Yes, Indian law gives you rights over your own face, name and voice, and yes, those rights reach AI deepfakes. There is no single Personality Rights Act. What exists instead is a working combination: the constitutional right to privacy and dignity under Article 21, the tort of passing off and the Trade Marks Act, 1999 where a name or image is used to imply endorsement, copyright where you own the underlying photograph or recording, defamation, and a dense set of criminal and platform-regulation provisions in the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023 and the IT Rules. Since 20 February 2026 the IT Rules also carry a purpose-built synthetic media regime with takedown clocks measured in hours.
Part of the cyber crime and online fraud practice at S Jain & Attorneys, Bangalore.
This guide sets out where those rights come from, exactly which provision catches which kind of fake, what platforms are now legally required to do and how quickly, and what an ordinary person (not a film star) should do on the day it happens.
What personality rights are
Personality rights, sometimes called publicity rights, are the rights a person has to control the commercial and personal use of their own identity: face, name, photograph, voice, signature and other distinctive attributes of persona. The constitutional anchor is Justice K.S. Puttaswamy (Retd.) v. Union of India (Supreme Court, 24 August 2017), which held privacy to be a fundamental right under Article 21. The earlier foundation is R. Rajagopal v. State of Tamil Nadu, (1994) 6 SCC 632, the "Auto Shankar" case, which first recognised a right to control the publication of one's own life story as implicit in Article 21.
The right has no statute of its own, so it rests on a constitutional foundation built by two judgments.
What persona covers
Face, name, photograph, voice, signature and other distinctive attributes of identity, and the right to control their commercial and personal use.
Puttaswamy, 2017
The Supreme Court held privacy to be a fundamental right under Article 21, and that is the constitutional anchor for control over your own image and identity.
R. Rajagopal, 1994
The Auto Shankar case first recognised a right to control the publication of one's own life story as implicit in Article 21, well before the digital problem arose.
No single statute
There is no Personality Rights Act, so a claim is built from several strands at once, and which strands are open to you depends on what was done and to whom.
Because there is no dedicated statute, a claim is usually built out of several strands at once. Which strands are available to you depends on what was done and to whom.
| Legal basis | What it protects | What you generally have to show | Typical relief |
|---|---|---|---|
| Privacy and dignity, Article 21 (Puttaswamy; R. Rajagopal) | Control over your image, identity and private life | Unauthorised use, and that it invades a reasonable expectation of privacy or dignity | Injunction, damages |
| Passing off, and the Trade Marks Act, 1999 where a name or mark is registered | Your name or persona used to suggest a false endorsement | Goodwill, misrepresentation, damage | Injunction, damages, account of profits |
| Copyright Act, 1957 | The photograph, video or recording itself, if you own it | Ownership of copyright and reproduction or communication to the public | Injunction, damages, delivery up |
| Defamation (civil, and s. 356 BNS, 2023, formerly s. 499 IPC) | Reputation | Publication of a false imputation lowering your reputation | Injunction, damages, criminal complaint |
| IT Act, 2000 and the IT Rules, 2021 (as amended in 2026) | Online misuse, impersonation, non-consensual imagery, synthetic media | The content falls in a listed category and the platform was put on notice | Takedown within fixed hours, prosecution |
Deepfakes: which provision catches which fake
A deepfake is synthetic audio or video that makes a real person appear to say or do something they did not. Indian criminal law reaches it through a set of provisions rather than one offence. The criminal codes were replaced in 2023 and 2024, so both numbering systems are in circulation and old templates still use the repealed ones.
| What was done | Provision now in force | Old provision it replaced |
|---|---|---|
| Capturing or publishing an image of a private area without consent | Information Technology Act, 2000, s. 66E | Unchanged (IT Act was not replaced) |
| Publishing or transmitting obscene material in electronic form | IT Act, 2000, s. 67 | Unchanged |
| Publishing or transmitting material containing a sexually explicit act | IT Act, 2000, s. 67A | Unchanged |
| Identity theft using a computer resource | IT Act, 2000, s. 66C | Unchanged |
| Cheating by personation using a computer resource | IT Act, 2000, s. 66D | Unchanged |
| Cheating by personation (offline or generally) | Bharatiya Nyaya Sanhita, 2023, s. 319 | Indian Penal Code, s. 416 and s. 419 |
| Forgery, including of an electronic record | BNS, 2023, ss. 336 and 340 | IPC, ss. 463 to 471 |
| Defamation | BNS, 2023, s. 356 | IPC, s. 499 and s. 500 |
| Voyeurism | BNS, 2023, s. 77 | IPC, s. 354C |
| Stalking, including online | BNS, 2023, s. 78 | IPC, s. 354D |
| Sale or circulation of obscene material | BNS, 2023, s. 294 | IPC, s. 292 |
Key takeaway. There is no single "deepfake offence" in Indian law, and you do not need one. A sexually explicit fake is prosecuted under sections 66E, 67 and 67A of the IT Act, 2000 read with the relevant Bharatiya Nyaya Sanhita provisions; a fake used to sell something is prosecuted as cheating by personation and pursued civilly as passing off; a fake that damages reputation is defamation. What matters practically is not naming the right offence on day one, it is getting the content down and the evidence saved before it spreads.
