS की धारा 294 भी लागू हो सकती है। बच्चों को यौन रूप में दिखाने वाली सामग्री पर धारा 67B में धारा 67A जितनी सज़ा है, और यह धारा ऐसी डिजिटल छवियाँ बनाने (creates) को भी शामिल करती है। बिना सहमति किसी के निजी अंग की तस्वीर प्रकाशित करने पर धारा 66E में तीन वर्ष तक का कारावास या दो लाख रुपये तक का जुर्माना या दोनों हो सकते हैं।
डीपफेक या इमेज मॉर्फिंग का शिकार होने पर क्या करें? परीक्षाओं में पूछे जाने वाले इस प्रश्न का सही उत्तर है – घटना की रिपोर्ट साइबर अपराध विभाग को करें और कानूनी सलाह लें। व्यवहार में: सबूत सुरक्षित रखें (पोस्ट का लिंक, स्क्रीनशॉट, फोटो या वीडियो, चैट) और सामग्री आगे न भेजें; प्लेटफॉर्म के शिकायत अधिकारी (Grievance Officer) से शिकायत करें – प्लेटफॉर्म को निजी अंग, नग्नता या यौन कृत्य दिखाने वाली या रूप धरने वाली सामग्री, कृत्रिम रूप से मॉर्फ की गई तस्वीरों सहित, दो घंटे के भीतर हटानी होती है; राष्ट्रीय साइबर अपराध रिपोर्टिंग पोर्टल cybercrime.gov.in पर शिकायत करें (बाल यौन शोषण या बलात्कार से जुड़ी सामग्री की शिकायत गुमनाम रूप से भी हो सकती है, पर शिकायत संख्या और उसकी स्थिति जानने की सुविधा पंजीकरण वाले “Report and Track” विकल्प में मिलती है) और पैसों की ठगी होने पर तुरंत 1930 पर कॉल करें; भारतीय नागरिक सुरक्षा संहिता, 2023 (BNSS) की धारा 173 के अंतर्गत किसी भी थाने में, अपराध का क्षेत्र कोई भी हो, मौखिक या इलेक्ट्रॉनिक रूप से FIR दर्ज कराएँ (किसी भी थाने में FIR दर्ज कराने को आम तौर पर “ज़ीरो FIR” कहते हैं, हालाँकि अधिनियम में यह शब्द नहीं है); तीन वर्ष या उससे अधिक पर सात वर्ष से कम की सज़ा वाले अपराधों में पुलिस पहले 14 दिन तक प्रारंभिक जाँच कर सकती है (धारा 173(3)); पुलिस मना करे तो पुलिस अधीक्षक (SP) को डाक से लिखित सूचना भेजें और फिर मजिस्ट्रेट के पास जाएँ; प्लेटफॉर्म कार्रवाई न करे तो 30 दिन के भीतर शिकायत अपील समिति (Grievance Appellate Committee) में अपील करें; और ज़रूरत हो तो अदालत से निषेधाज्ञा (injunction) लें।
2026 के नए नियम: IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 को 10 फरवरी 2026 को अधिसूचित किया गया और ये 20 फरवरी 2026 से लागू हैं। AI टूल देने वाले प्लेटफॉर्म को गैरकानूनी डीपफेक – बाल यौन शोषण सामग्री, बिना सहमति की अंतरंग सामग्री, झूठे दस्तावेज, या किसी व्यक्ति या घटना को धोखा देने वाले ढंग से झूठा दिखाना – बनने से रोकना होगा, और बाकी सिंथेटिक सामग्री पर साफ़ दिखने वाला लेबल और स्थायी मेटाडेटा लगाना होगा। अदालत के आदेश या अधिकृत अधिकारी की लिखित सूचना पर गैरकानूनी सामग्री तीन घंटे में (पहले 36 घंटे) और अंतरंग या मॉर्फ की गई सामग्री की शिकायत पर दो घंटे में (पहले 24 घंटे) हटानी होगी। ये नियम प्लेटफॉर्म पर लागू होते हैं; डीपफेक बनाने वाले की ज़िम्मेदारी IT Act, BNS और अन्य कानूनों से तय होती है।
