A deepfake is a piece of synthetic media in which a person who never said or did something is shown saying or doing it, with enough fidelity that an ordinary viewer cannot tell. The word combines deep learning and fake, and the technology behind it has progressed from a research curiosity in 2017 to a tool that can be run by an undergraduate on a laptop in 2026. The cost of producing a convincing forgery has collapsed. The cost of detecting one has gone up.
This is not just a problem of celebrity gossip videos or pornographic morphing. It is a problem of evidence, elections, financial fraud, and the basic credibility of the public record. A finance minister whose voice can be cloned in fifteen seconds. A judge whose face can be pasted onto a recorded statement. A parent who receives a phone call in their child’s voice asking for money. The problem is no longer hypothetical, and India has moved over the last three years to build a regulatory response.
For UPSC, the topic sits at the intersection of artificial intelligence, cyber security, and the law of intermediaries and personal data. This article explains how deepfakes are made, how they are detected, what the Indian legal framework actually contains, what the government is doing about safe harbour and watermarking, and the policy gaps that remain.
What a Deepfake Is
A deepfake is any synthetic image, video, or audio in which a person’s likeness or voice is generated by a machine learning model rather than recorded from reality. The original 2017 deepfakes were face-swap videos that used an autoencoder to map one face onto another. The architecture has since branched into several families. Generative adversarial networks remain the most common for visual deepfakes. Diffusion models are now competitive and produce sharper results. Voice cloning uses spectrogram-based generative models that learn the timbre and cadence of a target speaker from a few seconds of audio.
The defining quality of a deepfake is that the synthetic output is statistically plausible. It does not look like a clumsy cut-and-paste. The lighting matches. The lip movements track the audio. The blink rate is approximately right. Older detection cues, like unnatural eye behaviour or visible boundary artefacts around the face, have largely been engineered away by the latest models.
It is worth distinguishing deepfakes from cheap fakes, which are conventional manipulations like slowed-down audio or cropped video that are misrepresented as something else. Cheap fakes do most of the actual damage in the wild because they are easier to produce and circulate. Deepfakes attract more attention because the technology behind them is novel and the upper bound of what they can do is qualitatively different.
How a GAN Actually Works
The generative adversarial network proposed by Ian Goodfellow in 2014 is the architecture that made deepfakes practical. Two neural networks are trained against each other in a kind of game. The generator tries to produce images that look like the real training data, beginning from random noise. The discriminator tries to tell the generator’s output apart from the real data. Each network gets feedback from the other.
If the discriminator catches a fake, the generator updates its weights to produce a less detectable output next time. If the generator fools the discriminator, the discriminator updates its weights to be more discerning next time. After millions of training steps, the generator has learned to produce images that the discriminator cannot reliably distinguish from real photographs.
When the training data is faces of a particular person, the generator learns to produce arbitrary novel images of that person. Combined with a face-swap module that aligns the synthetic face with the head pose and lighting of a target video, the result is a deepfake. Voice cloning works on the same principle but with audio spectrograms instead of pixel arrays.
How Detection Works
Deepfake detection is a moving target because every detection technique that works today is published in a research paper, after which the next generation of generators is trained to defeat it. Despite that, several broad approaches are in use.
The first is signal-level forensics. Real video has noise patterns specific to the camera sensor that captured it. A synthetic frame, even if it looks correct, has different noise statistics. Detectors that examine the photo response non-uniformity of a video can flag content that is inconsistent with the claimed source camera.
The second is biological inconsistency. Real faces have subtle physiological signals such as periodic colour changes in the skin from blood flow, or micro-expressions that reflect emotion before the conscious face has caught up. Some detectors look for these signals in the pixel stream and flag content where they are absent.
The third is provenance. Cryptographic content credentials such as the C2PA standard attach a tamper-evident record of how a piece of media was produced and edited, beginning at the camera or the recording device. If a video lacks credentials or shows a modification history that does not match its claimed origin, the absence is itself a signal.
