Loading…
The Government has set out the full statutory framework used against AI-generated deepfakes, spanning the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the IT Rules 2021.
The IT Rules, 2021 were amended on 10 February 2026 to specifically address synthetically generated information (SGI), including deepfakes and AI-generated content.
The amendment mandates clear labelling and traceable metadata for permissible AI-generated content so users can identify synthetic material.
Compliance timelines were sharply cut: removal of unlawful information on valid intimation falls from 36 hours to 3 hours, and grievance redressal from 72 hours to 36 hours, with sensitive categories such as nudity or impersonation cut from 24 hours to 2 hours.
Intermediaries that fail these obligations lose their exemption from liability for third-party content under Section 79 of the IT Act.
Penalty and compensation for damage to computers and computer systems.
Punishment for computer-related offences.
Identity theft - directly applicable where a deepfake appropriates a person's likeness or credentials.
Cheating by personation using a computer resource - the core provision for impersonation deepfakes.
Violation of privacy.
Publishing or transmitting obscene and sexually explicit material in electronic form.
Power to issue blocking orders to intermediaries for specific information or links.
The safe harbour provision - intermediaries are exempt from liability for third-party content only while they observe due diligence; failure removes the exemption.
Empower the police to investigate offences under the Act.
Cheating by personation.
Forgery, including making false electronic records to cheat or harm reputation.
Penalises false or misleading statements, rumours and reports causing public mischief or fear - the misinformation provision.
Organised crime, under which organised cybercrime involving deepfakes can be prosecuted.
'Police' and 'Public Order' are State List subjects, so States and UTs remain primarily responsible for investigating and prosecuting cybercrime.
Section 79 of the IT Act protects an intermediary - a platform that merely hosts or transmits what its users create - from liability for that third-party content. The protection is conditional, not absolute. Section 79(3)(b) withdraws it once the intermediary has 'actual knowledge' of unlawful content and fails to act. The IT Rules, 2021 spell out the due-diligence obligations that must be met to keep the protection, which is why the 2026 amendment works by tightening those obligations rather than by creating a new offence. A platform that ignores a labelling requirement or misses the 3-hour takedown window does not merely face a fine; it risks being treated as a publisher of everything its users post.
Simple Analogy: Safe harbour is like a courier's protection from what is inside a sealed parcel - it lasts only while the courier follows the rules for handling parcels, and vanishes the moment it knowingly carries contraband.
Frames and amends the IT Rules and issues the India AI Governance Guidelines; the nodal ministry for intermediary regulation.
Hears user appeals against decisions of platforms' Grievance Officers, entirely online, within 30 days. Three Committees were notified on 27 January 2023 under Rule 3A of the IT Rules, 2021. GAC orders bind platforms that wish to retain safe harbour.
Appointed by every intermediary as the first tier of complaint resolution, bound by the prescribed timelines.
Investigate and prosecute cybercrime, because Police and Public Order are State List subjects under the Seventh Schedule.
GS Paper 2 > Governance: Government Policies and Interventions; GS Paper 3 > Science and Technology: Awareness in IT, Internal Security through Communication Networks
General Awareness > Current Affairs and Polity
General Awareness > Digital Banking and Cyber Security
IT Act provisions, intermediary liability and AI regulation have appeared repeatedly in UPSC Prelims and Mains since 2023, and deepfake regulation is a recurring Mains GS-2 and GS-3 theme.
The IT Rules' term for AI-generated or AI-altered audio, video, image and text content, including deepfakes.
Any entity that receives, stores or transmits an electronic record on another's behalf - the category to which safe harbour applies.
A social media intermediary with 50 lakh or more registered users in India, subject to additional obligations including traceability and compliance reporting.
Conditional exemption under Section 79 of the IT Act from liability for third-party content, lost on failure of due diligence.
Three-member appellate body under Rule 3A of the IT Rules, 2021, notified 27 January 2023, hearing user appeals online against platform Grievance Officer decisions.