ठगी, धमकी और झूठी सूचना: किसी का रूप धरकर कंप्यूटर संसाधन से ठगी पर IT Act की धारा 66D में तीन वर्ष तक का कारावास और एक लाख रुपये तक जुर्माना है, और BNS की धारा 319(2) (पहले IPC की धारा 419) में पाँच वर्ष तक की सज़ा। फर्जी वीडियो जारी करने की धमकी देकर पैसे माँगना अपने आप में अपराध है (धारा 308(3) BNS, दो वर्ष तक), और पैसा वसूल लेना उद्दापन (extortion, धारा 308(2) BNS, सात वर्ष तक) है; अन्य धमकियाँ आपराधिक अभित्रास (criminal intimidation, धारा 351 BNS) हैं। आपराधिक अभित्रास और मानहानि असंज्ञेय (non-cognizable) अपराध हैं, और मानहानि के लिए पीड़ित को स्वयं मजिस्ट्रेट के समक्ष परिवाद (complaint) देना होता है (धारा 222 BNSS)। जनता में भय फैलाने, एक समुदाय को दूसरे के विरुद्ध भड़काने या समूहों में वैमनस्य पैदा करने वाली झूठी सूचना या अफवाह ऑनलाइन फैलाने पर BNS की धारा 353 (पहले IPC की धारा 505) लागू होती है। IT Act की धारा 66A का प्रयोग नहीं हो सकता: सुप्रीम कोर्ट ने इसे 24 मार्च 2015 को श्रेया सिंघल मामले में रद्द किया और 30 नवंबर 2023 से यह अधिनियम से हटा दी गई है; पाठक ध्यान दें कि सुप्रीम कोर्ट धारा 66A के प्रावधानों को भारत के संविधान का उल्लंघन करने वाला पा चुका है।
क्या IT Act पर्याप्त है? अकेले नहीं। दिल्ली हाई कोर्ट ने अनिल कपूर (20 सितंबर 2023), ऐश्वर्या राय बच्चन (9 सितंबर 2025) और करण जौहर (17 सितंबर 2025) के मामलों में AI और डीपफेक के ज़रिए नाम, छवि और आवाज़ के दुरुपयोग पर रोक लगाई है, और 2026 के नियमों, BNS और पॉक्सो अधिनियम के साथ कानून अब अधिकांश नुकसान को कवर करता है। फिर भी हानिकारक डीपफेक बनाने का अलग अपराध नहीं है, नए नियम प्लेटफॉर्म पर लागू होते हैं, विदेश में बैठे अपराधी तक पहुँचना कठिन है, और डिजिटल व्यक्तिगत डेटा संरक्षण अधिनियम, 2023 (DPDP Act) के कर्तव्य 13 मई 2027 से ही लागू होंगे।
Frequently asked questions
There is no blanket ban and no offence called “deepfake”, but making or sharing one is illegal when its content or use falls within an existing offence: obscene or sexually explicit material (Sections 67 and 67A, IT Act), privacy violation (66E), cheating by personation (66D; Section 319 BNS), defamation, forgery, threats or false information (BNS). Since 20 February 2026, the amended IT Rules also require AI content to be labelled and make platforms with AI tools block content that falsely depicts a real person or event.
The answer expected in exams is: report the incident to the cybercrime department and seek legal advice. In practice: report on cybercrime.gov.in (or call 1930 for money fraud); lodge an FIR at any police station under Section 173 BNSS for the cognizable offences (criminal defamation needs a complaint to a Magistrate); complain to the platform, which must remove intimate or morphed content within two hours, and appeal to the Grievance Appellate Committee within 30 days if it does not; and sue for an injunction and damages.
