AI-Generated Deepfakes and the Right to Privacy in India: Emerging Legal Challenges and the Need for Stronger Protection
Abstract: AI-Generated Deepfakes and the Right to Privacy in India
Synthetic media has fundamentally altered how likeness, voice, and personal autonomy operate online. While generative Artificial Intelligence offers legitimate creative and educational utility, its weaponization through deepfakes—hyper-realistic, algorithmically manipulated audio and visual recordings—poses an acute threat to individual dignity. In India, privacy is a recognized fundamental right under Article 21 of the Constitution, yet victims of synthetic impersonation frequently find themselves navigating a fragmented statutory landscape built for an earlier era of internet crime. This paper examines the collision between generative AI and India’s constitutional privacy framework, evaluates the friction within existing penal and data protection statutes—including the 2026 amendments to the IT Rules—and outlines the structural reforms necessary to protect personal identity in an algorithmic age.
1. Introduction: The Growing Threat of AI-Generated Deepfakes
Artificial Intelligence has moved quietly from research labs into the pockets of everyday smartphone users, reshaping how we communicate, learn, and consume media. At the sharp end of this shift lies deepfake technology. By deploying deep-learning models to map facial geometry and clone vocal cadences, these tools can fabricate convincing footage of people saying words they never uttered or appearing in places they have never been.
Consider the reality on the ground: a single public photograph scraped from social media can be fed into an open-source model to generate non-consensual pornography within minutes. A three-second audio clip from a voicemail is enough to clone an executive’s voice to authorize a fraudulent wire transfer.
This is not merely a technical glitch; it is an existential assault on personal autonomy. In any constitutional democracy, a citizen must retain baseline control over their own likeness, voice, and reputation. When algorithms strip away that agency, the law must answer an urgent question: Are India’s existing statutory remedies actually equipped to contain synthetic identity theft, or are victims fighting modern algorithmic harm with outdated legal tools?
2. Anatomy of a Deepfake: Understanding Synthetic Media
Portmanteau of “deep learning” and “fake,” the term covers a spectrum of synthetic media engineered to mimic human identity with deceptive accuracy:
- Face Swapping: Grafting one person’s facial features onto another’s body in existing video or photographic frames.
- Voice Cloning: Training neural networks on brief audio samples to synthesize new, indistinguishable speech.
- Synthetic Fabrication: Generating entirely artificial video sequences where real individuals appear to perform actions or make statements from scratch.
- Non-Consensual Intimate Imagery (NCII): Superimposing an individual’s likeness into sexually explicit material without consent—currently the most prevalent and devastating misuse of the technology.
- Digital Impersonation: Deploying synthetic audio or video to bypass biometric verification, execute financial scams, or sabotage public reputations.
To be clear, synthetic media is not inherently unlawful. Film studios use it for visual effects; educators use it to translate lectures into regional languages. Legal friction begins at the exact point where synthesis crosses into deception, non-consensual exploitation, or statutory harm.
3. The Constitutional Shield: Article 21 and the Puttaswamy Doctrine
The text of the Indian Constitution contains no explicit clause granting a “right to privacy.” Instead, that right was forged through judicial interpretation, culminating in the landmark nine-judge Constitution Bench ruling in Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
Writing unanimously, the Supreme Court anchored privacy firmly within the right to life and personal liberty under Article 21. More importantly for the AI era, the Court refused to treat privacy as a narrow right to be left alone. It mapped out three distinct dimensions—bodily privacy, informational privacy, and decisional autonomy—linking them directly to human dignity.
Deepfakes strike at all three pillars simultaneously. Stripping someone of control over their own face or voice violates bodily and informational integrity; forcing a false digital persona onto them subverts their decisional autonomy. Puttaswamy gives Indian courts the constitutional bedrock needed to treat synthetic impersonation not as a trivial online nuisance, but as a direct infringement of Part III rights.
3.1 The Friction Between Article 19(1)(a) and Article 21
Constitutional protection rarely operates in a vacuum. Any attempt to police synthetic media immediately collides with Article 19(1)(a), which guarantees freedom of speech and expression, tempered only by the reasonable restrictions under Article 19(2).
