Court or government notice
General "actual knowledge" trigger
Where a court order or an appropriate government agency gives an intermediary actual knowledge of unlawful content, the general period to act was cut from thirty-six hours to three hours.
Home/AI & Synthetic Media Law
Practice Area · India
AI & Synthetic Media Law
Deepfakes, morphed content, AI voice cloning and unauthorised likeness use raise different legal questions depending on which side of the content you are on. This page sets out what changed in the IT Rules in February 2026, what personality rights currently protect, and where to go depending on the problem you have.
If content is live right now
Do not spend time deciding which legal category this falls into first. Preserve the content — screenshots, URLs, timestamps, the platform's own content ID if shown — before you request removal, because a takedown can destroy the evidence you will need for a police report or a court application. Detailed steps are on the deepfake and morphed-content removal page.
What changed on 20 February 2026
The IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (G.S.R. 120(E), notified 10 February 2026) were the first amendment to define “synthetically generated information” in Indian law and to compress the time an intermediary has to act once it has actual knowledge of unlawful content. The windows are tiered, not uniform, and the trigger matters as much as the clock:
Citizen complaint — NCII/morphed
Private, morphed or non-consensual intimate content
A faster two-hour period applies specifically to citizen complaints about content that is private, morphed, or non-consensual intimate imagery. This route runs through the platform's grievance officer.
Where the longer window still applies
Category-specific
A thirty-six-hour period survives as a separate proviso for a defined category of cases and has not been uniformly replaced by the shorter windows above.
Grievance disposal was separately shortened from fifteen days to seven days; the twenty-four-hour acknowledgment requirement is unchanged. The Sahyog portal is not a citizen complaint route — it is a government and law-enforcement channel through which agencies including I4C issue notices under Section 79(3)(b) of the IT Act. Citizens use the platform's own grievance officer, or report to cybercrime.gov.in or the police.
Find your situation
Each page below is organised around a problem, not a statutory heading.
Content is already circulating
Individuals affected
Evidence preservation, the correct grievance route depending on content type, reporting to cybercrime.gov.in or the police, and when a civil injunction is the faster path.
Start with evidence →Your name, voice or image is being used without consent
Public figures · Private individuals
What personality rights currently protect in India, how the Delhi and Bombay High Courts have approached AI misuse, and what an injunction application requires.
Where the courts stand →You operate a platform, AI tool or creator agency
Intermediaries · AI developers
Labelling and provenance-metadata obligations, grievance-mechanism design against the tiered takedown windows, and what puts Section 79 safe harbour at risk.
Check your compliance position →You are licensing a likeness, voice or performance
Agencies · Rights holders · Brands
Drafting scope for AI-generated and synthetic use, consent that will hold up if a use is later challenged, and avoiding disputes over what a licence actually covered.
See what a licence needs to cover →Where the criminal law fits
Synthetic-media misuse is frequently also a criminal matter, and the applicable provision depends on the facts rather than on the fact that AI was involved. Impersonation under the Bharatiya Nyaya Sanhita is addressed by Section 319 (cheating by personation); Section 356 of the BNS is defamation, a distinct offence. Depending on the content, provisions dealing with sexual offences, offences against modesty, or the Information Technology Act's own penal provisions may apply alongside or instead. Which provision fits a given case is a question we address on instruction, not something to self-diagnose from a single section number found online.
Where data protection fits
Where synthetic content is generated from personal data — a photograph, a voice sample, biometric-adjacent data used to train or prompt a model — the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 may also be engaged. Substantive obligations on Data Fiduciaries, including notice, consent and breach reporting, commence 13 May 2027, with penalties reaching ₹250 crore. That runway matters for platforms and agencies building compliance now rather than after commencement.
Why India-specific counsel matters here
The statute is new and narrow
The 2026 Rules amend intermediary obligations; they do not create a standalone deepfake offence or a general right to one's likeness. Advice built only on the headline "deepfake law" misses where the actual obligations and remedies sit.
Personality rights are judge-made
Protection is being built order by order by the Delhi and Bombay High Courts. What a court will grant depends on how recent and how factually similar the reported orders are, which is why this practice tracks them by date.
The commencement calendar is staggered
IT Rules obligations, DPDP obligations and case law each move on a different timeline. Treating any one of them as fully settled or fully pending is usually the wrong answer.
Frequently asked
Is the Sahyog portal where I report a deepfake or morphed image?
No. Sahyog is a government and law-enforcement channel through which agencies such as I4C issue notices to intermediaries under Section 79(3)(b) of the IT Act. As a citizen, you report through the platform's own grievance officer, and separately through cybercrime.gov.in or the police.
How long does a platform have to take down a deepfake in India?
It depends on the trigger. A citizen complaint about private, morphed or non-consensual intimate content carries a two-hour period under Rule 3(2)(b). Content flagged through a court order or government notice under the general "actual knowledge" standard carries a three-hour period under Rule 3(1)(d). A separate thirty-six-hour proviso applies to a further defined category. Grievance disposal generally is now seven days, down from fifteen.
Is deepfake impersonation a criminal offence in India?
It can be, depending on the facts. Cheating by personation under the Bharatiya Nyaya Sanhita is Section 319. Section 356 of the BNS is defamation — a different offence with different elements. Other provisions may apply depending on what the content depicts and how it is used.
Do I have a legal right to my own face, voice or likeness in India?
There is no dedicated Indian statute granting personality rights. Protection currently comes from interim and final orders of the Delhi and Bombay High Courts, extending established personality- and privacy-related principles to AI-generated misuse. See the personality rights page for the current case-law position and its date of review.
When do the DPDP Rules 2025 penalties actually start applying?
The Data Protection Board was constituted on notification of the Rules, consent manager registration opens in November 2026, and the substantive obligations on Data Fiduciaries — the ones that carry penalties of up to ₹250 crore — commence on 13 May 2027.
Enquiries
If a matter is time-sensitive — content already circulating, a takedown window running, or a statutory deadline approaching — say so in the first line.
Please do not send confidential or privileged material in a first message. Describe the situation in general terms only. A secure channel can be arranged once the enquiry has been acknowledged.
Or write directly to info@bylaw.in