Save the evidence first – URLs, screenshots showing the account and time, the file and messages – and do not forward it. Complain to the platform’s Grievance Officer, saying if the content is intimate or morphed (two-hour deadline); report on cybercrime.gov.in; lodge an FIR under the IT Act and the Bharatiya Nyaya Sanhita, 2023 (which replaced the IPC); and consider a civil suit. See our guide to filing an FIR.
On its own, no; with its 2026 Rules, the Bharatiya Nyaya Sanhita, 2023 and the POCSO Act, it now reaches most deepfake harms – sexual content, privacy, impersonation, defamation, forgery, threats and false information – and platforms face labelling, blocking and two- and three-hour takedown duties. Gaps remain: no offence of making a harmful deepfake as such, provisions written for real images, rules that bind platforms rather than creators, hard cross-border enforcement, and data protection duties starting only on 13 May 2027.
For sexually explicit material, Section 67A of the IT Act provides up to five years and a ₹10 lakh fine on a first conviction, and up to seven years and ₹10 lakh on a later one. For obscene material, Section 67 provides up to three years and a fine of up to ₹5 lakh, and up to five years and ₹10 lakh on a later conviction. Both punish publishing or transmitting the material; making obscene material for circulation can fall under Section 294 BNS (up to two years, five on repeat). Material depicting children is punished under Section 67B on the Section 67A scale, and that section also covers whoever “creates” such digital images.
अधिकतम सज़ा सूचना प्रौद्योगिकी अधिनियम (IT Act), 2000 की धारा 67A में है: यौन रूप से स्पष्ट (sexually explicit) डीपफेक को प्रकाशित या प्रसारित करने पर पहली दोषसिद्धि पर पाँच वर्ष तक का कारावास और दस लाख रुपये तक का जुर्माना, तथा बाद की दोषसिद्धि पर सात वर्ष तक का कारावास और दस लाख रुपये तक का जुर्माना। अश्लील (obscene) सामग्री पर धारा 67 में पहली दोषसिद्धि पर तीन वर्ष तक का कारावास और पाँच लाख रुपये तक का जुर्माना, तथा बाद में पाँच वर्ष तक का कारावास और दस लाख रुपये तक का जुर्माना है। ये दोनों धाराएँ प्रकाशन या प्रसारण पर लागू होती हैं; प्रसार के उद्देश्य से अश्लील सामग्री बनाने पर BNS की धारा 294 (दो वर्ष तक, बाद में पाँच वर्ष तक) लागू हो सकती है। बच्चों की यौन डिजिटल छवियाँ बनाना भी धारा 67B में अपराध है (सज़ा धारा 67A जितनी)।
सही उत्तर है – घटना की रिपोर्ट साइबर अपराध विभाग को करें और कानूनी सलाह लें। पीड़ित cybercrime.gov.in पर शिकायत कर सकता है और ठगी होने पर 1930 पर कॉल कर सकता है; भारतीय नागरिक सुरक्षा संहिता, 2023 की धारा 173 के अंतर्गत किसी भी थाने में संज्ञेय अपराधों की FIR दर्ज करा सकता है; प्लेटफॉर्म के शिकायत अधिकारी (Grievance Officer) से शिकायत कर सकता है – प्लेटफॉर्म को अंतरंग या मॉर्फ की गई सामग्री दो घंटे में हटानी होती है; और अदालत से निषेधाज्ञा (injunction) तथा हर्जाना माँग सकता है।
It depends on the provision: publishing or sharing sexually explicit deepfakes, up to five years and ₹10 lakh fine, seven on repeat (Section 67A IT Act); cheating by personation, up to three years and ₹1 lakh fine (Section 66D), or up to five years, or fine, or both (Section 319(2) BNS); privacy violation, three years or ₹2 lakh fine or both (Section 66E); forgery to harm reputation, three years and fine (Section 336(4) BNS); defamation, two years’ simple imprisonment, fine or community service (Section 356(2) BNS); a threat made to extort, two years or fine (Section 308(3) BNS); criminal intimidation, two years, or seven for a threat to impute unchastity to a woman, or fine (Section 351 BNS).
