Author: Beena Gaur, LL. B student, Hari Sahay law college Talkandala, Gorakhpur
LinkedIn profile: https://www.linkedin.com/in/beena-gaur-b91469343
Abstract
A few years ago, deepfakes were largely viewed as a technological novelty, often used for entertainment purposes. That novelty has worn off fast. Today, the same technology is being used to clone a CFO’s voice and authorize a wire transfer, to put a politician’s face on a speech they never gave, and, most disturbingly, to manufacture non-consensual explicit images of real people. The rapid advancement of Artificial Intelligence (AI) has transformed various aspects of modern society. One of the most controversial developments is Deepfake Technology, which utilizes artificial intelligence and machine learning algorithms to create highly realistic but fabricated audio, video, and image content. While deepfakes have legitimate applications in entertainment, education, and digital communication, their misuse poses significant legal and ethical concerns. Deepfakes have been increasingly used for identity theft, cyber fraud, misinformation, defamation, political manipulation, and non-consensual explicit content. India, being one of the largest digital economies, faces growing challenges in regulating such technology. This article examines the concept of deepfakes, their legal implications, the existing legal framework in India, relevant judicial precedents, and the need for comprehensive legislation to address the threats posed by deepfake technology. This article critically examines the current legal position of deepfake technology in India and evaluates whether the existing regulatory framework is adequate to address the challenges posed by AI-generated synthetic media. At present, India does not have a dedicated statute specifically regulating deepfake technology. Instead, issues arising from deepfakes are addressed through a combination of the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023, the Digital Personal Data Protection Act, 2023, and constitutional principles relating to privacy, dignity, and freedom of expression.
To the Point
The term “Deepfake” is derived from the combination of “deep learning” and “fake.” It refers to synthetic media generated through Artificial Intelligence (AI), particularly using Generative Adversarial Networks (GANs), to manipulate images, videos, or audio recordings in a manner that appears authentic. In simple terms, a deepfake refers to artificially generated or manipulated audio, video, or image content that appears authentic and realistic due to the use of advanced machine learning techniques. The primary legal concern does not arise from the technology itself. Generative Adversarial Networks (GANs) have several legitimate applications, including film restoration, voice dubbing, educational simulations, and accessibility enhancement tools. The primary concern relates to the issue of consent and the unauthorized use of an individual’s likeness. At present, India does not recognize deepfakes as a separate criminal offence. Consequently, legal authorities must rely on existing provisions relating to identity theft, defamation, obscenity, and data protection to address deepfake-related harms. Instead, prosecutors have to reach for older tools — identity theft provisions, obscenity provisions, defamation law, and now data protection law — and hope they fit. They mostly do, but with visible seams.
Use of Legal Jargon
A quick glossary, because legal writing on this topic tends to throw around terms without defining them:
* Synthetic media – any audio, video, or image that has been artificially generated or altered using AI, as opposed to traditionally edited.
* Personation – impersonating someone, in person or digitally, usually with intent to deceive or defraud.
* Obscenity (Section 67/67A, IT Act) – publishing or transmitting material that is lascivious or appeals to prurient interest, with Section 67A specifically targeting sexually explicit material.
* Right to publicity/personality rights – an individual’s (often a celebrity’s) right to control commercial use of their name, image, voice, or likeness.
* Data fiduciary – under the DPDP Act, the entity that decides why and how personal data is processed, and is accountable for it.
These legal concepts are not merely theoretical; each corresponds to specific statutory provisions and legal remedies that may be invoked by victims of deepfake-related offences.
The Proof — Why This Isn’t Hypothetical
Sceptics sometimes treat deepfake harm as a future problem.Deepfake-related harm is no longer a hypothetical concern; it has become a significant legal and societal challenge. Indian celebrities have had their faces morphed onto pornographic content that circulated on social media well before any takedown could happen. Globally, a finance employee at a multinational firm was tricked into transferring millions after a video call with deepfake executives. Political deepfakes have already surfaced during election cycles in India, including fabricated clips of leaders making statements they never made. Each of these cases shares a common thread: by the time the fake is identified and flagged, it has already done its damage — to a bank balance, a reputation, or an election narrative. That lag between creation and detection is precisely what makes deepfakes harder to regulate than ordinary defamatory speech.
