AI and Deepfakes: Navigating the digital revolution and its dark side

Artificial Intelligence (AI) has grown quite fast and has led to great inventions and significantly influencing the economy. AI technologies are expected to boost India’s GDP to USD 6.6 Trillion by 2035 but it has also seen technologies like Deepfake emerge. The volume of deepfake materials escalated from approximately 5 lakh during 2023 to 80 lakh in 2025. Exhibiting an accelerating expansion rate surpassing most other digital security challenges.

The phrase “deepfake” emerges from merging “deep learning” with “fake”, representing the technological basis grounded in deep learning computational methods. The proliferation of hyper-realistic audio video content generated through advanced AI techniques such as Generative Adversarial Networks (GANs) that generate synthetic data which looks like real data by training algorithms on extensive data sets of a particular individual’s images or recording producing convincing imitations of an individual.

Currently awaiting Parliamentary consideration, the Deepfake Prevention and Criminalization Bill, 2023 defines deepfake as:

“Digitally manipulated or fabricated digital content, including but not limited to images, videos or audio recordings, created through the use of advanced digital technologies such as artificial intelligence, machine learning, or other advanced technologies, with the intent to convincingly and deceptively depict subjects or issues or represent individuals engaging in actions, making statements, or being in circumstances that did not occur or exist in reality.”

1. Identity theft and fraud:  In the NSE case, a deepfake video, falsely depicting the MD CEO of the National Stock Exchange (NSE) endorsing stock-picking services, was streamed on various social media intermediaries. 

2. Privacy violation: Materials that previously seemed relatively manageable can now be repurposed to harm individuals when disclosed electronically.

3. Social, economic and political harm, with an ability to harm sovereignty too. Recently, Irish presidential candidate Catherine Connolly filed a complaint against a video announcing the withdrawal of her candidacy, which was a way to mislead voters and undermine democracy.

The Ministry of Electronic and Information Technology (MeitY) proposed an amendment to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (IT Rules, 2021), mandating that digital platforms eliminate prohibited communication upon gaining knowledge, upgrade the grievance procedure, implement mandatory disclosure through labelling of Artificial Intelligence (AI) generated synthetic content or modified content. The Rules mandate intermediaries to exercise due diligence and prevent hosting or transmission of unlawful content by themselves or their users.

The Information Technology Act, 2000

• Section 66C addresses electronic identity theft, permitting punishment involving a maximum sentence of three years and a monetary penalty of up to one lakh.

• Section 66D addresses punishment for cheating by personation by using a computer resource, imposing a penalty of up to 3 years and a fine up to one lakh.

• Section 66E handles privacy violations.

• Sections 67 and 67A establish regulations and punitive measures for the distribution or circulation of obscene or sexually explicit content.

• Section 69A deals with the power of the government to issue directions for blocking public access to any information through any computer resource. 

Digital Personal Data Protection Act, 2023 (DPDP Act)

The DPDP Act mandates that data fiduciaries must record consent of the data principals for their data processing activities, along with ensuring technical and privacy safeguards to avoid imposition of strict penalties.

Bharatiya Nyaya Sanhita, 2023 (BNS)

Under BNS, the act of spreading misinformation and disinformation causing public mischief under Section 353 of the Act is punishable with imprisonment for up to 3 years or with a fine or both. Section 111 states that organized cybercrimes, including cyber-crime involving deepfake content, can also be prosecuted.

Constitution of India

Article 21 of the Indian Constitution guarantees the right to life and personal liberty (includes right to privacy and dignity). Freedom of speech, guaranteed under Article 19(1)(a) is protected but subject to reasonable restrictions, allowing government to limit speech for reasons such as public order, decency, morality and individual dignity, balancing free expression with harms caused by deepfakes.

What is Safe harbor?

A safe harbor clause typically outlines actions or conduct that protect a company from being held legally responsible for the outcomes arising from actions taken or statements made in good faith.