Section 66D reads: “Whoever, by means of any communication device or computer resource cheats by personating, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupees.” It fits voice-clone calls, fake video calls and fake profiles used to cheat, and is cognizable and bailable (Section 77B). The same conduct is cheating by personation under Section 319(2) BNS (formerly Section 419 IPC), with up to five years.
Section 66E punishes whoever “intentionally or knowingly captures, publishes or transmits the image of a private area of any person without his or her consent, under circumstances violating the privacy of that person”. The penalty is “imprisonment which may extend to three years or with fine not exceeding two lakh rupees, or with both.” It may apply to fake intimate images, though whether a wholly synthetic image is covered is not settled; Sections 67 and 67A may apply in any case.
The latest is the IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E), 10 February 2026), in force from 20 February 2026. Platforms offering AI tools must block unlawful synthetic content and prominently label lawful synthetic content, with permanent metadata, where technically feasible, that the platform must not let users remove (rule 3(3)); significant social media intermediaries must verify users’ declarations (rule 4(1A)). Takedown deadlines are now three hours after a court order and two hours after a complaint about intimate or morphed images.
The main provision is Section 353 BNS (formerly Section 505 IPC): whoever circulates “any statement, false information, rumour, or report, including through electronic means” to cause public alarm or enmity between groups faces up to three years, or fine, or both, and five years and fine in a place of worship. False content about a person may be defamation (Section 356 BNS). Section 66A of the IT Act cannot be used; readers should note that the Supreme Court has found it violative of the Constitution of India.
It can be. Sections 67 and 67A of the IT Act punish whoever “publishes or transmits or causes to be published or transmitted” obscene or sexually explicit material, so forwarding is covered. Section 66E covers transmitting the image of a person’s private area without consent, and voyeurism under Section 77 BNS includes whoever “disseminates” an image of a woman in a private act. Child sexual material is punishable under Section 67B and the POCSO Act. Do not forward it; report it.
Under the amended IT Rules, a platform must remove unlawful content within three hours of a court order or an authorised officer’s written intimation (36 hours before 2026), and within two hours of a complaint about intimate, nude, sexual or impersonating content, including morphed images. Platforms with AI tools must block unlawful synthetic content and label the rest, and significant social media intermediaries must verify users’ declarations. A platform that ignores the Rules loses its Section 79 safe harbour (rule 7).
The law sets maximum times: two hours after a complaint about intimate, nude or impersonating content, including morphed images; three hours after a court order or authorised government intimation; 36 hours for most other removal complaints, such as obscene or patently false content; and seven days for other grievances. If the platform rejects the complaint or misses the deadline, an appeal lies to the Grievance Appellate Committee within thirty days, online at gac.gov.in (rule 3A). Copies on other services need separate complaints.
Under Section 77B, IT Act offences punishable with three years or more are cognizable and those punishable with three years are bailable: Sections 66C, 66D and 66E are cognizable and bailable, while Section 67A (five years) is cognizable and not made bailable by Section 77B. Under Section 77A, offences punishable with more than three years, and any offence “committed against a child below the age of 18 years or a woman”, cannot be compounded. See our guide to compoundable offences.
Usually through a court or the police. In civil suits the Delhi High Court has directed Google to disclose uploaders’ subscriber details (Karan Johar, 2025) or to file them with the court in a sealed cover (Aishwarya Rai Bachchan, 2025). Every intermediary must give information to an authorised investigating agency within 72 hours of a written order (rule 3(1)(j)). Platforms offering AI tools must also tell users that misuse of those tools may lead, in accordance with applicable law, to “disclosure of the identity of the violating user to the complainant” where the complainant is the victim (rule 3(1)(ca)).