The fourth, and increasingly the most practical, is large-scale machine learning models trained on enormous corpora of real and synthetic media. These detectors do not look for any specific artefact. They learn a general statistical fingerprint of synthetic content. They are accurate but not perfect, and their accuracy degrades when the generators they were trained against are replaced by newer ones.
India’s Legal Framework
India does not have a dedicated deepfake law. Instead, the legal response sits across three statutes and a layer of executive guidance. The first is the Information Technology Rules of 2021, framed under the parent Information Technology Act. Rule 3 of the 2021 Rules requires intermediaries to make reasonable efforts to ensure that users do not host content that impersonates another person. Rule 3 also requires intermediaries to remove such content within thirty-six hours of receiving a complaint. A more specific provision on intimate imagery, including morphed and synthetic nudity, requires removal within twenty-four hours.
The second is the Information Technology Act of 2000 itself. Section 66E criminalises the capture, publication, or transmission of images of the private parts of a person without consent, with a penalty of up to three years in prison or a fine of up to two lakh rupees. Section 66D punishes cheating by personation using a computer resource. Section 67 prohibits publishing obscene material in electronic form, and Section 67A increases the penalty for sexually explicit content.
The third is the Bharatiya Nyaya Sanhita of 2023, which replaced the Indian Penal Code from July 2024. The BNS retains the old offences of forgery, defamation, criminal intimidation, and breach of privacy, all of which apply to deepfake conduct. Section 356 of the BNS covers defamation. Sections 336 to 340 cover forgery. Sections 351 and 354 cover threats and obscenity. The BNS also creates new offences for organised cyber-crime that can apply to deepfake-based fraud.
Personal data protection sits parallel to all of this. The Digital Personal Data Protection Act of 2023, once its rules are notified in full, will require any processing of personal data, including biometric data such as a face image used to train a model, to be lawful and to include consent or another permitted ground. Deepfake creation that uses a person’s face without consent is likely to attract DPDP penalties in addition to the existing IT Act and BNS provisions.
The MeitY Advisory and the Safe Harbour Question
The most consequential regulatory development of the last two years was the November 2023 advisory from the Ministry of Electronics and Information Technology. After a string of high-profile deepfake videos involving Indian actors and political figures, MeitY issued a strict advisory to social media intermediaries reminding them that the protection of intermediary safe harbour under Section 79 of the IT Act is not unconditional. Platforms that fail to remove deepfake content promptly, or that fail to make reasonable efforts to prevent its hosting, can lose the protection and become liable for the content as if they had created it themselves.
The advisory was followed by another in March 2024 specifically on AI-generated content, requiring platforms to label such content and to permit users to identify it. The combination of the November and March advisories effectively created a labelling and watermarking obligation under the IT Rules without any new primary legislation.
A separate set of proposals under discussion in 2025 and 2026 would mandate cryptographic watermarking of AI-generated content at the point of creation, so that downstream platforms can detect synthetic media even when a user has stripped the visible label. C-DAC and IIT research groups are working on the technical standards that would underpin such a regime.
Major Indian Cases
The October 2023 deepfake video of actor Rashmika Mandanna was the first incident to generate sustained mainstream attention in India. A still image was animated to show the actor in a compromising context, and the video circulated on social media for several days before it was identified as synthetic. The case prompted public statements from the Prime Minister and led directly to the November 2023 MeitY advisory.
The 2024 general election saw a wave of synthetic content involving political leaders, ranging from voice clones used in mass robocalls to video edits that misattributed statements. The Election Commission issued advisories to political parties on the use of AI-generated content in campaigns. Some content was traced and the platforms responsible were notified. Many cases remained unattributed, illustrating the limits of post-hoc enforcement.
In 2025, several reported cases involved CEO-impersonation fraud in which a deepfaked video call from a senior executive was used to authorise wire transfers from junior finance staff. One Indian company reported a loss of more than fifteen crores in such an incident. The pattern is now familiar to the Indian Computer Emergency Response Team and is reflected in updated cyber-fraud advisories.
Cases involving deepfaked intimate imagery of private individuals continue to be the largest category by volume and the most underreported, because victims rarely come forward. Police data from 2025 suggests that complaints under Section 66E and Section 67 of the IT Act doubled between 2022 and 2025, although the actual incidence is likely much higher.