Under Section 79 of the Information Technology Act, 2000 (IT Act, 2000) and its corresponding Rules. Safe harbor provisions were introduced to protect intermediaries from liability for acts committed by third parties, subject to:

1. Whether the intermediary had actual knowledge of any unlawful activity

2. Whether the intermediary fulfilled the due diligence obligations as prescribed by the law.

Shreya Singhal vs Union of India

The case challenged the validity of Section 69A and the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009, due to its vague and broad powers of the government to block online content, arguing that it hinders freedom of speech.

The Court held that blocking can only take place by a reasoned order after complying with several procedural requirements, including a hearing to the originator and intermediary. The blocking order can only be passed by the designated officer after complying with 2009 Rules or when he has to follow an order passed by a competent court.

Kunal Kamra vs Union of India

An amendment to Rule 3(1)(b) of the IT Rules 2021 empowering  Public Information Bureau of the Ministry of Information and Broadcasting as the Fact Check Unit to identify the content as false or misleading, was challenged as violating the freedom of speech under Article 19(1)(a) of the Indian Constitution giving excessive power to government, also taking away safe harbor as provided under Section 79 of the IT Act, 2000.

The Bombay High Court’s split verdict led the petitioner to approach the Supreme Court (SC), appealing the decision. Before the matter was listed in the Supreme, the Government notified PIB as the Fact Check Unit. However, the Supreme Court stayed the enforcement of this notification.

National Cyber Crime Reporting Portal: The portal provides reporting of two kinds of cybercrime incidents:

(i)  crime related to women/ child

(ii) other crimes.

The crime related to women/ child can be reported anonymously.

Indian Cybercrime Coordination Centre (I4C): It is the nodal point to curb cybercrime, facilitate easy filing of complaints and identify trends and patterns. It also empowers agencies to issue notices for removal or disabling access to unlawful content including deepfakes.

Sahyog Portal: It automates the process of sending notices to intermediaries by the Appropriate Government or its agency under the IT Act, 2000 to facilitate the removal or disabling of access to any information, data or communication link being used to commit an unlawful act.

CERT-In: CERT-In has published an advisory in November 2024 on deepfake threats and measures that need to be followed to stay protected against deepfakes.

Grievance Appellate Committee (GACs): The committee deals with the appeals of users aggrieved by decisions of Grievance Officers of social media intermediaries.

SOP to curtail dissemination of Non-Consensual Intimate Imagery (NCII) content: The SOP provides guidance under the IT Rules 2021 to curb NCII. Victims can report through One stop Centers, Intermediaries, National Cybercrime Reporting Portal and Law Enforcement Agencies.

The creation and dissemination of AI-generated deepfakes often infringes upon individual’s privacy and likeness as examined in:

1. Arijit Singh vs Codible Ventures LLP.

2. Ankur Warikoo vs John Doe and Ors.

3. Akshay Kumar’s case.

Denmark Deepfake Law

The government has amended its copyright law to ensure that every person "has the right to their own body, facial features and voice".

The performers and regular individuals alike would enjoy protection, extending 50 years after their lifetime, for unauthorized AI reproductions of their work or likeness.

US Take It Down Act

The Act makes it illegal to “knowingly publish” or threaten to publish intimate images without a person’s consent, including AI-created “deepfakes”,

China’s AI content labeling regulations

These measures refine the labeling obligations and introduce mandatory technical requirements.

Under the law, platforms must apply both explicit and implicit labeling systems.

EU AI Act and labelling AI-generated content

Article 50 of EU AI Act and recitals thereunder provider and deployers of AI system that generate synthetic audio, video or text are required to ensure that such outputs are marked in a machine-readable format and detectable as artificially generated or manipulated.

About the authors: Vikrant Rana is the Managing Partner at SS Rana & Co. Anuradha Gandhi is a Managing Associate and Abhishekta Sharma is a Junior Associate at the Firm.

Disclaimer: The opinions expressed in this article are those of the author(s). The opinions presented do not necessarily reflect the views of Bar & Bench.

If you would like your Deals, Columns, Press Releases to be published on Bar & Bench, please fill in the form available here.