“Morphing” usually means editing or combining existing photos, and “deepfake” content generated with AI, but the law treats them alike. “Synthetically generated information” covers content “created, generated, modified or altered” by computer, and the two-hour takedown rule expressly includes “artificially morphed images” (rule 3(2)(b)). The offences – Sections 66D, 66E, 67 and 67A of the IT Act and the BNS offences of defamation, forgery and intimidation – depend on content and intent, not technique.
Deepfakes are photos, videos or audio clips made or altered with artificial intelligence so that a real person appears to say or do things they never did. Machine-learning software, such as generative adversarial networks (GANs), is trained on real images, video or voice recordings of the person and generates new material in their likeness. Indian law’s closest term is “synthetically generated information” (rule 2(1)(wa) of the IT Rules, from 20 February 2026): content altered or created by computer so that it “appears to be real, authentic or true”.
There is no Act of Parliament on deepfakes; the specific regulation is the 2026 amendment of the IT Rules, in force from 20 February 2026. In public interest petitions before the Delhi High Court, MeitY reported on 21 November 2024 that it had set up a committee on deepfakes, and the Court asked for its report, preferably within three months. No official document relied on here sets a date for a separate statute, so any timeline would be speculation.
No single test is reliable. Possible clues are lip movements that do not match the sound, unusual blinking or expressions, blurred edges around the face, odd lighting or a flat voice – but their absence proves nothing. Look for the label platforms must now attach to synthetic content, check the person’s own verified accounts, verify urgent money requests by calling back on a known number, and have a file examined by a forensic expert if it may be used in court.
The foreign framework checked officially for this guide is the EU’s AI Act (Regulation (EU) 2024/1689). From 2 August 2026, its Article 50 requires AI providers to mark synthetic outputs “in a machine-readable format” (providers whose systems were already on the market have until 2 December 2026, under the amending Regulation (EU) 2026/1744), and those who create a deep fake with AI to disclose it, with a lighter duty for evidently artistic or satirical work. India’s 2026 Rules already require labels but place the duty on intermediaries; a direct duty on AI providers and an express satire exception are points India could consider.
Yes: film effects, dubbing, education, accessibility tools, historical recreations and clearly labelled creative work. The IT Rules do not ban synthetic content but require it to be labelled, and they exclude good-faith editing, translation and educational material from the definition, so long as nothing false is created. The Delhi High Court has also left parody and caricature alone (Karan Johar, 2025). What is unlawful is deceptive impersonation, non-consensual intimate content, fraud and defamation.
Cybercrime cells are specialised police units for technology-related crime. Complaints on cybercrime.gov.in “shall be handled by the concerned State/UT police authorities”, and IT Act offences must be investigated by an officer not below the rank of Inspector (Section 78). A victim can approach a cyber cell, use the portal, or go to any police station, which must record information about a cognizable offence, though for offences punishable with three to seven years it may first hold a preliminary enquiry of up to 14 days (Section 173 BNSS); investigators can require production of devices holding digital evidence (Section 94 BNSS).
Schools and colleges can teach students to recognise synthetic media and its labels; explain that sharing or forwarding sexual deepfakes of classmates is a crime under Sections 66E, 67 and 67A of the IT Act, that humiliating fakes can be defamation or intimidation, and that where the person shown is under 18, Section 67B and the POCSO Act apply; tell students how to report – to the platform, on cybercrime.gov.in or to the police; and adopt clear policies on image-based harassment, preserving evidence rather than circulating it.
AI tools can help, and the law relies on them: significant social media intermediaries must use automated tools to verify users’ declarations and to identify child sexual abuse material (rules 4(1A) and 4(4)), and platforms with AI tools must use them to block unlawful synthetic content (rule 3(3)). No official accuracy figures were found for this guide, and the Rules recognise the limits, requiring human oversight and periodic review of automated tools for “accuracy and fairness” and bias (rule 4(4)).
