Deepfake Laws & Digital Evidence in India

The deepfake problem is no longer hypothetical

In October 2023, a morphed video of actor Rashmika Mandanna went viral across Indian social media. The clip was entirely fabricated — her face superimposed onto another person's body. The Prime Minister called it a crisis. It was not an isolated incident. It was a signal.

What is a deepfake?

A deepfake is synthetic media — video, audio, or images — generated or manipulated by AI algorithms, typically using deep learning techniques like Generative Adversarial Networks (GANs), to create a realistic but entirely fabricated representation of a real person or event.

Key statistics on the scale of the problem:

• The State of Deepfakes report 2023 recorded 95,820 deepfake videos online, a 550% rise since 2019.
• Between 2022 and 2023, deepfakes surged by 3,000%, peaking in June 2023.
• The Identity Fraud Report 2025 revealed that in 2024, one deepfake attempt occurred every five minutes, accounting for 40% of all biometric fraud.

India's response has evolved rapidly — from ad hoc judicial interventions under existing IT and criminal law, to a dedicated statutory framework under the IT Amendment Rules 2026. This article maps the entire legal landscape: the threats, the laws, the landmark cases, and the critical gaps that remain.

India's legal response: a timeline

2000 — IT Act enacted

The Information Technology Act, 2000 criminalises cyber fraud, impersonation, and obscene content under Sections 66C, 66D, and 67. The Act contained no mention of AI or synthetic media, but these provisions became the initial legal hook for deepfake prosecutions in later years.

2021 — IT Intermediary Guidelines Rules

The IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 imposed due diligence and takedown obligations on social media platforms, but without any mention of AI-generated content. Enforcement remained weak.

2023 — The crisis year

The Rashmika Mandanna deepfake goes viral. Anil Kapoor approaches the Delhi High Court for personality rights protection. The Delhi HC grants broad injunctions against AI misuse of celebrity likenesses. The Prime Minister publicly flags deepfakes as a national crisis.

2024 — BSA replaces the Indian Evidence Act

The Bharatiya Sakshya Adhiniyam (BSA) 2023 came into force in July 2024, replacing the Indian Evidence Act, and expanded the definition of electronic records to include data generated by AI systems. The Section 65B certificate mechanism was retained but would soon be critiqued as inadequate for deepfake verification.

October 2025 — MeitY acts

The Ministry of Electronics and Information Technology acted decisively on October 22, 2025, announcing amendments to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, marking India's initial explicit statutory framework addressing artificially generated information.

February 2026 — IT Rules 2026 in force

The IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 came into force on 20 February 2026, creating India's first legally binding framework for Synthetically Generated Information (SGI). Mandatory labelling, aggressive takedown windows, traceability, and expanded due diligence obligations were introduced. It is the most significant digital governance development India has seen in years.

IT Rules 2026: what the law actually says

The amendment is a revision of the existing IT Rules 2021, aimed at bringing Synthetically Generated Information (SGI) under strict legal oversight. It defines SGI as any audio, visual, or audio-visual content created or altered algorithmically to appear real or indistinguishable from a natural person or real-world event.

Deepfakes, AI-cloned voices, and synthetic video clips are the primary targets. Plain AI-generated text content — blog posts, newsletters, and articles produced using large language models — does not fall within the current statutory SGI definition under the IT Rules 2026.

Key obligations on intermediaries

• Mandatory labelling. All SGI that is lawfully permitted must be labelled as AI-generated — visibly and prominently. Platforms must implement technical mechanisms to receive and display such labels, along with metadata indicating synthetic origin.
• The 3-hour takedown window. Intermediaries must now act within three hours of receiving a court order or government notice to remove unlawful content, down from 36 hours previously. This is the most attention-grabbing change in the entire amendment.
• Expanded due diligence. The amendment requires all intermediaries to maintain fundamental due diligence requirements, which include publishing clear terms of use and informing users about restrictions on unlawful SGI creation and dissemination.
• Traceability. Platforms must maintain metadata and traceability mechanisms so that the origin of SGI can be traced when required by law enforcement or court order.
• Filtering technology. Significant Social Media Intermediaries are required to deploy automated tools for SGI detection and classification.

A note of caution: critics consider the timetable unrealistic for global platforms handling millions of uploads hourly, though MeitY insists domestic urgency outweighs operational discomfort. Important open questions remain about how the regime will work in practice.

Criminal liability for deepfakes under existing statutes

Before the IT Rules 2026, Indian courts were already using a patchwork of criminal and civil provisions to address deepfake harm. These remain relevant and operative alongside the new framework.

• IT Act, Section 66C — Identity theft. Using someone else's digital identity or electronic signature. Directly invoked in the Amit Shah deepfake case (2024).
• IT Act, Section 66D — Cheating by personation using computer resources. Applicable to impersonation deepfakes deployed for financial fraud or reputational damage.
• IT Act, Section 67 and 67A — Obscene and sexually explicit material in electronic form. These provisions apply to deepfake pornography, which accounts for a significant proportion of total deepfake content online.
• BNS, Section 318 — Cheating. Applicable to financial fraud deepfakes — AI-generated voice or video calls impersonating family members, bankers, or officials to extract money.
• BNS, Section 356 — Criminal defamation. Publishing a false deepfake to damage a person's reputation is cognisable under this provision.
• BNS, Section 77 / IPC Section 354C — Voyeurism. Covers the capturing or circulation of deepfake intimate imagery without the subject's consent.