The 2026 IT Rules: what platforms must now do, and how fast
The most significant recent change is regulatory rather than criminal. By notification G.S.R. 120(E) dated 10 February 2026, the Ministry of Electronics and Information Technology amended the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. The amendments came into force on 20 February 2026 and do two things that matter to anyone whose face has been misused.
First, they create a defined category of synthetically generated information. The Rules define it as audio, visual or audio-visual information which is artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that makes it appear real, authentic or true, and which depicts an individual or event in a way that is or is likely to be perceived as indistinguishable from a natural person or a real-world event. Routine or good-faith editing is carved out. Intermediaries that let users create or alter such content must require a declaration, deploy technical measures to verify that declaration, and where the content is confirmed to be synthetic, display a clear and prominent label saying so.
Second, they cut the takedown clocks sharply.
| Trigger | Time limit now | Time limit before the 2026 amendment |
|---|---|---|
| Court order, or reasoned intimation from an authorised government officer not below the rank of Joint Secretary (rule 3(1)(d)) | 3 hours | 36 hours |
| Complaint about content exposing a private area, showing full or partial nudity, depicting a sexual act, or impersonation including artificially morphed images (rule 3(2)(b)) | 2 hours | 24 hours |
| Other requests to remove content under rule 3(1)(b), with listed exceptions (proviso to rule 3(2)(a)(i)) | 36 hours | 72 hours |
| Grievance Officer to acknowledge any complaint | 24 hours | 24 hours |
| Grievance Officer to resolve the complaint | 7 days | 15 days |
Deadline warning. The two-hour rule under rule 3(2)(b) only starts running when the platform receives a complaint that identifies the content. It is not triggered by the content existing. This is why the first thing to do is file the complaint through the platform's own reporting mechanism and note the exact time, before doing anything else. If the platform then misses the window, that failure becomes the centrepiece of your case, because safe harbour under section 79 of the IT Act, 2000 is conditional on observing these due diligence obligations.
What the Delhi High Court has actually been ordering
The case law has moved fast, and almost all of it is from the Delhi High Court sitting in its commercial jurisdiction. The pattern is a John Doe injunction, restraining named defendants and a class of unknown persons (styled "Ashok Kumar") from using the plaintiff's persona, coupled with directions to platforms and domain registrars.
- Amitabh Bachchan v. Rajat Nagi and Ors., CS(COMM) 819/2022 (Delhi High Court, 25 November 2022), an ex parte ad interim John Doe injunction protecting the actor's name, voice and image.
- Anil Kapoor v. Simply Life India and Ors., CS(COMM) 652/2023 (Delhi High Court, 20 September 2023), which expressly restrained use of the actor's persona through artificial intelligence, machine learning, deepfakes and face morphing.
- Jaikishan Kakubhai Saraf (Jackie Shroff) v. The Peppy Store and Ors., 2024 SCC OnLine Del 3664 (Delhi High Court, 15 May 2024), extending protection against AI chatbots and e-commerce misuse.
- Aishwarya Rai Bachchan v. Aishwaryaworld.com and Ors., CS(COMM) 956/2025 (Delhi High Court, 9 September 2025), where the pleaded grievances included AI chatbots using the plaintiff's name, her face superimposed on other bodies, and a YouTube channel running AI-generated deepfake videos.
- Abhishek Bachchan v. The Bollywood Tee Shop and Ors. (Delhi High Court, 10 September 2025), restraining use of the plaintiff's persona through artificial intelligence, generative AI, machine learning, deepfakes and face morphing, on any medium and in any format.
- Kajol Vishal Devgan v. Kash Collective and Ors. (Delhi High Court, 20 February 2026).
- Sonakshi Sinha v. Character Technologies Inc. and Ors., CS(COMM) 275/2026 (Delhi High Court, 20 March 2026), concerning an AI platform whose users could create chatbots presenting themselves as real-world personalities.
- Akkineni Naga Chaitanya v. www.sexvid.xxx and Ors. (Delhi High Court, 29 May 2026).
The doctrinal point running through these orders is that persona is treated as a protectable commercial and personal interest, and that the mode of infringement (a t-shirt, a chatbot, a face swap) does not change the analysis. The practical point is that these are celebrity cases because celebrities can fund a commercial suit in Delhi. The underlying rights are not limited to them.
What an ordinary person should do
The sequence matters more than most people realise, because content disappears and platforms deduplicate reports.
- Preserve the evidence first. Full-page screenshots showing the URL and the timestamp, the account handle, the number of views, and where possible a screen recording. Save the direct link separately. Do not rely on the post staying up.