Elections, Trust, and the Liar’s Dividend
Beyond the specific harms of any one deepfake video, the broader effect of the technology is on trust. If any video can be synthetic, then a politician caught on camera saying something genuinely damaging can plausibly claim that the recording is a fake. This phenomenon, sometimes called the liar’s dividend, erodes the evidentiary value of recorded media in public life.
The Election Commission’s response in 2024, the national IPR policy framework that governs personality rights, and judicial pronouncements on the right to publicity have together started to articulate a doctrine that protects individuals against unauthorised synthetic representation. The Delhi High Court orders in the Anil Kapoor and Jackie Shroff cases established that personality rights extend to AI-generated likenesses, and that platforms can be ordered to take down such content under common law in addition to statutory provisions.
Constructive Uses
It is worth noting that the same technology is not uniformly malicious. Synthetic media is used in dubbing and accessibility, where an actor’s voice can be regenerated in another language without re-recording. It is used in education, where a deceased historical figure can deliver a primary-source lesson in their own voice. It is used in privacy-preserving research, where synthetic faces stand in for real ones during the development of computer vision systems. The challenge for policy is to distinguish legitimate from illegitimate uses without preventing the entire field of generative media.
Policy Gaps and the Way Forward
The Indian framework has come a long way in three years, but several gaps remain. There is no statutory definition of a deepfake, which forces every prosecution to fit the conduct into a more general offence. There is no mandatory provenance standard for AI-generated content, only an advisory expectation. The DPDP Act‘s provisions on biometric data are not yet fully in force. The criminal liability of model developers, as opposed to model users, remains unclear, and the question of cross-border liability when a deepfake is created abroad and circulated in India is largely untested.
A draft Digital India Bill, which has been under consultation since 2023, is expected to provide a more comprehensive framework, including a possible deepfake-specific offence, mandatory labelling, and a graded liability regime for platforms. Until that legislation is enacted, the existing patchwork will continue to be the basis for action, supplemented by judicial creativity and ministerial advisories.
Frequently Asked Questions
What is a deepfake?
A deepfake is synthetic media, usually video or audio, in which a person’s likeness or voice is generated by a machine learning model rather than recorded from reality. The term combines deep learning and fake. Deepfakes are typically produced using generative adversarial networks or diffusion models, and they can be convincing enough that ordinary viewers cannot reliably distinguish them from genuine recordings.
Are deepfakes illegal in India?
There is no dedicated deepfake law in India, but several existing statutes apply. The Information Technology Rules of 2021 require intermediaries to remove impersonation content. Section 66E and 66D of the IT Act criminalise privacy violations and personation by computer. The Bharatiya Nyaya Sanhita covers forgery, defamation, and criminal intimidation. The Digital Personal Data Protection Act of 2023 will apply once its rules are fully notified.
What is the MeitY advisory on deepfakes?
The Ministry of Electronics and Information Technology issued advisories in November 2023 and March 2024 reminding social media intermediaries that they can lose their safe harbour protection under Section 79 of the IT Act if they fail to act against deepfake content. The March 2024 advisory specifically required platforms to label AI-generated content and to allow users to identify it.
How are deepfakes detected?
Detection uses a combination of signal forensics, which examines camera noise patterns; biological inconsistency analysis, which looks for missing physiological signals; provenance standards such as C2PA content credentials; and machine learning models trained on large corpora of real and synthetic media. No single technique is reliable on its own, and detection is a continuous arms race against improving generators.
What is the difference between a deepfake and a cheap fake?
A deepfake is produced by a machine learning model and creates content that did not exist. A cheap fake is a conventional manipulation, such as slowing down a video or selectively cropping an image, that misrepresents real footage. Cheap fakes are responsible for most actual misinformation in circulation because they are easier to make, while deepfakes attract more attention because of the technology involved.
Tell Google you want more of this.
Add Anantam IAS as a preferred sourceOne tap, and this site shows up more often in your own Top Stories, AI Overviews and AI Mode. Remove it any time.
