Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 (synthetically generated information)

Until 2026 India had no binding rule specific to AI-generated content. Government action on deepfakes took the form of advisories reminding intermediaries that impersonation and misinformation fall under Rule 3(1)(b) of the IT Rules, 2021: the advisories of 7 November and 26 December 2023 and the AI-model advisory of March 2024, each described in separate entries. MeitY's own explanatory note to the 2025 draft recorded that it had 'earlier issued multiple advisories' and that concerns about deepfakes had been raised in both Houses of Parliament.³

The draft was published on 22 October 2025 with a notice stating that the spread of generative AI tools had made the misuse of synthetically generated information, 'commonly known as deepfakes', capable of causing user harm, spreading misinformation, manipulating elections and impersonating individuals.² The explanatory note said the amendments would 'provide a clear legal basis for labelling, traceability, and accountability'.³ They were made under the same Section 87 powers as the parent Rules, so the amendment works through intermediary due diligence and contains no separate duty addressed to AI developers as such.¹

The notice of 22 October 2025 invited rule-by-rule comments by email by 6 November 2025 and said that submissions would be 'held in fiduciary capacity' and would 'not be disclosed to any one at any stage'.² The draft proposed five changes: a definition of 'synthetically generated information' covering information 'artificially or algorithmically created, generated, modified or altered using a computer resource' that 'appears reasonably authentic or true' (Rule 2(1)(wa)); a clarification that 'information' includes such content (Rule 2(1A)); a protection for removals under a proviso to Rule 3(1)(b); a new Rule 3(3) requiring labels or permanent unique metadata, with a visible or audible marker covering at least 10 per cent of the surface area of a visual display or the first 10 per cent of an audio clip's duration; and a new Rule 4(1A) for significant social media intermediaries.²³

The draft attracted wide criticism. MediaNama's analysis listed five concerns: the definition could cover beauty filters, augmented-reality effects and video games; 'reasonably appears to be authentic' left too much to subjective judgment; there was no exemption for parody or satire; the 10 per cent threshold had no stated rationale and would dominate a cropped profile picture or a short clip; and it was unclear whether AI service providers are intermediaries at all.⁶ The Internet and Mobile Association of India called the Rule 3(3) labelling mandate 'premature', argued that it wrongly applied intermediary duties to AI providers, and said that requiring large platforms to verify user declarations effectively made them judges of legality before publication, in tension with Section 79(3)(b) and Shreya Singhal. It also warned that persistent identifiers could enable tracking and that watermarking adds latency. Nasscom argued that much internet content would need a label under the definition, proposed a narrower concept of 'deceptive synthetic content', and asked for text to be exempted.⁷ The Internet Freedom Foundation submitted its comments on 13 November 2025.⁸

The table shows how the final text differs from the draft.¹³⁴¹⁰

The notified amendment (G.S.R. 120(E), 10 February 2026) inserts two definitions. 'Audio, visual or audio-visual information' (Rule 2(1)(ca)) means any audio, image, photograph, graphic, video, moving visual recording, sound recording or other such content, with or without accompanying audio, whether created, generated, modified or altered through any computer resource. 'Synthetically generated information' (Rule 2(1)(wa)) means audio, visual or audio-visual information that is 'artificially or algorithmically created, generated, modified or altered' using a computer resource so that it appears to be real, authentic or true, and that depicts or portrays any individual or event in a manner that is, or is likely to be perceived as, indistinguishable from a natural person or real-world event.¹

Three categories are excluded: routine or good-faith editing, formatting, enhancement, colour adjustment, noise reduction, transcription or compression that does not materially alter the substance, context or meaning of the content; routine or good-faith preparation of documents, presentations, PDFs, educational material or research outputs, including illustrative or template-based content, provided no false document or false electronic record results; and use of computer resources solely to improve accessibility, clarity, translation, description or searchability without altering a material part of the content.¹ The Ministry's FAQs add that fake certificates, forged identity documents and fabricated records generated with AI tools are not covered by the exclusions.⁴

Rule 2(1A) provides that any reference to 'information' used to commit an unlawful act, including under Rules 3(1)(b) and (d) and Rules 4(2) and (4), includes synthetically generated information. According to the FAQs, pure text is not synthetically generated information: 'a chatbot-generated article spreading false rumours, without any synthetic audio/video/image' is not covered, though it may still be unlawful information, and text accompanying a deepfake does not change the video's status.¹⁴

The duties in Rule 3(3) apply to any intermediary that offers a computer resource that may enable, permit or facilitate the creation, modification, publication, sharing or dissemination of synthetic content. The FAQs say this includes AI image and video generation or editing tools, voice synthesis and voice-cloning tools, and platforms that facilitate publication or dissemination of such content.¹⁴ Because the Rules apply only to 'intermediaries', whether a standalone generative AI developer falls within them remains open (see the entry on the IT Act, 2000).

