INTERMEDIARY LIABILITY UNDER SECTION 79 OF THE INFORMATION TECHNOLOGY ACT, 2000: CHALLENGES POSED BY DEEPFAKES
SHAMIM RAZA
LL.B. (2026), Manikchand Pahade Law College, Chhatrapati Sambhajinagar.
AbstractSection 79 of the Information Technology Act, 2000 rests on one premise, a platform that merely hosts third-party content should not answer for that content as though it had written it. Indian law spent roughly two decades extending that premise, and the high-water mark came in Shreya Singhal v. Union of India, where the Supreme Court held that only a court order or a government notification, never a private complaint, could strip an intermediary of its immunity. That period has ended, and it has not ended by accident. Read together, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules of 2025 and 2026 and the Karnataka High Court’s decision in X Corp v. Union of India, which upheld the Sahyog Portal mechanism, have done three things at once, replaced judicially supervised actual knowledge with an executive standard called reasoned intimation, compressed takedown timelines to three hours (two, for non-consensual intimate imagery), and required platforms to label synthetically generated content in a way that forces editorial judgments the original statute never asked them to make. A separate but converging line of personality-rights litigation, most visibly the dynamic injunctions in Ankur Warikoo v. John Doe and Sadhguru Jagadish Vasudev v. Igor Isakov, has turned intermediaries into standing enforcers rather than passive hosts. This paper traces that trajectory from Shreya Singhal to the present, places the Indian position alongside comparable regimes in the European Union, the United States, and Germany, and argues that what has happened is not erosion at the margins of safe harbour. It is substantive replacement, by a regime of conditional, executive-supervised liability, and the shift carries real costs for online speech even where it answers a genuine and fast-moving harm.
Keywords: Intermediary liability, safe harbour, deepfakes, IT Rules 2021, Section 79, synthetically generated information, X Corp judgment, dynamic injunctions, Digital India Act.
I. INTRODUCTION
One of the internet’s oldest legal premises is also its simplest, the messenger should not be punished for the message. Carried into the architecture of the modern web, that premise became the doctrine of intermediary safe harbour, a platform that merely hosts, transmits, or facilitates access to content written by someone else should not be held liable as though it had written that content itself. India gave this premise statutory form in Section 79 of the Information Technology Act, 2000. In its current shape, the provision immunises an intermediary from liability for third-party information, data, or communication links that it hosts or makes available, so long as it meets certain conditions of due diligence and does not itself initiate, select, or modify the content in question.
The justification for this arrangement was never purely doctrinal; it was substantially economic and infrastructural. A regime that held every hosting platform liable for every defamatory comment, every pirated file, and every fraudulent advertisement posted by its users would have made the user-generated-content model of Web 2.0 commercially unworkable. No search engine could index the web, no social network could host billions of daily posts, and no e-commerce marketplace could list third-party inventory, if each carried the same exposure as a newspaper publisher reviewing copy before it went to print. Safe harbour was, in this sense, the legal precondition for the platform economy as it actually developed, and India’s adoption of a safe harbour modelled, in substantial part, on the European Union’s E-Commerce Directive and the United States’ Digital Millennium Copyright Act reflected an international consensus, formed in the early 2000s, that intermediaries needed structural protection from liability if the internet’s open architecture was to survive contact with litigation.
That consensus has not collapsed everywhere, but it has visibly fractured in India over the past five years, and the fracture has accelerated sharply in 2025 and 2026. The proximate cause is technological, the maturation of generative adversarial networks and, more recently, large multimodal generative models has made it possible to produce synthetic audio, image, and video content, colloquially termed deepfakes, that is functionally indistinguishable from authentic recordings to an ordinary viewer or listener. What was, a decade ago, a laboratory curiosity confined to well-resourced research groups is now achievable with consumer-grade software and minimal technical skill. The consequences have moved with comparable speed, deepfake content has been used to fabricate non-consensual intimate imagery of private individuals and public figures alike, to impersonate financial advisors and celebrities in investment fraud schemes, and to manufacture political and communal misinformation capable of inciting public disorder at a scale and speed that earlier generations of fabricated content could not approach. The asymmetry is stark and, for regulators, alarming, producing a convincing deepfake now takes minutes, while establishing its inauthenticity, through forensic analysis, source verification, or institutional fact-checking, typically takes considerably longer, and by the time it does, the content has often already achieved its harmful purpose.