Landmark cases: how Indian courts have responded

Anil Kapoor v. Simply Life India & Ors. (Delhi High Court, 2023)

The Delhi High Court granted protection against AI-generated deepfakes of the actor, solidifying protection for personality rights from the abuse of AI. The court issued a broad injunction covering name, likeness, and voice against AI-driven commercial misuse — establishing the personality rights doctrine in Indian AI jurisprudence.

Ankur Warikoo & Anr. v. John Doe & Ors. (Delhi High Court, 2024)

The court granted protection against information that is not true but is created by artificial intelligence. This is an important precedent on liability for false AI-generated content that misrepresents a real individual. I

Amit Shah Deepfake Case (Delhi, 2024)

Two individuals were arrested for a manipulated video of the Home Minister falsely claiming changes to reservation policies. They were charged under IT Act Sections 66C and 66D, and BNS Sections 153A and 468. The case prompted the ECI to issue stricter guidelines on AI misuse.

Sadhguru Jagadish Vasudev v. Igor Isakov & Ors. (Delhi HC, CS(COMM) 578/2025)

Justice Saurabh Banerjee's judgment represents pathbreaking jurisprudence on protection of personality rights against AI misuse. The defendants operated rogue websites using AI-morphed deepfakes of Sadhguru's voice, image, and distinctive appearance, including false arrest claims and fake endorsement content.

Karan Johar v. Unknown Entities (Delhi High Court, September 2025)

The Delhi High Court restrained several entities from misusing filmmaker Karan Johar's name, image, voice, and persona through technological tools such as AI, Machine Learning, deepfakes, face morphing, and GIFs for commercial purposes.

ECI AI Election Directive (2025)

The Election Commission of India published a directive urging political parties to prominently label AI-generated campaign material. The Press Council of India similarly insisted that disclaimers be presented in AI-modified images. I

Deepfakes in court: the digital evidence crisis

This is the most technically complex — and most legally urgent — dimension of the deepfake problem.

The Section 65B gap

A Section 65B certificate confirms that a file came from a specific device or system. It does not confirm that the content of that file is authentic or unmanipulated. A deepfake video can very easily satisfy the technical requirements of Section 65B while still being completely fabricated. The certificate proves origin, not truth.

Consider the judicial problem plainly: a lawyer submits a video clip as evidence. In it, a person clearly admits to a crime. The clip looks real, the voice sounds right, the face matches. But the clip was generated by AI. The person never said those words. It is sitting in your courtroom as proof. This is not a hypothetical. It is a present reality.

What the BSA 2023 changes — and what it does not

India's new evidence law expands the definition of electronic records to include data generated by AI systems — a meaningful step forward. However, the BSA still lacks specific provisions dealing with deepfake evidence or mechanisms to verify AI-generated content. The authentication framework remains largely certificate-based, without mandatory forensic verification of content integrity.

Forensic infrastructure

The Ministry of Home Affairs maintains a Cyber Forensic Lab Directory (2023), but expert capacity for deepfake detection across Indian states remains uneven and limited. There is no statutory mandate compelling courts to require AI-authenticity verification before admitting electronic records. Digital forensic experts testifying in proceedings face no standardised accreditation framework under Indian law.

Gaps and the road ahead

Where the law falls short

• No standalone deepfake criminal statute — liability is pieced together from multiple pre-existing provisions
• No statutory recognition of personality rights — the current framework is entirely judge-made
• BSA 2023 lacks mandatory AI content verification requirements
• No specific provision criminalising non-consensual intimate deepfakes (NCII)
• Forensic infrastructure for deepfake detection is underdeveloped
• Enforcement under the Intermediary Guidelines remains weak Jus Corpus
• No dedicated digital evidence procedure tailored to AI-generated content

Positive developments

• IT Rules 2026 — SGI framework now legally operative
• BSA 2023 brings AI-generated data within the definition of electronic records
• Robust Delhi High Court personality rights jurisprudence
• ECI and PCI labelling mandates for AI election content
• MeitY's three-hour takedown mandate
• Active CERT-In and I4C institutional involvement
• Draft Digital India Act in the legislative pipeline

What India needs next. A standalone deepfake offence in substantive criminal law; statutory personality rights recognition to replace the current judicial patchwork; mandatory AI-authenticity verification requirements before electronic records are admitted as evidence; standardised forensic accreditation for deepfake analysis; expansion of the Draft Digital India Act to address criminal deepfakes specifically; and enhanced platform liability enforcement with clear penalties beyond the current due diligence framework.

Conclusion: India is building the scaffold — but the house is not yet built

The IT Rules 2026 represent a genuine and important shift. For the first time, India has a legal definition of deepfakes, mandatory labelling obligations, and aggressive takedown timelines. The Delhi High Court's personality rights jurisprudence has done what Parliament has not — filling a statutory vacuum through equity and judicial reasoning.

But the evidentiary crisis is not solved. Indian courtrooms can today receive a deepfake as electronic evidence that passes the Section 65B threshold, while the content itself is a fabrication. Until the BSA mandates forensic AI-verification and Indian courts develop a deepfake-specific admissibility doctrine, the integrity of digital evidence in Indian proceedings remains structurally vulnerable.

For law students, practitioners, and policymakers, deepfakes are not a future problem. They are a present one — sitting at the intersection of evidence law, constitutional privacy rights under Article 21, criminal law, and platform regulation. Understanding this intersection is no longer optional. It is essential.

Key statutes to know: IT Act 2000 · IT Rules 2021 & 2026 Amendment · Bharatiya Sakshya Adhiniyam 2023 · Bharatiya Nyaya Sanhita 2023 · Draft Digital India Act · DPDP Act 2023