Existing Legal Framework in India
1. Information Technology Act, 2000
* Section 66C – punishes identity theft involving fraudulent use of another person’s electronic signature, password, or other unique identification feature.
* Section 66D – punishes cheating by personation using a computer resource, which fits a voice-cloning fraud call almost exactly.
* Section 67 / 67A – cover obscene and sexually explicit electronic content respectively, frequently invoked in deepfake obscene content cases. These provisions may be used where deepfakes involve impersonation, fraud, or obscene content.
2. Bharatiya Nyaya Sanhita, 2023
The BNS, which replaced the IPC, retains and in places sharpens offences relevant here: cheating, forgery, criminal intimidation, and defamation. None of these provisions mention “deepfake” by name, but Courts have generally been willing to interpret technology-neutral language broadly enough to encompass AI-generated content, much as they once stretched older forgery law to cover digital documents.Relevant offences include:
Cheating.
Identity theft.
Forgery.
Defamation.
Publication of false information.
Criminal intimidation.
The broad language of these provisions allows their application to deepfake-related offences.
3. Digital Personal Data Protection Act, 2023
This is the newest and, arguably, most promising tool. A person’s face, voice print, and biometric features are personal data. Scraping someone’s photos or voice recordings to train a deepfake model without consent arguably triggers the DPDP Act’s consent and purpose-limitation requirements, even though the Act wasn’t drafted with deepfakes specifically in mind.
4. Constitutional Dimension
Two constitutional principles appear to be in direct tension in this context. Article 19(1)(a) protects freedom of speech and expression, which includes satire, parody, and creative use of AI tools. Article 19(2) permits reasonable restrictions for decency, morality, defamation, and public order — the natural home for regulating harmful deepfakes. Article 21’s protection of life and personal liberty has, since the Puttaswamy judgment, been read to include both privacy and dignity, giving victims of non-consensual deepfakes a constitutional hook independent of any specific statute. The challenge for any future legislation is drawing the restriction narrowly enough to survive an Article 19(2) proportionality test while still being broad enough to actually stop the harm.
Case Laws
1. Justice K.S. Puttaswamy v. Union of India (2017)
A nine-judge bench unanimously held that privacy is a fundamental right flowing from Article 21. For deepfake victims, this is the foundation: unauthorised use of one’s face or voice is, at minimum, an informational privacy violation, independent of whether it also amounts to obscenity or defamation.
2. Shreya Singhal v. Union of India (2015)
The Court struck down Section 66A of the IT Act for being vague and overbroad, chilling legitimate speech. The lesson for any future deepfake law is structural: it has to define prohibited conduct with precision, or it risks the same fate — struck down for casting too wide a net over ordinary digital expression.
3. R. Rajagopal v. State of Tamil Nadu (1994)
This early privacy case recognised that publishing someone’s personal life without consent can be actionable, subject to narrow exceptions for public records and public figures. It anticipated the consent-related concerns that now lie at the heart of deepfake regulation.
4. Subramanian Swamy v. Union of India (2016)
The Court upheld criminal defamation as a reasonable restriction on speech, reasoning that reputation is itself part of the right to life under Article 21. A convincing deepfake that falsely shows a person doing or saying something damaging fits comfortably within this defamation framework.
5. Anil Kapoor v. Simply Life India & Ors. (Delhi High Court, 2023)
This is probably the most directly relevant precedent we have. Actor Anil Kapoor approached the Delhi High Court after his image, voice, and even his catchphrase was being exploited online, including through AI tools and morphed content. The Court granted a broad injunction protecting his personality and publicity rights, expressly recognising that unauthorised AI-based manipulation of a person’s likeness — essentially a judicial description of deepfaking — could not be allowed to continue. This decision represents one of the earliest Indian judicial pronouncements directly addressing the misuse of a person’s identity through AI-generated and manipulated digital content.
6. Amitabh Bachchan v. Rajat Negi & Ors. (Delhi High Court, 2022)
Decided just before the Anil Kapoor matter, this case saw the Court protect Amitabh Bachchan’s name, image, voice, and persona from unauthorised commercial exploitation, including through morphed images and deceptive use of his likeness online. Together with the Anil Kapoor ruling, it forms the backbone of an emerging Indian personality-rights doctrine that courts are now leaning on whenever deepfake or AI-manipulated content involving a real, identifiable person is at issue.
