Beyond Consent: Deepfakes and the Structural Limits of India’s Data Protection Regime.

Abstract The rapid spread of generative artificial intelligence has placed synthetic media at the centre of the Indian privacy debate. Deepfakes, understood as audio-visual content generated or altered by machine learning models, so as to depict a real person in situations that never happened have intensified these concerns. This article analyses how deepfakes are being handled in Indian law today and why they fall short of what is actually needed. It examines the main laws that are supposed to apply, including the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023, the Digital Personal Data Protection Act, 2023, and the new IT Amendment Rules of 2026, along with the evolving jurisprudence of the Delhi and Bombay High Courts. The argument is simple: none of these laws was written with generative AI in mind, leading to a gap that deepfakes can easily walk through. The biggest hindrance is Section 3(c)(ii) of the Digital Personal Data Protection Act, 2023, which says that personal data made publicly available by a person is outside the scope of the Act, making it ineffective against the omnipresent harms of deepfakes. The argument proceeds on two tracks. First, that the Digital Personal Data Protection Act is structurally ill-suited to the deepfake problem because Section 3(c)(ii) removes publicly available personal data from the scope of the Act altogether, and because the consent-based fiduciary model cannot reach anonymous or cross-border generative actors. Second, that reform must rest on a dignitary reading of Article 21 rather than on an extension of consent doctrine. A four-tier reform framework is proposed, combining constitutional recognition, statutory amendment, ex-ante technical obligations, and modernised remedial tools, while remaining disciplined by the proportionality standard of Shreya Singhal v. Union of India.