Synthetic Media and the Indian Principal: what the law now requires of platforms, and what it leaves to you

This paper covers the offences that apply, the February 2026 labelling and takedown rules, what the High Courts have ordered, the Election Commission's advisories, and a protocol for the principal, the family and the finance team.

The law as it stands in October 2026

India has no single statute on deepfakes. In August 2026 the government's own account listed the Information Technology Act, the Bharatiya Nyaya Sanhita and the intermediary rules as the laws that address them [1]. The Delhi High Court said in July 2026 that, until legislation regulates such content, a court that receives a complaint must examine whether the use of AI has infringed a person's dignity, and must balance that against free speech [2]. Later that month the government was reported to be planning a law on deepfakes and impersonation scams [3]. We found none enacted as of 4 October 2026.

Under the Information Technology Act, 2000, section 66C punishes fraudulent or dishonest use of another person's password, electronic signature or other unique identification feature, and section 66D punishes cheating by personation through a computer or communication device. Each carries up to three years' imprisonment and a fine of up to one lakh rupees. Section 66E covers capturing or publishing an image of a person's private area without consent. Sections 67 and 67A cover obscene and sexually explicit material in electronic form, and section 67B covers sexually explicit material depicting children [4].

The Bharatiya Nyaya Sanhita, 2023 replaced the Indian Penal Code [5] and has been in force since 1 July 2024 [6]. The sections most relevant here are 318 (cheating, up to seven years where the victim is induced to hand over property), 319 (cheating by personation, up to five years), 336 (forgery, which includes making a false electronic record), 356 (defamation), 308 (extortion) and 294 (obscene material, including in electronic form) [7]. Which of them fits a particular clip is for counsel and the investigating officer.

The February 2026 rules: labels and clocks

On 10 February 2026 the Ministry of Electronics and Information Technology notified amendments to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (G.S.R. 120(E)), in force from 20 February 2026 [8]. They define synthetically generated information as audio, visual or audio-visual material created or altered by computer so that it appears real and is likely to be taken for an actual person or event. Routine editing, colour correction and translation that leave the substance unchanged are excluded [9]. Text alone falls outside the definition, according to the Ministry's FAQ, which says of itself that it is not a legal document [8].

A platform whose tools create or share such material must deploy reasonable and appropriate technical measures to stop unlawful synthetic content, including non-consensual intimate imagery, false electronic records and deceptive depictions of a real person's identity, voice, conduct or statements. Other synthetic content must carry a prominent label, or a spoken disclosure at the start of audio, with provenance data embedded where technically feasible, and the platform may not let users strip either. Large social media platforms must require uploaders to declare synthetic content, use technical measures to verify the declaration and label what is confirmed [9].

The same amendments shortened the removal clocks [8][9].

A second round is pending. Draft amendments published on 30 March 2026, with an addition on 21 April, would require the label on visual content to stay visible throughout and would require intermediaries to comply with the Ministry's clarifications, advisories and directions. Comments closed on 7 May [10]. On 22 August the Hindustan Times reported that the Ministry might notify the advisory-compliance rule separately [11]. We found no gazette notification of any part of the draft as of 4 October 2026.

The government-notice route is under constitutional challenge. On 22 July 2026 the Supreme Court, hearing the Union's transfer petitions, stayed High Court proceedings in Karnataka and Bombay that question the Sahyog portal and takedown notices under section 79(3)(b) of the IT Act [12]. On 8 September it stayed a public interest petition on deepfakes in the Gujarat High Court, with notice returnable on 5 October 2026 [13][14]. Neither order, on our reading, suspends the rules.

What the High Courts have restrained since 2022

Personality rights in India are judge-made. The orders below are interim injunctions, most of them granted before the defendants had replied.

In April 2023 the Delhi High Court used the same tools for a child. It ordered websites and YouTube channels to stop publishing videos that carried false claims about the health of an eleven-year-old from a film family, and told Google to deactivate the listed URLs and disclose who was behind the channels [21].

The orders are built around lists of defendants, URLs and accounts. The May 2026 order lets the founder send newly found websites to the platform defendants, which are directed to lock or suspend the domain registrations [20]. The August 2026 decree in Rajat Sharma v Tamara Doc sets a standing route: on a fresh request supported by an affidavit, Meta and Google acknowledge within 24 hours and act, under their own policies, within 36 hours after that [22]. Courts also order disclosure of subscriber details and IP logs for the accounts behind the content [2][22].

The Bombay High Court called celebrity status the primary ingredient of the claim, to which a plaintiff adds identifiability and use for commercial gain [17]. In its July 2026 order, in a suit by a sitting Rajya Sabha member, the Delhi High Court took the preliminary view that the complaint was not about personality rights. Counsel confined the claim to defamation, and the court found most of the 52 items to be political satire and ordered six taken down within two weeks [2]. For a relative with no public profile the personality-rights route is less tested in the orders we read; the rule 3(2)(b) complaint and the criminal provisions are the tools to hand.