Challenges Before the Indian Legal System
* No dedicated statute — every prosecution currently requires fitting deepfake conduct into laws drafted for other harms.
* Cross-border creation and hosting, which makes service of process and evidence-gathering painfully slow.
* Authentication problems — courts need forensic tools to even determine whether a piece of evidence is itself a deepfake.
* The pace of generative AI tools consistently outstrips the pace of legislative drafting and judicial precedent.
* Most ordinary internet users still cannot reliably distinguish a deepfake from genuine footage, which slows reporting and amplifies viral spread.
Recommendations
* A targeted amendment or standalone provision criminalising non-consensual creation and distribution of synthetic media depicting identifiable persons.
* Mandatory labelling/watermarking obligations for AI-generated content on major platforms, with intermediary liability for non-compliance.
* Dedicated cyber-forensic capacity within state police cyber cells, specifically trained on deepfake detection tools.
* A fast-track takedown mechanism, similar to existing IT Rules provisions, calibrated specifically for non-consensual intimate deepfakes.
* Public digital literacy campaigns should be promoted, as legal remedies often fail to adequately repair reputational harm once harmful content has gone viral.
Conclusion
Although India does not currently have a dedicated law regulating deepfakes, the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023, the Digital Personal Data Protection Act, 2023, and existing constitutional jurisprudence collectively provide a legal framework for addressing several deepfake-related harms. However, these provisions were not specifically designed to regulate AI-generated synthetic media and therefore may not always provide adequate protection.
At present, victims are often required to rely on a combination of existing legal provisions to seek remedies against deepfake-related harms. This approach may lead to legal uncertainty and procedural delays, particularly in cases involving digital content that can spread rapidly across online platforms. Adedicated and narrowly tailored legislative framework would provide greater clarity to victims, law enforcement agencies, and digital platforms. Such legislation should strike a balance between protecting privacy, dignity, and reputation on the one hand and preserving freedom of speech and technological innovation on the other. As artificial intelligence continues to evolve, India must develop a comprehensive and balanced regulatory framework that safeguards individual rights while fostering responsible technological innovation. The future effectiveness of digital governance will depend significantly on the legal system’s ability to respond to emerging challenges posed by deepfake technology and other AI-driven developments.
FAQ
Q1. What exactly is a deepfake?
It’s AI-generated audio, video, or image content engineered to look or sound authentic even though it’s fabricated, usually built with deep learning techniques such as GANs.
Q2. Are deepfakes illegal in India right now?
There’s no single deepfake-specific law yet, but misuse can attract liability under the IT Act, BNS, and DPDP Act depending on the facts — identity theft, obscenity, defamation, or data protection violations, individually or together.
Q3. How do deepfakes violate someone’s privacy?
By using a person’s face, voice, or biometric likeness without their consent, which the Puttaswamy judgment treats as a core component of the constitutional right to privacy.
Q4. Can a deepfake amount to defamation?
Yes — if it falsely portrays someone saying or doing something that damages their reputation, it can be pursued under both civil and criminal defamation law.
Q5. What’s the single hardest part of regulating deepfakes?
Speed. Detection technology, legal process, and platform takedowns all move slower than the content itself spreads, so most legal remedies arrive only after the reputational or financial damage is already done.
References
1. Constitution of India, 1950, arts. 19(1)(a), 19(2), 21.
2. Information Technology Act, 2000, ss. 66C, 66D, 67, 67A.
3. Bharatiya Nyaya Sanhita, 2023.
4. Digital Personal Data Protection Act, 2023.
5. Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1.
6. Shreya Singhal v. Union of India, (2015) 5 SCC 1.
7. R. Rajagopal v. State of Tamil Nadu, (1994) 6 SCC 632.
8. Subramanian Swamy v. Union of India, (2016) 7 SCC 221.
9. Anil Kapoor v. Simply Life India & Ors., CS(COMM) 652/2023, Delhi High Court (29 September 2023).
10. Amitabh Bachchan v. Rajat Negi & Ors., CS(COMM) 819/2022, Delhi High Court (25 November 2022).