It is against this backdrop that the Indian state has moved, with notable speed by the standards of Indian legislative and regulatory practice, to recalibrate the conditions attached to intermediary immunity. This recalibration has proceeded along several connected tracks, and a central purpose of this paper is to show that these tracks are not independent developments but mutually reinforcing components of a single underlying policy shift. The first track is regulatory, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules of 2025 and 2026 introduce a defined category of Synthetically Generated Information, impose mandatory labelling obligations on platforms that host it, and, most consequentially, replace the judicially supervised actual-knowledge standard established in Shreya Singhal with an executive-driven standard described as reasoned intimation, compressing the time within which a platform must act on such intimation to three hours for unlawful content generally and a startling two hours for non-consensual intimate imagery. The second track is judicia, the Karnataka High Court’s decision in X Corp v. Union of India has supplied constitutional and statutory legitimacy to the principal administrative mechanism through which these intimations are delivered, the so-called Sahyog Portal, by characterising it as a facilitative tool rather than an unconstitutional bypass of the safeguards Shreya Singhal had imposed on government-initiated takedowns. The third track, distinct from the first two but pulling in the same direction, is the gradual extension, through personality-rights litigation in cases such as Ankur Warikoo v. John Doe and Sadhguru Jagadish Vasudev v. Igor Isakov, of dynamic and dynamic-plus injunctions that require intermediaries to monitor for and remove not merely the specific URL identified in an original order but an open-ended and continuously expanding set of mirror content, a development that converts the intermediary from a passive respondent to a litigation order into something closer to a standing private enforcement arm of the court.
This paper central claim is that these three tracks, taken together, do not represent an incremental tightening of an otherwise stable safe harbour regime. They represent its substantive replacement. The statutory text of Section 79 remains formally on the books, and a platform that satisfies its conditions is still, technically, immune from liability for third-party content. But the conditions themselves have been redefined so as to require continuous, proactive, and largely automated content surveillance, labelling synthetic media correctly, responding to executive intimations within hours rather than days, and tracking an expanding universe of mirror URLs identified by private litigants, to a degree that the original statute, drafted for a pre-algorithmic internet, never contemplated and arguably cannot sensibly accommodate without converting every significant platform into something resembling a publisher exercising prior editorial control. Whether this transformation is justified by the genuine and escalating harms of deepfake-driven misinformation, or whether it concedes more constitutional ground than the harm requires, is the question this paper sets out to answer with the seriousness it deserves, not by assuming the answer in advance, but by tracing the doctrinal history in detail, examining the 2025–2026 regulatory and judicial developments on their own terms, situating the Indian approach against comparable regimes abroad, and only then drawing conclusions about where the balance currently sits and where, in the author’s assessment, it ought to sit instead.
II. THE EVOLUTION OF INTERMEDIARY LIABILITY AND SAFE HARBOUR
2.1 Introduction
Safe harbour, wherever it exists, is not a fixed constitutional entitlement. It is a policy bargain, the state extends a concession to technology platforms in exchange for a measure of self-regulatory diligence, calibrated to its own assessment of the costs and benefits of unmediated online expression. To grasp how far that bargain has eroded in India, it helps to start with how it was struck in the first place, and how successive legal interventions reshaped its terms before the 2025-2026 amendments arrived.
2.2 Section 79 of the Information Technology Act, 2000
When Parliament enacted the Information Technology Act in 2000, the user-generated content platforms that now dominate the modern internet barely existed in the Indian market, so the immunity the original Act offered was correspondingly narrow. The provision practitioners know today is largely the product of the Information Technology (Amendment) Act, 2008, which restructured Section 79 along lines drawn recognisably from the European Union’s E-Commerce Directive and the United States’ Digital Millennium Copyright Act. Both regimes rest on the same premise, a hosting platform, unlike a publisher exercising editorial control before publication, should bear a lighter standard of liability for content it did not create.
