Deepfakes, Personality Rights and the New IT Rules: What Businesses Need to Know

Deepfakes – AI-generated synthetic media that realistically mimics a person’s face, voice, or likeness – are no longer just cybersecurity or social media concern; they have become a legal and business risk. Such content is increasingly being used to create fake endorsements, clone voices, manipulate videos and misuse an individual's identity. Recognising these risks, the government has amended the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2021 (IT Rules), specifically addressing intermediaries dealing with synthetically generated information (SGI). These amendments were notified in February 2026.

The amendments

The 2026 amendments define SGI and brings it within the due diligence framework under the IT Rules. While intermediaries continue to benefit from the safe harbour protection under Section 79 of the Information Technology Act, 2000, that protection is now dependent on compliance with enhanced due diligence. Some of the key changes include:

• regulation of SGI. 

• adoption of reasonable measures to identify, label and manage SGI. 

• shorter timelines for removing unlawful AI-generated content and addressing user complaints. 

• enhanced grievance redressal and transparency requirements. 

• clarification that using automated tools to detect or remove harmful AI-generated content does not, by itself, affect the safe harbour protection. 

Why it matters

The amendments come against the backdrop of a growing number of personality rights disputes involving AI-generated content. In Anil Kapoor v. Simply Life India (2023) and Arijit Singh v. Codible Ventures (2024), Indian courts restrained the unauthorised use of celebrities' names, voices and likenesses. More recently, in July 2026, the Bombay High Court granted interim relief to Preity Zinta against AI-generated deepfakes and misuse of her identity, signalling continued judicial protection of personality rights despite the absence of dedicated legislation.

Impact on businesses

The amendments affect not only social media platforms but also AI developers, SaaS providers, marketplaces, creator platforms and any business that hosts or facilitates user-generated content. Businesses should review their AI governance frameworks, content moderation policies and grievance redressal mechanisms to ensure compliance with the amended IT Rules. Failure to do so could jeopardise the intermediary's safe harbour protection and increase legal and reputational risk.

Our view

The amendments signal a shift from reactive content moderation to proactive AI governance. For businesses, compliance with the amended IT Rules is no longer simply a legal obligation—it is a business imperative for responsible AI governance, reputation management and sustained digital trust. The future of AI lies not just in innovation, but in establishing accountability with such innovation.