Beyond Consent Deepfakes and the Structural Limits of India s Data Protection Regime Abstract Submission Amrita Sinha IFIM Amrita Sinha

Beyond Consent: Deepfakes and the Structural Limits of India's Data Protection Regime

Abstract

Amrita Sinha¹

The rapid spread of generative artificial intelligence has placed synthetic media at the centre of the Indian privacy debate. Deepfakes, understood as audio-visual content generated or altered by machine learning models, so as to depict a real person in situations that never happened have intensified these concerns.

This article analyses how deepfakes are being handled in Indian law today and why they fall short of what is actually needed. The research follows a doctrinal approach, analysing statutes,caselaws and the emerging regulatory frameworks. It examines the main laws that are supposed to apply, including the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023, the Digital Personal Data Protection Act 2023, and the new IT Amendment Rules of 2026, along with the evolving jurisprudence of the Delhi and Bombay High Courts.The argument is simple: none of these laws were written with generative AI in mind, leading to a gap that deepfakes can easily walk through. The biggest hindrance is Section 3(c)(ii) of the Digital Personal Data Protection Act 2023, which says that personal data made publicly available by a person is outside the scope of the Act, making it ineffective against the omnipresent harms of deepfakes.

The argument proceeds on two tracks. First, that the Digital Personal Data Protection Act is structurally ill-suited to the deepfake problem because Section 3(c)(ii) removes publicly available personal data from the scope of the Act altogether, and because the consent-based fiduciary model cannot reach anonymous or cross-border generative actors.

Second, that reform must rest on a dignitary reading of Article 21 rather than on an extension of consent doctrine. A four-tier reform framework is proposed, combining constitutional recognition, statutory amendment, ex-ante technical obligations, and modernised remedial tools, while remaining disciplined by the proportionality standard of Shreya Singhal v. Union of India.

Keywords

Deepfakes, Generative Artificial Intelligence, Digital Personal Data Protection Act 2023, Article 21, Personality Rights, Dignity.