Yes, and criminal and civil remedies can run together. Lodge an FIR for the cognizable offences, under the IT Act (such as Sections 66D, 66E, 67 and 67A) and the Bharatiya Nyaya Sanhita, 2023, which replaced the IPC (such as Sections 308(3), 319 and 336). Criminal intimidation (Section 351) and defamation (Section 356) are non-cognizable, and criminal defamation is pursued by your own complaint to a Magistrate (Section 222 BNSS). You can also sue for an injunction, takedown and disclosure orders and damages, as the Delhi High Court granted in the Anil Kapoor (2023), Aishwarya Rai Bachchan (2025) and Karan Johar (2025) cases. See our guide to injunctions.
If money has gone, call 1930 or report on cybercrime.gov.in at once and inform the bank; preserve the fake audio or video, call logs, e-mails and transaction records; and lodge an FIR under Section 66D of the IT Act and Sections 318(4) and 319(2) BNS (formerly Sections 420 and 419 IPC). Section 43 of the IT Act allows compensation if systems or data were accessed. Then require call-back confirmation of payment instructions and train staff that a familiar voice on a call is not proof of identity.
Using them is not illegal in itself, and content made for fun or creative work is lawful; a platform offering such tools must label lawful synthetic output (rule 3(3)). What makes use illegal is the content and purpose: sexual images of a real person, impersonation to cheat, defamation, forged documents or threats are offences under the IT Act and the BNS, whichever app is used, and platforms must warn users that misuse can lead to suspension, disclosure of identity to the victim and punishment.
Admissibility and authenticity are separate. An electronic record is not refused merely because it is electronic (Section 61 BSA) and is proved under Section 63 BSA (formerly Section 65B of the Evidence Act), a copy needing a certificate signed by the person in charge of the device and an expert, with the file’s hash value. Whether it is genuine is then decided on the evidence, including the opinion of an Examiner of Electronic Evidence (Section 39(2) BSA). See our guide to electronic evidence.
A private group gives no immunity. Sending obscene or sexually explicit material to a group is transmitting it under Sections 67 and 67A of the IT Act; sending the image of a person’s private area without consent falls under Section 66E; disseminating a voyeuristic image of a woman is an offence under Section 77 BNS; and a defamatory clip shared with others can be defamation. The maker and those who forwarded it may all be liable, and messaging services must give information to authorised investigators within 72 hours of a written order.
Not to deceive. On 6 May 2024 the Election Commission (Press Note No. ECI/PN/72/2024) directed political parties to “refrain from publishing and circulating deep fake audios/videos” and to remove such content within three hours of notice. Since 20 February 2026, platforms with AI tools must block synthetic content that falsely depicts a person or event in a manner likely to deceive, and warn users that misuse may be punished under laws including the Representation of the People Act, 1951. Defamation and public mischief (Sections 356 and 353 BNS) also apply.
A deepfake can be evidence of the offence: the victim proves what was circulated by producing the post or file as an electronic record under Section 63 BSA, and an expert can show it is synthetic. It cannot honestly be evidence of the events it pretends to show. Fabricating a recording for use in a case is fabricating false evidence (Sections 228 and 229 BNS), and knowingly using a forged electronic record as genuine is an offence under Section 340(2) BNS. Disputed authenticity is decided with expert opinion (Section 39(2) BSA).
Being shown in a fake sexual or humiliating video can cause serious distress, fear and shame and damage relationships, studies and work, often worsened because copies resurface. The law tries to limit the harm: intimate or morphed content must be removed within two hours of a complaint; child sexual abuse and rape content can be reported anonymously; a woman’s complaint of voyeurism or stalking is recorded by a woman officer; and IT Act offences against a woman or child cannot be compounded. Support from family, a counsellor or a doctor also matters.
Trace the clip to its first appearance and to the person’s own verified accounts; check for the label and metadata platforms must now attach to synthetic content; compare it with other footage of the event; use reverse image and video searches and detection tools; and consult forensic experts for important stories. Publishing an unverified deepfake carries legal risk: false information causing public alarm or enmity is punishable under Section 353 BNS, and a false clip about a person may be defamation under Section 356 BNS.