Section 79(1) states the operative principle as a non-obstante clause. Notwithstanding any other law in force, an intermediary is not liable for third-party information, data, or communication links made available or hosted by it.
That immunity was never unconditional, though. Section 79(2) confines the intermediary’s function to providing access to a communication system through which information is transmitted, stored, or hosted, without itself initiating the transmission, selecting the receiver, or selecting or modifying the information it carries. Section 79(3) then withdraws the immunity once the intermediary has actual knowledge, via a court order or government notification, that material on its platform is unlawful, and it fails to remove or disable access to that material expeditiously. For roughly a decade the Indian internet sector grew under this fairly permissive arrangement, on the reasonable expectation that a platform staying out of direct participation in unlawful conduct would generally remain shielded for what its users posted.
2.3 The Shreya Singhal Doctrine
The precise meaning of actual knowledge under Section 79(3)(b) became the central battleground of Indian intermediary law for a straightforward reason, intermediaries were being flooded with private takedown demands, often from individuals alleging defamation, copyright infringement, or simple reputational harm, and they argued, with real force, that they lacked both the institutional competence and the constitutional legitimacy to adjudicate the legality of contested content case by case at the scale private complainants demanded.
The Supreme Court settled this decisively in Shreya Singhal v. Union of India. It read down Section 79(3)(b) to require that actual knowledge be constituted only by a court order or a notification from the appropriate government agency, and never by a private party’s unilateral assertion that content was unlawful.
Justice Rohinton F. Nariman’s reasoning turned on a structural concern, who should bear the burden of adjudicating legality in a system built on mass-scale user expression? Asking intermediaries to decide, at private complainants’ instance and without judicial guidance, whether particular content crossed the line into defamation, obscenity, or incitement would produce a strong incentive toward over-removal. A platform facing legal exposure for retaining unlawful content, but none for wrongly removing lawful content, will rationally err toward removal whenever in doubt. By insisting that only a court or a duly authorised government agency could trigger loss of immunity, Shreya Singhal placed a judicial or quasi-judicial check between a private complaint and a platform’s removal decision. This paper treats that check as the doctrinal high-water mark against which the following decade of regulatory development should be measured.
2.4 The Information Technology Rules, 2021
The years after Shreya Singhal brought a string of episodes that hardened the government’s view, organised disinformation campaigns, mob violence linked to rumours circulated on messaging platforms, the systematic weaponisation of social media during periods of communal and political tension. Together they persuaded the government that the largely passive model of intermediary conducts the 2000 statute envisioned, reinforced by Shreya Singhal’s judicial-oversight requirement, no longer suited a platform ecosystem increasingly built around algorithmic amplification rather than neutral hosting.
The result was the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Where the old due-diligence standard was comparatively light, the 2021 Rules built a denser web of affirmative compliance obligations, a Grievance Officer, periodic compliance reports, and, for platforms with more than five million registered Indian users designated as Significant Social Media Intermediaries, resident Chief Compliance Officers and Nodal Contact Persons exposed to a degree of personal liability that has no real precedent in the earlier regime.
Rule 4(2) traceability requirement, which obliges messaging intermediaries to identify the first originator of a message on judicial or governmental order, proved especially contentious. End-to-end encrypted services argue, and continue to argue in pending litigation, that compliance is technically impossible without either weakening the encryption itself or maintaining originator metadata that defeats the very privacy guarantees the encryption was built to provide.
2.5 The Active–Passive Distinction
A second, analytically distinct erosion of safe harbour happened not through legislative amendment but through judicial interpretation, most significantly in the e-commerce and intellectual property context in Christian Louboutin SAS v. Nakul Bajaj. There, the Delhi High Court drew a sharp line between passive intermediaries entitled to Section 79 immunity and active intermediaries that had, through their own conduct, forfeited it.
