AUTHORED BY – KANISHKAA KUNDU
Sister Nivedita University, Kolkata, West Bengal
ABSTRACT:
This article will explore the efficacy of the laws in India with respect to placing liability on the creation and dissemination of deepfakes using artificial intelligence. The applicable provisions of the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023, the Protection of Children from Sexual Offences Act, 2012 (“POCSO”) and the Digital Personal Data Protection Act, 2023 (“DPDPA”) will be analyzed. On the basis of comparative jurisprudence and regulation, the article will argue that although there are several possible ways through which the laws can be interpreted to provide for deepfake related offences, the lack of a specific technology based law, unclear definitions, difficulties in terms of evidence gathering for an AI related case and intermediary liability rules make the current regime inadequate.
TO THE POINT:
The advent of deepfake technology, which involves the use of artificial intelligence to generate highly realistic videos, audio, and images showing real people in fictional situations, has become one of the most destabilizing technological threats of the digital era. The surge in deepfake pornography, political misinformation, and economic scams involving the creation of fake media in India has underscored the presence of an important regulatory gap. While the provisions of the IT Act and IPC offer some support, there is still a lack of specific laws dealing with deepfakes. This paper analyzes whether India’s current legal framework can tackle criminal responsibility emanating from deepfakes generated via AI technologies.
USE OF LEGAL JARGON:
The analysis of deepfakes liability involves complex jargons of technical and legal nature which require careful understanding. A “deepfake” can be described as the fake media which has been produced using deep learning algorithms or specifically GANs where one’s facial image is pasted on another person. The mens rea or criminal intent plays an important role in establishing liability since the majority of artificial intelligence-based platforms are operated through intermediaries where the issue of liability depends on the actus reus and vicarious liability.
“Non-consensual intimate imagery” (“NCII”) represents those kinds of intimate/deepfake media that have been released without the consent of the individual being portrayed in the video. Another difficulty related to the issue of deepfakes liability lies in locus standi/jurisdiction nexus (“cyber-jurisdiction”), which becomes complicated in case perpetrators are involved in transnational crimes.
The “safe harbor” immunity for intermediaries provided in Section 79 of IT Act becomes crucial for establishing platform liability depending on the due diligence requirement specified in IT Rules, 2021.
THE PROOF:
The evidence regarding the deepfake menace in India is unequivocal. In 2023, Home Security Heroes reported that India was one of the five countries that recorded high incidences of deepfake porn, where the number of deepfakes increased by 550% globally from 2019 to 2023.
There have also been reports on morphed videos in India; for instance, a video morph of actor Rashmika Mandanna was widely condemned in November 2023 due to IT Act violations by MeitY.
There was an emergence of politically motivated fake audio clips involving senior politicians ahead of the 2024 General Elections.
Deepfake technology has also been noted to be exploited in the banking sector by the RBI to commit fraud using synthetic voice and video impersonations to enable KYC bypass and unauthorized transactions.
From the above cases, it is evident that the damage caused by deepfakes cannot be ignored; they are tangible and have not yet been adequately addressed by the law.
STATUTORY PROVISIONS:
1. Information Technology Act, 2000:
- Section 66C (Identity Theft)- Penalizes fraudulent or dishonest use of the electronic signature, passcode or unique identification mark of any other person, punishable with imprisonment up to 3 years and fine up to one lakh rupees. Use of deepfakes in order to pose as others in digital transactions may be caught under this section.
- Section 66D (Cheating by Personation)- Punishes for cheating by impersonating any other person using computer resources, with imprisonment up to 3 years and fine. Applicable in case deepfake videos/sound is used in phishing and impersonation crimes.
- Section 66E (Violation of Privacy)- Punishes the intentional capturing, publishing or transmitting images of any other person’s private parts without his/her consent, with imprisonment up to 3 years or fine up to two lakh rupees. Despite being restricted to visual images only, it can cover some intimate forms of deepfakes.
- Section 67 (Publishing Obscene Material) and Section 67A (Publishing Sexually Explicit Material)- Prescribe imprisonment up to five years and ten years respectively for electronic publication of obscene or sexually explicit content. Deepfake pornography is directly cognizable under these provisions.
- Section 67B- Specifically criminalizes electronic publication or transmission of material depicting children in sexually explicit acts. Deepfake-generated child sexual abuse material (“CSAM”) constitutes an offence under this provision, read with POCSO, 2012.
- Section 79- Grants conditional immunity to intermediaries, subject to the safe harbor doctrine. Under Rule 3(1)(b) of the IT Rules, 2021, intermediaries must not host content that is harmful, defamatory, or impersonates another imposing an obligation relevant to deepfake hosting.
2. Bharatiya Nyaya Sanhita, 2023:
- Section 318 (Cheating)- Applies where deepfakes are used to deceive victims into financial transactions. The element of mens rea and inducement required by the provision can be established where AI-generated impersonation is the modus operandi.
- Section 356 (Defamation)- Criminalizes publication of imputations harming reputation. Deepfakes depicting individuals in compromising or fabricated criminal conduct may constitute defamatory publication in electronic form.
- Section 79- Addresses acts intended to outrage modesty; Section 75 (BNS) concerning sexual harassment may be applicable where deepfake NCII is distributed with intent to humiliate.
3. Digital Personal Data Protection Act, 2023:
The DPDPA mandates lawful processing of personal data, including biometric and facial data used to train deep-fake algorithms. Creation of deepfakes using a person’s biometric data without “consent” as defined under Section 6 of the DPDPA constitutes a violation. However, the Act is civil-regulatory in character and does not create specific criminal liability for deep-fake generation a gap that requires bridging.
