In November 2023, a morphed deepfake video depicting Indian actress Rashmika Mandanna circulated widely and went viral on the internet before any meaningful remedial action could be taken. Although the content was eventually removed, the harm had already proliferated beyond the practical reach of an injunctive relief. The incident was not an isolated one; rather, it exposed a structural deficiency in India’s legal framework for protecting identity, one designed largely for an era of conventional photographs and audio-visual recordings, rather than synthetic media generated and disseminated at scale.

Deepfake technology no longer depends merely on manipulating pre-existing images or recordings. Using artificial intelligence (AI), it can generate entirely new and convincing “performances” based on publicly available data, including an individual’s face, voice, mannerisms, and speech patterns, thereby manufacturing expressions and consent that were never given. The resulting harms range from reputational injury and commercial misappropriation to political misinformation and sexual exploitation. Although Indian courts have begun adapting existing legal principles to address such misuse, the present legal architecture remains fragmented, reactive, and insufficiently tailored to the unique risks posed by synthetic identity manipulation.

Brief Overview
Personality rights broadly protect attributes associated with an individual’s identity, including their name, likeness, image, voice, signature, gestures, and other distinctive personal markers, against unauthorised commercial exploitation or misuse. In India, these rights are not codified under a single statutory framework but have emerged primarily through judicial interpretation of Article 21 of the Constitution, particularly following the recognition of privacy and dignity as fundamental rights in Justice K.S. Puttaswamy (Retd.) v. Union of India.

Indian courts have also recognised the dual character of personality rights as both a dignitary interest and a proprietary interest. In ICC Development (International) Ltd. v. Arvee Enterprises & Anr., the Delhi High Court acknowledged the commercial dimension of publicity rights, while in Titan Industries Ltd. v. Ramkumar Jewellers, it granted protection against unauthorised commercial appropriation of celebrity identity. Although historically associated primarily with public figures and celebrities, personality rights are increasingly relevant to digital creators and ordinary individuals alike, whose identities may be replicated, manipulated, or weaponised with equal ease through generative AI tools.

Indian law presently contains several provisions that may be invoked against deepfake-related harms, though none directly address synthetic identity manipulation. The Copyright Act, 1957 offers limited protection through moral rights under Section 57 and performers’ rights under Sections 38 and 38A. However, these provisions were not designed to regulate wholly synthetic performances and may not adequately address cloned voices, fabricated gestures, or AI-generated endorsements involving no direct reproduction of copyrighted expression.

Similarly, the Information Technology Act, 2000 provides indirect remedies. Sections 66C, 66D, and 66E address identity theft, cheating by personation, and privacy violations, while Sections 67, 67A, and 67B criminalise the transmission of obscene and sexually explicit material. Section 79, read with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, establishes a notice-and-takedown framework for intermediary liability. Yet these provisions remain content-specific and do not expressly engage with the structural problem of synthetic identity fabrication.

The Unique Challenge: From Likeness to Synthetic Identity
Deepfakes present a qualitatively distinct legal challenge. Unlike traditional forms of identity misuse, which typically involve the unauthorised use or alteration of an existing image or recording, deepfakes may generate entirely new content that merely simulates an individual’s identity. This collapse of the distinction between authentic likeness and synthetic identity exposes a conceptual gap in existing legal doctrine.

Recent decisions of the Delhi High Court demonstrate an emerging judicial willingness to extend personality-rights protection to AI-enabled misuse.

• In Mr. Allu Arjun v. Frankly Retail Private Limited & Ors., the Court extended protection to the actor’s personality rights in the context of AI-driven misuse, including alleged voice cloning and fabricated endorsements, indicating judicial recognition that synthetic impersonation may infringe legally protectable identity interests.
• Similarly, in Bhuvan Bam & Anr. v. INKWYNK & Ors., the Court granted relief against unauthorised use of the plaintiff’s persona, including through digital content and merchandise, recognising that a creator’s persona may function as a commercially valuable identifier deserving legal protection.
• In Shashi Tharoor v. Ashok Kumar & Ors., the Court restrained unknown persons from generating and disseminating false AI-generated political content and directed platforms to disclose identifying information relating to uploaders, reflecting an important convergence between personality-rights enforcement and platform accountability.

However, these decisions also reveal a recurring enforcement deficit. The principal limitation often lies not in obtaining judicial relief, but in ensuring its continued effectiveness. Anonymous actors may re-emerge through mirror accounts, relocate content across platforms, or exploit foreign-hosted servers faster than affected individuals can secure further judicial intervention. As a result, injunctions frequently function as temporary containment mechanisms rather than comprehensive remedies.

Way Forward
It has become clear that a legislative reform is essential. Under the IT Act, 2000, a new Section 66F should criminalise non-consensual synthetic media with graduated penalties, modelled on the US Defiance Act, 2024. Intermediaries should be required to preserve logs and upload data following complaints, and platforms on foreign servers should face cross-border takedown obligations or lose safe-harbour protection under Section 79.

The IT Rules, 2021 should mandate machine-readable watermarks, hash-matching to block re-uploads, and mandatory disclosure for electoral deepfakes. The Copyright Act should extend performers' rights to synthetic performances under Sections 38 and 38A. Most fundamentally, Parliament should codify a statutory personality rights framework in the IT Act defining protected attributes, establishing consent-based licensing, and specifying defenses for parody, satire, and reporting.

Conclusion
Indian courts have demonstrated both creativity and willingness in adapting existing legal principles to protect identity in the age of artificial intelligence. Cases such as Bhuvan Bam and Shashi Tharoor suggest that personality-rights doctrine can evolve to address synthetic impersonation and that intermediaries may be compelled to act swiftly where judicial intervention is sought.

However, litigation-driven enforcement cannot, by itself, provide a systemic response to a technological phenomenon that evolves faster than conventional adjudication. India must move beyond an injunction-centric model toward a broader framework of identity governance—one in which synthetic media is more readily traceable, platforms bear meaningful preventive responsibilities, and ordinary individuals have practical access to effective remedies alongside public figures.

By - Gurdev Singh Tung and Anu Choudhary