The Court held that an e-commerce platform that engages substantively with the underlying transaction, whether by verifying authenticity, providing warehousing or logistics, or otherwise involving itself in the mechanics of a sale rather than simply listing third-party inventory, has ceased to function as a conduit and has become an active participant in the commercial activity. Such a platform cannot claim the immunity Section 79 reserves for genuinely passive hosts. This active–passive distinction matters a great deal for the present inquiry, because its logic extends with disquieting ease to AI-mediated platforms. Is a recommendation algorithm that surfaces a deepfake video to a particular user based on inferred preferences still a neutral conduit in the Christian Louboutin sense? Is a generative AI tool that produces a synthetic image directly in response to a user prompt? Both look, on this reasoning, like active participants in creating or distributing the very content whose unlawfulness is in question. Carried to its logical conclusion, this test would place a meaningful share of contemporary AI-enabled platforms outside Section 79 protection altogether, not because any statute says so expressly, but because the platforms own technical architecture, personalised recommendation and generative output alike, satisfies a judicially constructed test for active participation that predates the deepfake problem entirely.
III. THE STATUTORY EROSION OF 2025–2026
3.1 Introduction
Part II traces a gradual tightening of safe harbour over roughly a decade. What happened in 2025 and 2026 is more abrupt, a deliberate, rapid recalibration of the underlying bargain in direct response to the deepfake problem, carried out through two Amendment Rules and a landmark High Court decision inside less than a year.
3.2 The 2025 and 2026 Amendments
The Ministry of Electronics and Information Technology, Amendment Rules of October 2025 and February 2026 introduce, for the first time in Indian law, a defined statutory category of Synthetically Generated Information, content artificially or algorithmically generated, modified, or altered by a computer resource in a way that reasonably suggests it is authentic, or genuinely captured, rather than synthesised.
That phrase, reasonably suggests, is doing a great deal of unacknowledged work. It requires intermediaries, and in practice their automated content-moderation systems operating at a scale no team of human reviewers could match, to make a continuous, large-volume judgment about whether a given piece of content would mislead a reasonable viewer into believing it authentic. That is an inherently contextual, culturally variable determination, resistant to the kind of bright-line rule that scaled automated enforcement needs. In practice, platforms are now expected to exercise a species of editorial judgment about authenticity that the statute never defines with precision and that no current detection technology can perform with anything close to the reliability the regulatory framework assumes.
The more consequential change sits in Rule 3(1)(d), which swaps the term notification for the broader and markedly less precise reasoned intimation as the trigger for the actual-knowledge standard under Section 79(3)(b).
On the government account, this is a modest terminological clarification. Read more closely, it is the functional reversal of Shreya Singhal. The Supreme Court had insisted that only a court order or a government notification, issued through a defined statutory process, could constitute actual knowledge sufficient to trigger loss of immunity. The amended rule lets an executive letter, described as a reasoned intimation but subject to no independent judicial or quasi-judicial check at the point it is issued, do the same job. A platform that receives such an intimation must respond or risk forfeiting immunity. The safeguard Shreya Singhal built into the system, an institutionally separate body standing between a complaint and a removal obligation, has in substance been dismantled, even though the judgment’s formal language is never directly overruled.
The most operationally severe piece of the 2026 Amendment is its compression of response time. An intermediary that receives a court order or a reasoned governmental intimation about unlawful content, deepfake material included, must take it down within three hours of communication. For non-consensual intimate imagery, the window narrows further, to two hours.
The gap between the speed demanded of platforms and what human content review can realistically deliver at that speed is not incidental. It is the regulation’s evident design. An intimation received at two in the morning must, on this framework, be acted upon by five, a timeline that leaves no meaningful room for human verification of context, satire, public-interest reporting, or counter-notice. It all but forces reliance on automated, pre-emptive filtering systems tuned to err sharply toward removal whenever a match, however imperfect, is detected.
3.3 X Corp v. Union of India
The Karnataka High Court’s decision in X Corp v. Union of India gave the 2025–2026 Amendment Rules something they had lacked, judicial imprimatur, converting a contested administrative innovation into a settled, court-endorsed mechanism.
X Corp had challenged the government’s use of the Sahyog Portal, a centralised digital interface through which individual ministries, state police departments, and other government agencies could issue takedown intimations directly to platforms under Section 79(3)(b). That route bypasses the more procedurally elaborate blocking mechanism under Section 69A, which requires a designated Review Committee and a written statement of reasons.