Political satire, parody, and experimental art frequently rely on digital manipulation. Banning synthetic media outright would chill legitimate expression and invite constitutional invalidation. Yet, free speech has never been a license to circulate non-consensual pornography, commit wire fraud via voice cloning, or destroy a citizen’s livelihood through fabricated videos. The legal challenge lies in drawing a razor-sharp boundary between protected parody and actionable malice.
4. Statutory Patchwork: How Current Indian Laws Respond to Deepfakes
India currently lacks a standalone statute dedicated to deepfakes. Prosecutors and litigants must instead piece together remedies across general cyber laws, criminal codes, and intermediary regulations—a patchwork that often leaves critical gaps.
4.1 The Information Technology Act, 2000
Enacted long before generative AI existed, the IT Act remains the primary statutory weapon against cyber offences, though forcing deepfakes into its provisions requires careful legal stretching:
- Section 66C (Identity Theft): Criminalizes the fraudulent use of another person’s electronic signature, password, or “other unique identification feature.” While prosecutors attempt to argue that a person’s facial geometry or voiceprint qualifies as a unique identifier, the section was drafted with cryptographic credentials in mind, leaving room for defense challenges.
- Section 66D (Cheating by Personation): Directly penalizes anyone who cheats by personating another using a communication device or computer resource. If a fraudster uses a cloned voice to extract money, Section 66D applies squarely—provided the prosecution can prove dishonest inducement.
- Section 66E (Violation of Privacy): Punishes the intentional capture, publication, or transmission of images of a person’s “private area” without consent. Here lies a glaring statutory loophole: because Section 66E targets the capture of actual anatomical exposure, defense lawyers routinely argue that an AI-generated composite—where the body belongs to someone else or is entirely synthetic—does not strictly satisfy the text of the provision.
- Sections 67 and 67A (Obscene and Sexually Explicit Material): Where Section 66E falters, Sections 67 and 67A step in to penalize the electronic publication or transmission of obscene or sexually explicit content. These remain the most reliable penal provisions against deepfake pornography, regardless of whether the imagery is real or synthesized.
4.2 The Bharatiya Nyaya Sanhita, 2023 (BNS)
Replacing the colonial-era Penal Code, the BNS supplies traditional criminal remedies adapted to digital harms:
- Section 319: Addresses cheating by personation.
- Section 336: Governs forgery, extending to the creation of false electronic records intended to cause damage or support fraudulent claims.
- Section 356: Criminalizes defamation, offering recourse when fabricated media is weaponized to ruin a person’s standing in society.
Still, criminal liability under the BNS is never automatic. Prosecutors bear the heavy burden of proving specific mens rea (criminal intent) and satisfying strict statutory ingredients that were not designed with neural networks in mind.
4.3 The IT Rules, 2021 and the February 2026 Amendments
Because deepfakes rely on viral distribution to inflict damage, regulating the platforms that host them is critical. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 condition an intermediary’s safe-harbor immunity on strict due diligence and timely grievance redressal.
Recognizing that existing takedown protocols were too slow for viral synthetic media, the Central Government notified targeted amendments on 10 February 2026 via G.S.R. 120(E), bringing “synthetically generated information” explicitly within the regulatory fold. These amendments tighten platform accountability in three key ways:
- Mandatory Labelling and Traceability: Platforms must enforce visible disclosures and technical metadata identifiers on permissible AI-generated content.
- Proactive Safeguards: Intermediaries are required to deploy automated detection measures to prevent the circulation of unlawful synthetic media.
- Compressed Takedown Timelines: The rules impose stricter, accelerated deadlines for removing non-consensual synthetic content upon receiving a victim’s complaint.
While G.S.R. 120(E) marks a decisive regulatory shift, enforcement remains an uphill battle—especially when synthetic content jumps from public social media feeds into end-to-end encrypted messaging apps.