Campaign content: the Election Commission's advisories

The Commission wrote to political parties on this subject in May 2024, January 2025 and October 2025. On 6 May 2024 it told them not to publish or circulate deepfake audio or video and to remove such content within three hours of its being brought to their notice [23]. On 16 January 2025 it asked for labels such as AI-Generated, Digitally Enhanced or Synthetic Content [24]. On 24 October 2025 it fixed the label at 10 per cent of the visible display area, or the first 10 per cent of an audio clip, required the name of the entity that generated the content and records of AI-made campaign material, and barred unlawful content that misrepresents a person's identity, appearance or voice without consent in a way likely to mislead voters. That advisory was reported to apply to all future elections [25]. On 19 April 2026 the Commission restated the labelling requirement and said that misleading or unlawful AI-generated content is to be acted on within three hours of being brought to a platform's notice [26].

The final IT Rules dropped the 10 per cent figure that appeared in the October 2025 draft; the Commission's October 2025 advisory keeps it [25][27]. The advisories are addressed to parties, candidates and campaigners, so they give no remedy against an anonymous account.

What the law does not do

The two-hour clock needs a complaint that shows impersonation or intimate imagery on its face, and the platform's duty is to take all reasonable and practicable measures. The three-hour clock needs a court order or a reasoned written intimation from an authorised officer of the prescribed rank [9]. An order or an intimation takes time to obtain, and a complaint alone may not be enough. In the Warikoo case, as reported from the pleadings, the deepfakes surfaced around August and September 2024, reports to the platform produced delayed or incomplete removals, an appeal to the Grievance Appellate Committee was dismissed on technical grounds, and the injunction came in May 2025 [19].

The labelling duty rests on the intermediary [9]. A clip made with a tool outside the reach of Indian rules arrives without a label or provenance data. On our reading it acquires a label only if a large platform's declaration and verification step catches it at upload.

A host abroad is usually reached indirectly. Courts have had domain registrars lock names, asked the telecom and IT ministries to have internet providers block links, and let plaintiffs add newly found sites to an existing order [15][16][17][20]. Blocking limits access from India; the file stays on the foreign server.

Private messaging is where the rules reach least. Under rule 4(2), a large messaging platform can be made to identify the first originator of a message only by a court order or an order under section 69 of the IT Act, and only for listed offences: those relating to sovereignty, state security, foreign relations and public order, or to rape, sexually explicit material or child sexual abuse material, punishable with at least five years. It cannot be required to disclose message contents [9]. Financial impersonation is not on the list. Courts have had numbers blocked and groups removed [15][18], but a forwarded voice note in a family or office group will usually be heard, and acted on or ignored, before any notice is drafted.

A protocol for the principal, the family and the finance team

CERT-In's advisory of 27 November 2024 describes two frauds: impersonating an executive or family member to request a transfer, and impersonating a relative in distress to extract money. It recommends callback procedures for sensitive transactions, multi-factor authentication, fewer high-resolution personal images online and a crisis plan [28].

The principal

• Name one official channel for statements. Tell staff, family, bankers and main counterparties that nothing said in your voice or with your face elsewhere is to be acted on.
• Keep a dated reference set of genuine photographs, video and voice samples, so counsel can show what is real.
• Decide now who speaks for you when a fake appears.

The family

• Agree a verification phrase, spoken only and never typed, and change it once used.
• A call or voice note asking for money, a pickup or a password gets the phrase, or a callback on a saved number.
• For intimate or morphed imagery, complain to the platform's grievance officer at once under the two-hour rule. Anyone may complain on the person's behalf [9].

The finance team

• Make no payment, change of beneficiary or release of documents on the strength of a call, voice note or video, whoever appears to be speaking. Call back a number already on file and require a second approver.
• Put in writing that the team may hold an urgent request from the principal until it is verified.
• If money has moved, call 1930 and file on cybercrime.gov.in at once. The Home Ministry set up its financial fraud reporting system for immediate reporting and to stop funds being siphoned off [29].

Evidence and takedown

• Capture before reporting: URL, account handle, date and time, a screen recording, the original file if received, and who received it. Do not forward the clip.
• Keep the capturing device and record who made the capture. To admit an electronic record, section 63 of the Bharatiya Sakshya Adhiniyam, 2023 calls for a certificate signed by the person in charge of the device and by an expert [30].
• Route notices through counsel: the rule 3(2)(b) complaint to each platform; a police or cybercrime complaint, so that an authorised officer can start the three-hour clock; and, where content keeps returning, a High Court suit for a John Doe injunction with a URL list and disclosure of account details.
• Ask counsel to request preservation. A platform must keep removed content and the associated records for 180 days [9].

ARKA's Overwatch desk handles monitoring, the response plan and the brief for counsel. It does not give legal advice; complaints, notices and suits are handled by independent advocates engaged by the client.

What to do with this

• Name the one official channel and tell the people who need to know.
• Agree the family phrase aloud and put the finance callback rule in writing, this week.
• Save the grievance officer links for the platforms you use, with 1930 and cybercrime.gov.in.
• Choose counsel now and agree who captures evidence.
• Campaign teams: label, name the generating entity, keep records, and be ready to remove within three hours.
• Recheck the law in three months. The draft amendments, the reported plan for a dedicated law and the Supreme Court transfer petitions are all unresolved.