AI-Generated Deepfakes in India: Consent, Privacy, and the Limits of Existing Cyber Regulation

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Artificial intelligence is no longer a one-way instrument embedded within digital systems. It now shapes how people relate to one another, and its absorption into data governance marks a shift from artificial intelligence as a component of digital infrastructure to artificial intelligence as a means of governing that infrastructure, and with it a part of ordinary human experience. The shift is troubling chiefly because it has made hyper-realistic synthetic images, audio and video cheap to produce, and such material displaces a person's face, voice and likeness. Deepfakes are images, videos and voice recordings of people, living and deceased, whose faces and voices have been altered without their agreement. This paper takes a doctrinal approach and argues that the Indian framework governing synthetic media suffers from legal lag. It assesses the Information Technology Act 2000 and the Digital Personal Data Protection Act 2023, and finds that neither parent statute defines synthetic media, that the labelling and provenance duties introduced in February 2026 sit in subordinate legislation rather than in the statute book, that the identity offences on which prosecutors must rely were drafted for the misuse of existing credentials and not for the fabrication of a likeness, and that the substantive obligations of the data protection statute are not yet in force. It considers India's decision not to accede to the Budapest Convention on Cybercrime and the consequences for cross-border evidence collection, and it compares the regulatory regimes of the European Union, the United States, the United Kingdom and China. The paper calls for targeted legislative measures on the model of those jurisdictions: a statutory definition of synthetic media, mandatory labelling, and a fast track for statutory takedown. Three changes are treated as crucial: takedown timeframes with a statutory footing, a victim-centred reporting framework, and sustained public education. The position is stated as at August 2026.