X Corp’s central argument was structural, not merely procedural. The constitutional safeguards Shreya Singhal had read into Section 69A blocking power, committee review and reasoned written orders, could not simply be routed around by pushing the same substantive demand through Section 79 takedown mechanism instead. Doing so, the argument ran, would let the executive achieve exactly the outcome those safeguards were built to prevent, by picking whichever statutory pathway carried fewer procedural constraints.
In a substantial 351-page judgment, the Karnataka High Court rejected this argument and upheld the Sahyog Portal as a facilitative administrative tool for transmitting reasoned intimations. It drew a formal distinction between blocking under Section 69A, which restricts public access to content and therefore engages the heavier procedural safeguards, and takedown under Section 79, which the Court characterised as directed at the intermediary’s own conditional immunity rather than at restricting access as such. The Court further held that X Corp, as a foreign corporation, could not invoke Article 19(1)(a) guarantee of freedom of speech and expression, reading that guarantee as available only to Indian citizens and leaving the platform without standing to raise the free-speech dimension of its own challenge. The cumulative effect is to validate, with the authority of a reasoned High Court judgment, exactly the mechanism, executive-issued intimation without the committee review Section 69A requires, that Shreya Singhal’s actual-knowledge doctrine was meant to keep from operating as a backdoor around judicial oversight. Whether this blocking-versus-takedown distinction survives appellate scrutiny, and whether the foreign-corporation standing holding stays confined to its facts or gets extended more broadly, are both live questions this paper flags for close attention as the litigation, quite plausibly, continues.
3.4 The Dynamic and Dynamic-Plus Injunction in Personality Rights
X Corp concerned the government’s relationship with platforms over politically and socially sensitive content. A separate, independently significant line of litigation has grown up in the Delhi High Court around protecting individual personality rights against deepfake-driven impersonation, and it deserves treatment as a distinct vector of liability expansion rather than being folded into the regulatory story above.
In Ankur Warikoo v. John Doe, the Court granted a John Doe injunction against unidentified defendants who had circulated a deepfake video using the claimant’s likeness to promote a fraudulent investment scheme. It ordered the takedown of identified infringing URLs within thirty-six hours, a deadline set, notably, before the later regulatory three-hour rule came into force, and ordered disclosure of the uploaders identifying information.
Days later, in Sadhguru Jagadish Vasudev v. Igor Isakov, the same Court went further, issuing what commentators have called a dynamic-plus injunction, an order letting the plaintiff add newly discovered infringing URLs to an existing blocking order by simple notification to the platform, with no need to return to court for a fresh hearing each time the deepfake content reappeared under a different web address.
The device draws directly on the dynamic-injunction principle first developed in the copyright context in UTV Software Communications Ltd. v. 1337X.TO, extended here by analogy to the personality-rights and deepfake setting.
The practical consequence for intermediaries is significant and easy to underrate. A platform subject to such an order is no longer simply complying with a discrete, time-bound judicial command; it is committed to an open-ended monitoring relationship with the plaintiff, obliged to treat each subsequent private notification of a new URL with the same operative force as the original court order, indefinitely, without further judicial supervision of whether each new URL genuinely falls within what was originally adjudicated. The intermediary becomes, in effect, a standing private enforcement mechanism for the plaintiff’s personality rights, a role a good deal closer to a publisher exercising ongoing editorial vigilance than to the passive conduit Section 79 was designed to protect.
3.5 The Bharatiya Nyaya Sanhita, 2023
Losing Section 79 immunity does not just expose an intermediary to civil liability. It exposes the intermediary, and potentially its compliance officers personally, to the far harsher consequences of criminal law under the Bharatiya Nyaya Sanhita, 2023, which expressly addresses electronic forgery and the dissemination of false information likely to cause public unrest, and which criminalises conduct of exactly the kind deepfake content often involves.
The Bharatiya Sakshya Adhiniyam, 2023 raises the practical stakes further still by setting out the evidentiary framework through which synthetic and AI-generated material must now be authenticated or challenged in judicial proceedings, adding another layer of legal complexity to any dispute touching deepfake content.