4. POCSO Act, 2012:
Section 13 read with Section 14 of POCSO criminalizes use of a child in any form of media for sexual gratification. AI-generated child sexual abuse imagery even if entirely synthetic and depicting no real child is not expressly addressed; however, MeitY’s advisory and POCSO’s purposive construction support criminalization in judicial interpretation.
CASE LAWS:
Indian Jurisprudence:
- Shreya Singhal v. Union of India, (2015) 5 SCC 1
The Information Technology Act, Section 66A, has been found to be unconstitutional due to its vagueness and sweep. Therefore, it is important to be precise when regulating the Internet and it sends a message to us that we should never enact vague and sweeping laws on the subject of deep fakes.
- Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1
Thus, the decision upheld that privacy and identity of individuals are their fundamental rights as per Article 21 of the constitution. Any use of deep fakes through technology would violate the privacy and dignity of the individual since it involves the identity and picture of the individual.
- X v. Union of India & Ors., W.P. (C) No. 413/2024 (Delhi High Court)
The filing of a plea in Delhi High Court by the victim of deep fake morphing resulted in the court ordering the Ministry of Electronics and Information Technology (MeitY) and Government of India to formulate guidelines concerning synthetic media. While Sections 66E and 67A of the law apply, they are insufficient to regulate deep fakes.
- State of Tamil Nadu v. Suhas Katti, (2004)
An example of prosecution under the IT Act in which the defendant had put up non-consensual obscene images on the internet and set a precedent on the application of Section 65B of the Indian Evidence Act of 1872.
Comparative Jurisprudence:
- Elenis v. 303 Creative LLC, 600 U.S. 570 (2023) (U.S. Supreme Court)
Though it was mostly a case of forced speech, it showcased the clash of technological expression and individual rights, which is highly relevant to regulation of deepfakes in democracies.
- Automattic Inc. v. Steiner, (2013) EW Misc 6 (CC) (UK County Court)
One of the earlier court rulings on digital identity abuse, emphasizing that intermediaries should delete abusive impersonation once notified, which is a key aspect of deepfake regulation today.
CONCLUSION:
Though the present Indian law system is not without any remedy, structurally, it lacks the ability to counter all kinds of harms caused by AI-based deepfakes.
Provisions like Section 66C, 66D, 66E, 67, 67A and 67B of the IT Act are limited and insufficient because they are bound with some definitions which will be difficult to apply in cases involving synthesized media content.
Cheating, defamation and sexual harassment laws under the BNS need an interpretive stretch to cover cases of deepfakes.
The DPDPA, although significant, lacks penal consequences for deepfakes creators.
Specifically, the following gaps stand out in the discussion:
First, there is no statutory definition of “deepfake” or “synthetic media” within India’s legal system, which results in the lack of a definite point of reference in terms of doctrine for enforcers and courts.
Second, there is no mention of the threshold for the AI-content detection, which would require the forensic authentication to be admissible by the court, in either IT Act or the Bharatiya Sakshya Adhiniyam, 2023.
Third, the intermediary liability regime under Section 79 and IT Rules, 2021 does not have any obligation for proactive detection.
It is evident that the existing notice and takedown system is wholly unsuitable considering the viral speed at which deepfakes are proliferating.
There is an urgent need for legislative action. It is necessary that the parliament enacts a separate Synthetic Media Regulation Act providing for the following:
- a statutory definition of deepfakes;
- mandatory watermarking and provenance disclosure obligations on AI platforms;
- enhanced criminal penalties for non-consensual deepfake creation and distribution;
- a fast-track removal mechanism with binding intermediary timelines; and
- a designated regulatory authority under MeitY for AI-generated content oversight.
Until such legislation is enacted, the citizens of India, especially women, public personalities, and children are disproportionately vulnerable to the harms that existing law is unable to remedy.
FAQs:
Q1. Is creating a deepfake video a criminal offence in India?
Until now (2024), there is no provision criminalizing the act of making deepfake videos. But based on the video’s content and purpose, the provisions of the IT Act (Section 66C, 66D, 67, 67A), BNS (Section 318, 356), and POCSO can apply. The MeitY’s advice in November 2023 required the removal of deepfakes within 24–36 hours under the IT Rules 2021.
Q2. Can deepfake victims sue platforms hosting such content?
Platforms can benefit from safe harbor immunity if they follow the IT Rules, 2021, under Section 79 of the IT Act. The safe harbor immunity is lost by the platforms in case of non-compliance with the said provision, in the event that the platforms do not take down the deepfake content on receipt of either actual knowledge or an order from the court.
Q3. Is non-consensual deepfake pornography addressed under Indian law?
IT Act Sections 67 and 67A penalize the electronic publishing of obscene material and sexually explicit material, respectively, which are relevant for non-consensual deepfake pornographic imagery. The IPC’s Section 354C (or the 77B NS), relating to voyeurism, could be relevant as well, depending on the nature of the imagery. There is no separate NCII law.
Q4. What evidentiary challenges arise in deep-fake prosecutions?
The electronic evidence generated from deepfake cases needs to be authenticated according to Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (Section 65B, Indian Evidence Act, 1872). AI forensic experts must authenticate that the generated material is indeed artificially generated. Deepfake recognition software, although highly advanced, lacks standardization in the Indian context.
Q5. Does India have any dedicated deepfake legislation?
The country of India lacks any specific law that deals with deepfakes or synthetic media until the month of June 2025. Some regulations have been put forth by MeitY, and it was expected that these issues were to be handled via the Digital India Act, which has yet to be made into a law.
