Deepfakes, Labelling and Provenance

In one line

Every intermediary that offers a tool for making synthetic media must stop the unlawful kinds outright, label and permanently watermark the rest, and never let the label be removed; and a significant social media intermediary must in addition make its users declare and then check the declaration itself.

Rule 3(3): the core obligation

Inserted by G.S.R. 120(E) with effect from 20 February 2026. It applies to an intermediary that offers a computer resource which may enable, permit or facilitate the creation, generation, modification, alteration, publication, transmission, sharing or dissemination of information as synthetically generated information. So it binds the tool provider, not merely the platform where the output is posted.

Clause (a)(i), the prohibition. The intermediary must deploy reasonable and appropriate technical measures, including automated tools or other suitable mechanisms, to not allow any user to create, generate, modify, alter, publish, transmit, share or disseminate synthetic information that violates any law in force, including the Act, the Bharatiya Nyaya Sanhita, 2023, the Protection of Children from Sexual Offences Act, 2012, and the Explosive Substances Act, 1908, and includes synthetic information that:

(I) contains child sexual exploitative and abuse material, non-consensual intimate imagery, or is obscene, pornographic, paedophilic, invasive of another's privacy including bodily privacy, vulgar, indecent or sexually explicit;

(II) results in the creation, generation, modification or alteration of any false document or false electronic record;

(III) relates to the preparation, development or procurement of explosive material, arms or ammunition;

(IV) falsely depicts or portrays a natural person or real-world event by misrepresenting, in a manner likely to deceive, such person's identity, voice, conduct, action, statement, or such event as having occurred, with or without the involvement of a natural person.

Sub-clause (IV) is the deepfake provision, and it should be quoted. Note that it covers voice as well as image, and that it covers a fabricated event as well as a fabricated person.

Note also that the obligation is to prevent, not to remove. Rule 3(3)(a)(i) requires technical measures so as not to allow the user to make the thing in the first place. That is an obligation at the point of generation.

Clause (a)(ii), the labelling and provenance obligation. Every synthetic item not covered by (a)(i), that is every lawful piece of synthetic media, must be:

Prominently labelled in a manner ensuring prominent visibility in the visual display that is easily noticeable and adequately perceivable, or, for audio content, through a prominently prefixed audio disclosure, that can be used to immediately identify that the information is synthetically generated and was created, generated, modified or altered using a computer resource; and

Embedded with permanent metadata or other appropriate technical provenance mechanisms, to the extent technically feasible, including a unique identifier, to identify the computer resource of the intermediary used to create, generate, modify or alter it.