Put civil safe-harbour conditionality together with criminal exposure under the Bharatiya Nyaya Sanhita and the combined effect is a strong, arguably disproportionate, incentive toward defensive over-compliance. A platform facing possible criminal liability for its compliance officers, rather than merely civil damages, will rationally remove any content bearing even a marginal resemblance to a deepfake, whatever its actual legal status, simply because the cost of wrongly keeping it now vastly exceeds the cost of wrongly removing it. This is precisely the dynamic Shreya Singhal tried to forestall by insisting on judicial gatekeeping, and its return, in starker form given the criminal stakes now attached, is among the more troubling features of the current regime.
IV. A COMPARATIVE PERSPECTIVE
4.1 Introduction
India is not alone in facing the question of how intermediary liability should respond to AI-generated harm. A comparative survey helps isolate which features of the Indian approach are distinctive and which reflect a broader global recalibration.
4.2 The European Union (EU)
The European Union Digital Services Act has, like the Indian framework, moved toward more demanding obligations on large platforms, including notice-and-action mechanisms and statement-of-reasons requirements for content moderation decisions. But it has done so while preserving, and in some respects strengthening, a structured right to internal complaint and external dispute resolution for users whose content is removed, alongside transparency reporting obligations that subject the platform’s own removal practices to independent scrutiny.
The Indian approach compresses timelines sharply while building in comparatively little structured recourse for a user whose lawful content gets wrongly removed under the pressure of a three-hour deadline. That asymmetry between the EU and Indian models, in this paper assessment, is the more consequential point of comparison than the headline similarity that both jurisdictions have moved toward tighter platform obligations.
4.3 The United States (USA)
The United States retains, under Section 230 of the Communications Decency Act, a markedly broader immunity than either the Indian or European frameworks. It generally shields platforms from liability for third-party content regardless of actual knowledge in most civil contexts, subject to narrow statutory carve-outs.
The American debate over deepfakes has therefore run along a different axis entirely, focused on whether new federal or state-level deepfake-specific statutes targeting the creators of synthetic content directly are a better response than recalibrating platform liability itself. The comparative lesson is this, whatever their internal differences, the Indian and European responses share a premise the American framework has so far resisted adopting at the level of platform liability, namely that the platform, not only the original creator of synthetic content, must bear meaningful responsibility for its dissemination.
4.4 Germany
Germany Network Enforcement Act (NetzDG), enacted well before the Indian amendments, offers perhaps the closest precedent for the compressed-timeline model India has now adopted. It requires platforms to remove manifestly unlawful content within twenty-four hours of notification, with a longer window for more legally ambiguous cases needing further assessment.
The German experience is instructive precisely because it has already generated several years of empirical and academic assessment. Critics have documented a measurable over-removal effect, platforms operating under compressed timelines and facing substantial statutory fines for non-compliance have systematically erred toward removing borderline or contestable content rather than risk liability. This paper considers that pattern highly likely to recur, in amplified form, under India’s much shorter three-hour and two-hour windows, since the German timeline, itself criticised as too compressed, is still eight to twelve times longer than the Indian standard for comparable categories of content.
V. FINDINGS
Four findings emerge from the analysis above, and they merit statement on their own terms rather than as a restatement of preceding sections.
First, the passive-conduit model that originally justified Section 79 immunity is, for any platform of meaningful scale, no longer operative in practice. Between the 2021 Rules due-diligence architecture, the Christian Louboutin active–passive distinction, and the labelling and detection obligations introduced in 2025 and 2026, no significant intermediary can credibly claim the kind of pure passivity the original statute envisioned. Proactive content surveillance has become a precondition of immunity, not an exception to it.
Second, the reasoned-intimation standard introduced by Rule 3(1)(d), judicially ratified in X Corp, has displaced the judicial-order requirement Shreya Singhal established as the trigger for actual knowledge. In practice, an executive determination of unlawfulness now carries force comparable to a court order, without the institutional separation between complaint and adjudication the Supreme Court treated as constitutionally necessary in 2015.