5. The Digital Personal Data Protection Act, 2023: Promise vs. Reality
On paper, the Digital Personal Data Protection Act, 2023 (DPDPA) looks like a natural shield against deepfakes. Facial imagery and voice recordings clearly qualify as “personal data” whenever they identify an individual. By requiring explicit, informed consent before a data fiduciary processes personal data, the Act theoretically outlaws scraping a citizen’s photos to train a deepfake model without permission.
In practice, two major hurdles limit its immediate utility:
First, Statutory Exemptions
The DPDPA exempts personal data processed for “personal or domestic purposes” as well as data made publicly available by the individual themselves. If an attacker downloads photos that a user voluntarily posted on a public Instagram profile and manipulates them on a personal laptop, the DPDPA’s compliance machinery may not even be triggered.
Second, Delayed Commencement
Under the Central Government’s phased rollout notification dated 13 November 2025, the core substantive obligations of the DPDPA—including enforceable Data Principal rights and penalty mechanisms—have still not reached their scheduled commencement date as of 13 November 2026. Until those provisions take full legal effect, victims must rely on the IT Act and the 2026 IT Rules rather than data protection remedies.
6. Judicial Pushback: How Indian Courts Are Filling the Vacuum
In the absence of a dedicated deepfake statute, Indian courts have stepped into the breach, stretching common-law torts and constitutional principles to protect individual likeness.
R. Rajagopal v. State of Tamil Nadu, (1994) 6 SCC 632
Popularly known as the Auto Shankar case, this foundational ruling drew a firm line between press freedom and personal privacy. The Supreme Court held that a citizen has a right to “be let alone” and to safeguard their biography, family, and personal image from unauthorized publication, barring matters already on public record. Three decades later, Rajagopal remains the primary authority against unauthorized commercial or public exploitation of a person’s private life.
Anil Kapoor v. Simply Life India, 2023 SCC OnLine Del 6914
If Rajagopal laid the groundwork, the Delhi High Court’s ruling in Anil Kapoor brought Indian jurisprudence squarely into the generative AI era. Facing widespread unauthorized use of his name, voice, image, and catchphrases—including AI-generated face morphing and deepfakes—actor Anil Kapoor sought sweeping injunctive relief.
The Court did not hesitate. Recognizing that technological novelty cannot be used as a shield to misappropriate a person’s identity, it issued an omnibus interim injunction restraining unknown entities (“John Does”) from exploiting his personality attributes via AI or deepfake tools. While the ruling centered on celebrity personality rights, its underlying logic—that a person’s voice and likeness belong exclusively to them—extends naturally to ordinary citizens defending their dignity.
Justice K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1
By elevating privacy to an inalienable constitutional right, Puttaswamy ensures that statutory gaps cannot be used to deny judicial relief. High Courts exercising writ jurisdiction under Article 226 routinely invoke Puttaswamy to order the immediate de-indexing and removal of non-consensual intimate imagery, bypassing sluggish trial procedures when human dignity is on the line.
7. Why Enforcement Still Fails on the Ground
Even with progressive judicial precedents and the February 2026 IT Rules amendments, victims face grim practical barriers once a deepfake goes live:
- The Attribution Trap: Perpetrators hide behind burner accounts, VPNs, and offshore servers. By the time law enforcement secures cross-border mutual legal assistance to trace an IP address, the damage is irreversible.
- The “Whack-a-Mole” Virality Problem: Taking down an original post on one platform does nothing to stop thousands of downloaded copies from circulating across private WhatsApp groups and Telegram channels.
- Forensic Bottlenecks: As generative models improve, naked-eye detection becomes impossible. Proving in court that a video is synthetic requires certified digital forensic analysis under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023—a process slowed down by under-equipped state forensic labs.
- Asymmetric Harm to Women: Non-consensual sexual deepfakes disproportionately target women, inflicting severe psychological trauma and social ostracization that often deters victims from filing formal police complaints in the first place.
- The Over-Regulation Trap: Heavy-handed censorship mandates risk forcing platforms to deploy overly aggressive filters that wipe out legitimate political satire, journalism, and creative expression alongside malicious fakes.