Internet service providers are intermediaries under Section 2(1)(w) of the IT Act. The Central Government can direct them to block information under Section 69A, and non-compliance is punishable with up to seven years and fine. Courts direct them too: in Anil Kapoor (20 September 2023) the Delhi High Court ordered all ISPs to take down the listed links. ISPs keep the Section 79 safe harbour only if they observe the due-diligence rules, and must preserve removed content for 180 days.
Deepfakes of well-known people have been challenged as violations of personality and publicity rights, described by the Delhi High Court as the right to control the exploitation of one’s image, name, likeness or other attributes (Aishwarya Rai Bachchan, 2025). In that case and in Anil Kapoor (2023) and Karan Johar (2025), it restrained AI and deepfake misuse and ordered takedowns. Copyright or trade mark questions may also arise on the facts; see our guide to intellectual property rights in India.
Consent matters at several points. Section 66E punishes publishing the image of a person’s private area “without his or her consent”; under Section 77 BNS, a woman’s consent to an image being taken is not consent to its dissemination; the 2026 Rules require AI tools to block “non-consensual intimate imagery”; and the Delhi High Court treats unauthorised use of a person’s likeness or voice as actionable. From 13 May 2027, consent under the DPDP Act must be “free, specific, informed, unconditional and unambiguous” (Section 6(1)). Get clear written permission first.
Recordings, photos and chats are often relied on in matrimonial and custody disputes, and deepfakes make their authenticity a live issue. Electronic records are ordinarily proved under Section 63 BSA, with the certificate where a copy is produced, although a Family Court may receive any material that may assist it to deal effectually with a dispute, “whether or not the same would be otherwise relevant or admissible” under the Evidence Act (Section 14, Family Courts Act, 1984). The other side can dispute a recording and seek expert examination. Fabricating a recording for use in the case is an offence (Sections 228 and 229 BNS), and circulating a fake intimate clip of a spouse can attract Sections 66E, 67 or 67A of the IT Act.
Section 75 of the IT Act applies it to offences committed outside India by any person if the conduct involves a computer or network in India, and the cybercrime portal accepts complaints from Indian citizens victimised by a foreign national or company. The Delhi High Court has directed Google LLC and domain registrars to take down content and to disclose subscriber details or file them with the court (2025). Prosecuting a creator abroad still depends on cooperation from other countries; the formal treaty channels are outside the sources used for this guide.
Talk to children about how shared photos can be misused, keep their accounts private, limit public posting of their images, and make sure they can come to you without blame if someone threatens them. If it happens, do not pay; save the evidence and report it. Section 67B of the IT Act covers even creating sexual digital images of children, and such material can be reported anonymously on cybercrime.gov.in. See our guide to the POCSO Act.
The IT Rules do not mention blockchain. They require provenance: lawful synthetic content made with a platform’s tools must carry a visible label and “a permanent metadata or other appropriate technical provenance mechanisms, to the extent technically feasible, including a unique identifier”, which the platform must not let anyone remove (rule 3(3)). Blockchain-based timestamping is one technique suggested for recording where content came from, but the Rules do not say whether any particular technology satisfies them, so it is a technical choice, not a legal requirement.
Businesses face fraud through cloned voices of executives, brand misuse in fake endorsements and the cost of responding; no official estimate of the overall cost was found for this guide. A defrauded business has remedies under Section 66D of the IT Act and Sections 318 and 319 BNS. A business running a platform with AI tools has duties under rule 3(3) of the IT Rules, and a business (a “body corporate”) handling sensitive personal data must protect it (Section 43A until 13 May 2027, then the DPDP Act); under Section 85 of the IT Act, those in charge of a company can be liable for its contraventions.