Third, algorithmic content surveillance has become a mandatory feature of platform operation, not a voluntary compliance measure, driven both by the SGI labelling obligations and by the sheer operational impossibility of meeting three-hour and two-hour takedown windows through human review alone. The structural consequence, visible already in Germany experience under NetzDG, is a strong and probably unavoidable tendency toward over-removing legitimate satire, political commentary, and artistic content that imperfect automated detection cannot reliably tell apart from genuinely unlawful synthetic media.
Fourth, the personality-rights litigation track represented by Ankur Warikoo and Sadhguru Jagadish Vasudev operates as an independent, judicially self-sustaining vector of liability expansion. It converts intermediaries into standing enforcers of an indefinitely expanding set of takedown obligations through the dynamic-plus injunction mechanism, and it does so without depending on the regulatory amendments at all. This track would persist even if the 2025–2026 Rules were later narrowed or withdrawn.
VI. CONCLUSION & RECOMMENDATIONS
6.1 Conclusion
The erosion of safe harbour traced above is not an unintended side effect of regulatory drift. It is the visible outcome of a considered policy choice, faced with a genuine and rapidly escalating harm, the Indian state has decided that the risk of deepfake-driven misinformation and reputational damage outweighs the value of the broad platform immunity the country’s digital economy had, until recently, taken largely for granted. Section 79 still reads, on its face, as a safe harbour provision. But look at what now attaches to its invocation. Platforms must run algorithmic surveillance at a scale and speed no current detection technology can reliably deliver. They must respond immediately to executive intimation, without the judicial check Shreya Singhal once guaranteed. And they remain exposed to an open-ended set of private enforcement obligations through dynamic-plus injunctions. Taken together, these conditions have turned the provision from a shield into something closer to a conditional licence, one whose terms the platform itself has only a limited practical capacity to satisfy with any confidence.
In doctrinal terms, what this paper has documented is a move from the Shreya Singhal model of judicial oversight to something fairly described as the X Corp model of executive cooperation. Whether that move is a proportionate response to an unprecedented technological threat, or a more troubling surrender of judicial safeguards than the threat actually requires, is not a question this paper alone can settle, and it makes no claim to have settled it. What it does claim, with more confidence, is that the shift is real, that it is structural rather than incidental, and that it deserves to be named and examined on those terms, not absorbed quietly into the background as one more routine regulatory update. The era of the open internet, governed by a presumption of platform passivity subject to narrow and judicially supervised exceptions, has given way to one in which safety is defined by the state and trust is enforced through the intermediary. That trade may well be justified by the scale of the harm now at stake. But it is a trade that should be made consciously, debated openly, and written into the forthcoming Digital India Act with far more procedural care than its present, piecemeal construction through successive Amendment Rules has so far shown.
6.2 Recommendations
- Codification of the Actual Knowledge Standard
The forthcoming Digital India Act is a genuine chance to settle, on a durable statutory footing, what actual knowledge means for non-emergency content. It should restore the requirement, consistent with Shreya Singhal, that removal obligations outside narrowly defined emergency categories be triggered only by a court order or by a government notification issued through a process subject to independent review, not by an administrative intimation issued and acted on entirely outside judicial oversight. - Independent Review of Reasoned Intimations
To meet the executive-overreach concern that X Corp raised but ultimately rejected, intimations issued through mechanisms such as the Sahyog Portal should go through review by an independent committee, modelled on the Review Committee structure already attached to Section 69A blocking orders but with materially greater disclosure obligations. This would preserve administrative speed for genuine emergencies while restoring a check on the individual intimations that fall outside that narrow category. - Good-Faith Safe Harbour for AI Labelling
The statute should say expressly that a platform’s good-faith application of a deepfake or AI-generated content label, consistent with applicable technical standards, is a defence against liability for failing to detect or remove the underlying synthetic content. That would let the labelling regime work as an incentive-compatible transparency mechanism rather than an additional, unbounded source of liability exposure for imperfect detection. - Provenance Standards for AI-Generated Content
Rather than placing the entire burden of detection on intermediaries after content has already been created and disseminated, the law should mandate content-provenance and watermarking standards, such as the Coalition for Content Provenance and Authenticity specification, at the point of generation, requiring AI developers themselves, not just downstream hosting platforms, to embed verifiable provenance metadata into synthetic outputs.