Prevention (Rule 3(3)(a)(i)). Covered intermediaries must deploy 'reasonable and appropriate technical measures, including automated tools or other suitable mechanisms' so that no user can create or share synthetic content that violates any law, including the IT Act, the Bharatiya Nyaya Sanhita, the Protection of Children from Sexual Offences Act, 2012 and the Explosive Substances Act, 1908. Four categories are listed: (I) child sexual exploitative and abuse material, non-consensual intimate imagery, or content that is obscene, pornographic, paedophilic, invasive of bodily privacy, vulgar, indecent or sexually explicit; (II) content that results in a false document or false electronic record; (III) content relating to the preparation or procurement of explosives, arms or ammunition; and (IV) content that falsely depicts a natural person or real-world event 'by misrepresenting, in a manner that is likely to deceive' the person's identity, voice, conduct, action or statement.¹ The FAQs give examples that include synthetic 'undressing' content, cloned voices used in emergency scam calls, forged identity documents and deepfake endorsements.⁴

Labelling and provenance (Rule 3(3)(a)(ii) and (b)). Synthetic content that is not prohibited must be prominently labelled so that it can be immediately identified, with a 'prominently prefixed audio disclosure' for audio, and embedded with permanent metadata or other provenance mechanisms 'to the extent technically feasible', including a unique identifier of the intermediary's computer resource used to create or alter it. The intermediary must not enable modification, suppression or removal of the label, metadata or identifier; the FAQs give 'remove watermark' and 'export without metadata' functions as examples to avoid.¹⁴

User warnings and consequences (Rules 3(1)(c), (ca) and (cb)). All intermediaries must warn users at least once every three months of the consequences of non-compliance. Those covered by Rule 3(3) must additionally warn that unlawful synthetic content can attract penalties under the IT Act, the BNS, the POCSO Act, the Representation of the People Act, 1951, the Indecent Representation of Women (Prohibition) Act, 1986, the Sexual Harassment of Women at Workplace Act, 2013 and the Immoral Traffic (Prevention) Act, 1956, and can lead to immediate removal, suspension or termination of the account without destroying evidence, disclosure of the user's identity to a victim-complainant in accordance with law, and mandatory reporting where required. An intermediary that becomes aware of a violation, on its own or through a complaint, must take 'expeditious and appropriate action'.¹

Large platforms (Rule 4(1A) and 4(4)). Before any information is displayed, uploaded or published, a significant social media intermediary must require users to declare whether it is synthetic, 'deploy appropriate technical measures' to verify the declaration having regard to its nature, format and source, and display a clear and prominent label where the declaration or verification confirms it. If the intermediary knowingly permitted, promoted or failed to act on non-compliant synthetic content it is deemed to have failed to exercise due diligence; an explanation extends its duty to 'reasonable and proportionate technical measures to verify the correctness of user declarations'. Rule 4(4) was amended so that these platforms must deploy, rather than 'endeavour to deploy', tools to identify rape and child abuse content and previously removed identical content.¹

Deadlines. Rule 3(1)(d) now requires removal within three hours of a court order or reasoned intimation; Rule 3(2)(b) within two hours of a complaint about private-area exposure, nudity, sexual acts or impersonation, including artificially morphed images; the first proviso to Rule 3(2)(a)(i) allows 36 hours (previously 72) for removal requests under most heads of Rule 3(1)(b); and general grievances must be resolved in seven days (previously 15). Police intimations must come from officers not below the rank of Deputy Inspector General specially authorised by the appropriate government.¹