Regulation must leave room for legitimate speech. The Delhi High Court has recognised that free speech about a well-known person is protected unless it results in tarnishment (Anil Kapoor, 2023) and left parody untouched (Karan Johar, 2025). The IT Rules exclude good-faith editing and educational material from the definition and require automated tools to be proportionate “having regard to the interests of free speech and expression” (rule 4(4)). Section 66A was struck down in 2015; readers should note that the Supreme Court has found it violative of the Constitution of India.
Section 67B(b) of the IT Act covers anyone who “creates text or digital images”, collects, downloads or distributes material depicting children in an obscene, indecent or sexually explicit manner, with up to five years and a ₹10 lakh fine (seven years on repeat). On its words it reaches the creation of digital images, not only recordings of real abuse, although no judgment applying it to wholly AI-generated images was found for this guide. The 2026 Rules also require AI tools on platforms to block such material.
Only partly, and mostly from 13 May 2027, when the Digital Personal Data Protection Act, 2023’s duties on Data Fiduciaries and the Data Protection Board’s penalties start. Even then it will not apply to processing by an individual for a personal or domestic purpose, or to data the person has made publicly available. Until then, Section 43A of the IT Act allows compensation from a company or other body corporate whose negligence in protecting sensitive personal data causes wrongful loss, and the criminal law and civil suits remain the main remedies.
Conclusion
Deepfakes are not beyond the reach of Indian law. Fake sexual videos, cloned voices used to cheat, fabricated clips that defame or threaten, and false content that stirs public alarm are all punishable under the IT Act, 2000 and the Bharatiya Nyaya Sanhita, 2023, and since 20 February 2026 the amended IT Rules require platforms to block unlawful synthetic content, label the rest and remove morphed intimate images within two hours of a complaint. A victim’s best course is to save the evidence, complain to the platform, report on cybercrime.gov.in or at a police station, and take legal advice early. The IT Act is not enough by itself – there is still no offence aimed at harmful deepfakes as such, and the new duties fall on platforms rather than creators – so until those gaps are closed, protection lies in using the existing provisions quickly and together.
Sources used for this post: the Information Technology Act, 2000 (India Code, as on 27 June 2025); the IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, G.S.R. 120(E) of 10 February 2026 (Gazette of India), the corrigendum G.S.R. 148(E) and MeitY’s consolidated text of the IT Rules, 2021 updated to 10 February 2026; the Bharatiya Nyaya Sanhita, 2023, the Bharatiya Nagarik Suraksha Sanhita, 2023 and the Bharatiya Sakshya Adhiniyam, 2023 (India Code, as on 6 October 2025), with the firm’s Gazette-checked IPC to BNS comparison data; the POCSO Act, 2012, Section 15, and the Digital Personal Data Protection Act, 2023, with the commencement dates of G.S.R. 843(E) as recorded in India Code; the Family Courts Act, 1984, Section 14 (India Code); the DPDP Rules, 2025, G.S.R. 846(E) (MeitY’s copy of the Gazette); the National Cyber Crime Reporting Portal’s home page and FAQ; PIB releases of MeitY of 26 December 2023 and 4 April 2025; ECI Press Note No. ECI/PN/72/2024 of 6 May 2024; the Delhi High Court’s own copies of the orders in Anil Kapoor (20 September 2023), Chaitanya Rohilla and Rajat Sharma (4 December 2023 and 21 November 2024), Aishwarya Rai Bachchan (9 September 2025) and Karan Johar (17 September 2025); the Supreme Court’s own copies of its orders of 12 October 2022 in PUCL v. Union of India (on Section 66A and Shreya Singhal, 24 March 2015) and of 9 February 2026 in In re: Victims of Digital Arrest related to Forged Documents, and Arjun Panditrao Khotkar (14 July 2020) as quoted in its later judgments; and Regulation (EU) 2024/1689, Articles 3(60), 50 and 113, with the amending Regulation (EU) 2026/1744 (Article 111(4)), on EUR-Lex.