This shifts a meaningful share of the compliance burden upstream, to the entities best placed to bear it technically, and it would meaningfully improve the reliability of the detection systems the 2025–2026 amendments currently expect intermediaries to run without adequate technical support. - Calibration of Takedown Timelines
A uniform three-hour window applied across every category of unlawful content fails to distinguish cases that genuinely demand an emergency response, non-consensual intimate imagery being the clearest example, from cases such as contested political or satirical content, where a slightly longer window would allow meaningful human review without materially raising the risk of harm. A tiered timeline structure, reserving the shortest windows for the narrowest and most clearly defined categories of irreversible harm, would ease the structural pressure toward indiscriminate automated over-removal that the current uniform standard produces.
BIBLIOGRAPHY
i. Statutes and Rules
The Information Technology Act, 2000 (No. 21 of 2000) (India).
The Information Technology (Amendment) Act, 2008 (No. 10 of 2009) (India).
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (India).
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2025, G.S.R. 775(E) (Oct. 22, 2025) (India).
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, G.S.R. 120(E) (Feb. 10, 2026) (India).
The Bharatiya Nyaya Sanhita, 2023 (No. 45 of 2023) (India).
The Bharatiya Sakshya Adhiniyam, 2023 (No. 47 of 2023) (India).
Council Directive 2000/31/EC, 2000 O.J. (L 178) 1 (EC).
Regulation (EU) 2022/2065 (Digital Services Act), 2022 O.J. (L 277) 1 (EU).
Digital Millennium Copyright Act, 17 U.S.C. § 512 (1998) (U.S.).
Communications Decency Act, 47 U.S.C. § 230 (1996) (U.S.).
Netzwerkdurchsetzungsgesetz (NetzDG), Bundesgesetzblatt, 2017, Teil I, S. 3352 (Ger.).
ii. Cases
Ankur Warikoo v. John Doe, CS(COMM) 415/2025 (Del. H.C. May 26, 2025) (India).
Christian Louboutin SAS v. Nakul Bajaj, (2018) 253 D.L.T. 728 (Del. H.C.) (India).
Google India Pvt. Ltd. v. Visaka Industries, (2020) 4 S.C.C. 162 (India).
Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 S.C.C. 1 (India).
Sadhguru Jagadish Vasudev v. Igor Isakov, CS(COMM) 578/2025 (Del. H.C. May 30, 2025) (India).
Shreya Singhal v. Union of India, (2015) 5 S.C.C. 1 (India).
UTV Software Communications Ltd. v. 1337X.TO, 2019 SCC OnLine Del 8002 (India).
X Corp v. Union of India, Writ Petition No. 13782 of 2023 (Kar. H.C. Sept. 24, 2025) (India).
iii. Books, Articles, and Other Sources
Chesney, Bobby and Citron, Danielle, ‘Deep Fakes: A Looming Challenge for Privacy, Democracy, and National Security’ (2019) 107 California Law Review 1753.
Mukul, Mukul, ‘Deepfakes and Legal Accountability: A Threat to Evidence and Reputation’ (2025) 7 International Journal of Multidisciplinary Research 5.
Kashyap, Sommya, ‘The Digital Mirage: India’s Evolving Legal Battle Against Deepfake Technology’ (2025) 22 SCRIPTed 162.
Anand, Rishi et al., ‘Rethinking India’s Draft Rules for Synthetically Generated Content’ Law School Policy Review (Dec. 13, 2025).
Ministry of Electronics and Information Technology, Explanatory Note to the Draft IT Amendment Rules, 2025, MeitY (Oct. 22, 2025) (India).
‘Decoding the Proposed IT Amendment Rules 2025’ The Leaflet (Oct. 24, 2025).
‘An Exhaustive Takedown of the Karnataka High Court’s Decision Upholding the Sahyog Portal’ The Leaflet (Nov. 6, 2025).
Coalition for Content Provenance and Authenticity (C2PA), Technical Specification (2025).
About the Author:
Shamim Raza is an Advocate enrolled with the Bar Council of Delhi and a graduate of Manikchand Pahade Law College, Chhatrapati Sambhajinagar. His focus is trademark and IPR law