Deepfakes, Synthetic Media, and the IT Rules: Does India Need an AI-Specific Liability Standard?

India regulated deepfakes for three years the way it regulated any other unlawful post: through post-publication complaints, platform takedown timelines, and scattered offences under the Information Technology Act, 2000. That model assumed a human publisher who could be identified, warned, and prosecuted; generative AI removed that assumption by letting anyone manufacture a stranger’s face, voice, and words at a scale no complaint-driven system was built to absorb. This paper traces how that gap was closed first through an improvised line of Delhi High Court personality-rights injunctions, then through the Ministry of Electronics and Information Technology’s Draft IT Rules of October 2025, and finally through the amendment that came into force on 20 February 2026, bringing ‘synthetically generated information’ within the due-diligence framework of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and compressing platform response timelines to as little as two hours. Reading this amendment against Article 50 of the European Union’s Artificial Intelligence Act, the paper argues that India’s model remains structurally downstream: it obliges platforms to detect and label synthetic content after it is generated, rather than obliging the tools that generate it to mark their own output at the point of creation. It proposes a three-tier statutory standard: generation-point provenance, platform-level verification, and a codified civil remedy for ordinary victims as a more coherent alternative to the current combination of criminal offence, platform rule, and judge-made injunction.