8. Practical Recourse for Victims
When targeted by synthetic media, speed and evidence preservation dictate whether legal action succeeds. Victims should execute the following steps immediately:
1. Lock Down Digital Evidence
Before reporting content for deletion, capture full-screen recordings showing the URL, account handle, timestamp, and engagement metrics. Once a platform deletes a post, crucial metadata often vanishes with it.
2. Trigger Statutory Grievance Mechanisms
File an immediate takedown request with the platform’s Resident Grievance Officer under the amended IT Rules, explicitly citing non-consensual synthetic impersonation to invoke accelerated removal timelines.
3. File a Formal Cyber Complaint
Lodge a report on the National Cyber Crime Reporting Portal (cybercrime.gov.in)—utilizing the anonymous reporting option if the content involves sexually explicit material.
4. Escalate Financial Fraud Immediately
If synthetic voice cloning or video impersonation was used to siphon money, dial the national cyber helpline 1930 within the “golden hour” to freeze recipient bank accounts.
5. Seek Dynamic Injunctions
For viral reputational harm or commercial impersonation, approach a civil or constitutional court for a “John Doe” (Ashok Kumar) dynamic injunction, compelling platforms to block not just existing URLs, but future re-uploads of the same synthetic file.
9. Closing the Gaps: Necessary Legal Reforms
The February 2026 IT Rules amendments prove that Indian regulators recognize the urgency of synthetic media threats. Yet subordinate legislation cannot carry the entire burden alone. To build durable protection, India needs four structural upgrades:
1. A Dedicated Synthetic Media Statute
Rather than forcing deepfakes into ill-fitting provisions like Section 66E of the IT Act, Parliament should enact clear statutory definitions criminalizing malicious, non-consensual synthetic impersonation—with explicit carve-outs for satire, parody, and educational use.
2. Cryptographic Provenance Over Mere Labels
Visible watermarks are easily cropped out. Regulatory standards must push AI developers toward cryptographic provenance protocols (such as C2PA metadata standards) embedded at the point of generation.
3. Decentralized Cyber Forensics
State police departments need dedicated, fast-track AI forensic units capable of certifying synthetic media within days rather than months, preventing evidentiary delays from derailing bail hearings and trials.
4. Full Operationalization of the DPDPA
Bringing the substantive enforcement provisions of the Digital Personal Data Protection Act into force will finally give citizens direct statutory leverage against companies and platforms that scrape biometric data without consent.
10. Conclusion
Generative AI has permanently severed the link between seeing and believing. For centuries, a photograph or a voice recording served as reliable proof of reality; today, both can be fabricated on a consumer laptop in minutes.
India is not defenseless against this shift. Between the constitutional shield of Puttaswamy, the Delhi High Court’s assertive protection of personality rights in Anil Kapoor, and the 2026 updates to the IT Rules, the foundational blocks of accountability are falling into place.
Yet laws written in reaction to yesterday’s technology will always struggle against algorithms that evolve weekly. Protecting the right to privacy in the synthetic age requires more than reactive takedowns—it demands statutory precision, forensic speed, and a firm legal insistence that a human being’s face and voice remain theirs alone.
References and Bibliography
Statutes, Rules, and Constitutional Provisions
- Constitution of India, 1950 — Articles 19(1)(a), 19(2), 21, and 226.
- Information Technology Act, 2000 — Sections 66C, 66D, 66E, 67, and 67A.
- Bharatiya Nyaya Sanhita, 2023 — Sections 319, 336, and 356.
- Bharatiya Sakshya Adhiniyam, 2023 — Section 63.
- Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (as amended on 10 February 2026 via G.S.R. 120(E)).
- Digital Personal Data Protection Act, 2023 (read with Commencement Notification dated 13 November 2025).
Judicial Decisions
- Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1.
- R. Rajagopal v. State of Tamil Nadu, (1994) 6 SCC 632.
- Anil Kapoor v. Simply Life India, 2023 SCC OnLine Del 6914.
Official Portals and Institutional Sources
- Ministry of Electronics and Information Technology (MeitY) — https://www.meity.gov.in/
- India Code (Digital Rep