- Report through the platform's own mechanism and record the time. For nudity, sexual content, morphed images or impersonation, the two-hour clock under rule 3(2)(b) of the IT Rules, 2021 runs from receipt of the complaint. Keep the acknowledgement.
- Escalate to the Grievance Officer. Every intermediary must publish the officer's name and contact details. The officer must acknowledge within 24 hours and resolve within 7 days.
- File on the National Cyber Crime Reporting Portal. Use cybercrime.gov.in, or call the helpline on 1930. For sexual content there is a dedicated reporting category, and it can be filed anonymously.
- File a police complaint. Take printed copies of the evidence. Identify the provisions you are relying on so the complaint is not deflected as a civil matter.
- Send a legal notice. To the uploader where identifiable, and to the intermediary, putting it on notice of its rule 3 obligations and of the loss of safe harbour under section 79 of the IT Act, 2000 if it does not act.
- Move for an injunction where the harm continues. A civil suit can seek a John Doe order covering unknown uploaders, directions to search engines to de-index, and directions to registrars to suspend domains.
Common mistake. People delete the content from their own view first, by blocking the account or muting the thread, and only then think about complaining. Blocking removes your access to the evidence without removing the post. Screenshot and save the URL before you block anything. The second common mistake is complaining only to the platform and never filing anywhere official, which leaves you with no record if the platform simply ignores you.
How these matters actually run
What we tell people who walk in with a morphed image is that the legal question is usually the easy part and the timing is the hard part. Most of the damage in these matters is done in the first forty-eight hours, while the content is still being reshared, and almost every person who comes for advice comes after that window has closed, having spent it arguing with a support chatbot. The single most useful thing a non-celebrity can do is treat the first hour as an evidence exercise rather than an emotional one: capture, timestamp, report, note the reference number. The second thing worth saying honestly is about cost and forum. A commercial suit in the Delhi High Court is not a realistic route for most people, and it is not the only route. A well-drafted notice citing the two-hour and three-hour obligations, a cybercrime portal complaint with a reference number, and a police complaint together move most platforms, because the platform's own safe harbour is the thing at risk. Where the target is a woman and the content is sexual, that leverage is at its strongest, and it should be used immediately rather than saved for a courtroom.
Frequently Asked Questions
Does an ordinary person have personality rights, or only celebrities?
Everyone has a right to privacy and dignity over their own image under Article 21. The commercial publicity aspect is strongest for famous people, but misuse of any person's photo, voice or identity can be challenged through privacy, IT Act and defamation routes.
Is making or sharing a deepfake a crime in India?
It can be. Depending on the content it may attract IT Act provisions on obscenity, privacy violation and online impersonation, plus BNS provisions on cheating, forgery, defamation and offences against women. Forwarding such content can also create liability.
Someone made a fake sexual image of me. What is the fastest step?
Report it immediately to the platform and on the National Cyber Crime Portal (cybercrime.gov.in or 1930), and preserve screenshots and links. Under rule 3(2)(b) of the IT Rules, 2021 as amended in 2026, the intermediary must act within two hours of receiving your complaint.
Can I stop a brand from using my photo in an advertisement?
Generally yes. Using your image to imply endorsement without consent can be challenged as a violation of privacy and as passing off, and you can seek an injunction and damages.
Is a platform like YouTube or Instagram liable for deepfakes users upload?
Platforms enjoy safe harbour under section 79 of the IT Act, 2000 only if they observe the due diligence obligations in the IT Rules, including acting within the prescribed time. The 2026 amendments cut those timelines sharply, so a platform that ignores a valid complaint risks losing immunity.
Do AI-generated videos have to be labelled in India now?
Yes. Since 20 February 2026 the IT Rules require intermediaries that enable the creation or alteration of synthetically generated information to obtain a user declaration, verify it by technical means, and display a clear and prominent label on content confirmed to be synthetic. Users are not permitted to strip out the label or the associated metadata.
What is a John Doe order and can I get one?
It is an injunction that binds not only named defendants but also unidentified persons doing the same thing, usually described in Indian pleadings as "Ashok Kumar". Courts grant them where the wrongdoers cannot be identified in advance, which is the normal position with anonymous uploaders. It is available in principle to any plaintiff, though it requires a civil suit and the associated cost.
Can I sue if a deepfake of me was made as a joke and not for money?
Yes. Commercial exploitation is one route but not the only one. A fake that invades privacy, damages reputation or shows you in a false light can support an action based on privacy and dignity under Article 21 and on defamation, whether or not anyone profited from it.
My voice was cloned for an audio message. Is that covered?
Voice is treated as an attribute of persona in the Delhi High Court orders, which have restrained misuse of name, voice, image, likeness and signature. Depending on how the clone was used, sections 66C and 66D of the IT Act, 2000 and the cheating and forgery provisions of the Bharatiya Nyaya Sanhita, 2023 may also apply.
This article is for general informational purposes only and does not constitute legal advice. Laws change and every situation is different; please consult a qualified advocate about your specific matter.