The amendment adds no new penalty. Its sanction is the existing Rule 7: an intermediary that fails to observe the Rules loses the protection of Section 79(1) of the IT Act and becomes liable under other laws, now including the Bharatiya Nyaya Sanhita, 2023.¹ The amendment's proviso to Rule 4(1A) specifically deems a significant social media intermediary to have failed due diligence if it knowingly permits or promotes non-compliant synthetic content.¹ At the same time Rule 2(1B) protects intermediaries that remove content through automated tools from the argument that doing so makes them editors who forfeit immunity under Section 79(2)(a) or (b); MediaNama noted that this clarification is wider than the limited protection for certain removals in the October 2025 draft.¹⁵

The rules therefore put the legal risk of an undetected deepfake on the platform. The Ministry said in its FAQs that users who generate unlawful synthetic content may face removal, account suspension or termination and disclosure of their identity to victims; Rule 3(1)(ca) names the criminal statutes under which they can be prosecuted.¹⁴

The rules took effect 10 days after notification, giving platforms a very short compliance window. According to MediaNama, the three-hour deadline was not in the draft, no separate consultation on it was publicly known, several industry associations criticised it, and on 25 February 2026 IT Secretary S. Krishnan reportedly told companies in a closed-door meeting that there would be no extensions or exemptions.¹⁰ MeitY issued FAQs dated 10 February 2026 to explain the due-diligence measures.⁴

Evidence of enforcement is limited. A MediaNama review of June 2026 listed ten instances since the rules took effect in which AI-generated or deepfake content spread without labels or effective platform action, including intimate-image deepfakes on Instagram, a fabricated video of the Finance Minister used in an investment scam, AI-generated election videos during the Assam, West Bengal, Kerala and Tamil Nadu polls and a face-swap clip of an actress on 29 May 2026. It reported no penalty or regulatory action against any platform and no MeitY response, noting that remedies came from courts, police and the Press Information Bureau.¹¹

On 8 October 2026 MeitY issued an advisory to social media intermediaries asking them to label or contextualise 'manipulated, synthetically generated or misleading content', particularly where it is presented as depicting a current event. MediaNama noted that the advisory's labelling request is not limited to audio-visual content and does not mention the February amendment.¹²

Free speech and compelled labelling. The Internet Freedom Foundation says the rules 'invert' the safe-harbour logic of Shreya Singhal by shifting classification burdens onto users, create a prior-restraint regime incompatible with Article 19(1)(a), treat mandatory labelling as compelled speech, rely on detection tools that perform poorly in real-world and multilingual settings, and allow user identities to be disclosed to complainants without a prior judicial order. It also says shortened timelines force automated over-removal.⁸

Technical reliability. Industry bodies and commentators questioned whether watermarking, C2PA-style content credentials and detection tools are mature, interoperable and robust against stripping or transcoding; a Bar & Bench commentary noted that the rules require labelling without a standardised format.⁷⁹

Women's safety. Writing in Bar & Bench, Shalini Sinha argued that the rules should be seen as a critical intervention for women's safety but that they target intermediaries rather than the individuals who create synthetic intimate imagery, that existing criminal provisions were not designed for AI-generated abuse, and that enforcement capacity, including evidence collection and handling of victim reports, is a concern.⁹

Process. The Ministry kept draft submissions confidential and added the three-hour deadline in the final text without separate consultation, according to the notice and to MediaNama's reporting.²¹⁰

Official explanation. MeitY's FAQs stress that the amendment excludes routine good-faith editing, accessibility uses and document preparation, that labelled satire and creative synthetic works that break no law may be permitted, and that compliant removal, including through automated tools, does not by itself affect safe harbour.⁴

As of 15 October 2026 the amendment is in force, and the sources reviewed reported no court decision setting it aside. MeitY maintains a consolidated text of the IT Rules updated for it.⁴ A separate draft amendment published on 30 March 2026 (binding advisories, news content posted by users, data retention) is covered in its own entry, and the sources reviewed reported no further amendment as notified.¹² The Ministry has indicated that it will go further: on 8 October 2026 it asked platforms to label manipulated or misleading content beyond the rules' definition, and Union IT Minister Ashwini Vaishnaw said the same day that a consultation paper on AI regulation would follow within a month, with deepfakes among its themes.¹² The sources reviewed did not report any penalty or loss of safe harbour imposed on a platform under the new rules.