India's IT Rules 2026: What the Synthetic Content Law Means for Platforms, Lawyers, and Users

Think about the last time you watched a video online and wondered, even for a second, "Is this real?" That split-second doubt is no longer just a curiosity. It is now a legal question, and India has just given it a formal answer.

On February 10, 2026, India's Ministry of Electronics and Information Technology (MeitY) notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026. These came into force on February 20, 2026, marking India's entry into a new era of platform accountability for AI-generated content. The IT Rules 2026 synthetic content framework is not a minor tweak to existing law. It is a structural shift in how the country governs digital media, deepfakes, and the responsibilities of online platforms.

This article breaks down what changed, what it means in practice, and why every lawyer, legal professional, and digitally active person in India should understand this law.

Why India Needed a Synthetic Content Law

India's internet story is staggering in scale. The country went from roughly 250 million internet users to over a billion in less than a decade. That growth brought enormous opportunities, but it also outpaced digital literacy, giving rise to a flood of misleading content, impersonation scams, and AI-generated misinformation.

The immediate triggers for the 2026 amendment were hard to ignore. Deepfake videos of celebrities circulated widely. AI-generated obscene content targeting women became a growing crisis. During elections, synthetic audio clips impersonating political figures spread rapidly. Courts began flagging the absence of a clear statutory hook to address AI-generated harm. Civil society groups called for action. MeitY had already issued advisories to platforms in late 2023 asking them to identify deepfakes and take them down, but advisories do not carry the force of law.

The 2026 amendment was drafted in response to all of this, formally designating a new category of regulated content called "synthetically generated information" or SGI, and building a compliance structure around it.

What Is "Synthetically Generated Information"?

The term SGI is the cornerstone of the IT Rules 2026 synthetic content framework. Rule 2(1)(wa) defines it as any audio, visual, or audiovisual content that is "artificially or algorithmically created, generated, modified, or altered using a computer resource" in a way that depicts persons, events, or scenes that appear authentic but have not actually occurred.

In simpler terms, this covers AI-generated videos, deepfakes, voice clones, face swaps, and AI-manipulated images or audio that a reasonable person would believe is real.

What is excluded from SGI?

Not everything AI-generated falls into this regulated bucket. The rules carve out several categories that remain outside the SGI definition, as long as they are not designed to mislead. These include:

• Routine photo and video editing such as color correction or brightness adjustments

• Accessibility enhancements like captions or audio descriptions

• Educational or illustrative content used in research, presentations, or academic work

• AI-generated content in documents, code, or text form (pure text remains outside the SGI framework entirely and is only regulated as "information" under the broader IT Act)

This is a deliberate design choice. The law targets content that mimics reality, not every creative or functional use of AI.

How Deepfake Regulations in India Work Under the New Framework

The term "deepfake" is now formally embedded in Indian law. Under the IT Rules 2026, deepfake regulations in India address specific harms that fall within the broader SGI definition. These include fabricated videos misrepresenting real people, AI-generated audio impersonating specific individuals, face-swapped intimate imagery, forged documents made to look authentic, and synthetic news or messages designed to deceive.

The practical implication is that courts and regulators now have a clear statutory hook when dealing with deepfake-related complaints. Before this amendment, legal action on deepfakes in India required improvised use of provisions from the Indian Penal Code (now the Bharatiya Nyaya Sanhita), the POCSO Act, or general IT Act provisions. The 2026 rules consolidate this and give enforcement agencies a more direct path to action.

The Three-Hour Takedown Rule: A Game-Changer

If there is one provision in the IT Rules 2026 that has grabbed every compliance professional's attention, it is the three-hour takedown window.

Under the previous framework, intermediaries had up to 36 hours to act upon government notices ordering the removal of unlawful content. That window has now been slashed by over 90 percent. Once an intermediary receives a valid order from a court of competent jurisdiction or a reasoned intimation from an authorized government officer, it must remove or disable access to the flagged content within three hours.

For certain categories of especially harmful synthetic content, such as non-consensual intimate imagery or morphed sexual content, the window is even shorter. Platforms must act within two hours of receiving a user complaint about such material.

Grievance officers must now acknowledge complaints within 24 hours and resolve them within seven days, down from the earlier 15-day timeline.

To put this in perspective, India now has one of the fastest statutory takedown deadlines in the world for AI-generated harmful content. The EU's AI Act allows up to 24 hours for removal in comparable situations. Singapore's online falsehood laws allow six hours. India's three-hour sprint places it at the strictest end of the global spectrum.

Whether this is achievable is a separate conversation. Many legal experts and platform representatives have flagged that meeting a three-hour window without making errors requires round-the-clock human and automated systems operating in tandem, and that the rushed compliance architecture could lead to erroneous takedowns of legitimate content. But as the law stands today, the obligation is real and the consequences for missing it are severe.

What Intermediaries Must Do: The New Compliance Obligations

The IT Rules 2026 synthetic content obligations apply broadly. "Intermediaries" under this framework include social media platforms, video-sharing services, messaging apps, hosting providers, generative AI tools, image and voice cloning services, and any digital platform that enables the creation, modification, or large-scale sharing of AI-generated content.

Here is a practical breakdown of what these platforms are now required to do.

Labeling and Metadata Requirements

All permitted SGI must carry a clear and prominent label visible to users. Beyond a surface-level label, platforms must embed permanent metadata including a unique identifier that traces the content back to the originating platform. Crucially, platforms are prohibited from facilitating the stripping of these labels or metadata markers. The goal is provenance: ensuring that even if a deepfake video travels across multiple platforms, its AI-generated origin remains detectable.

Technologies like cryptographic watermarks and C2PA (Coalition for Content Provenance and Authenticity) manifests are expected to play a key role in meeting this requirement, though MeitY has not yet published formal technical standards specifying acceptable formats.

Pre-Publication Verification for Significant Social Media Intermediaries

Significant Social Media Intermediaries (SSMIs), which are platforms with over five million registered users in India, face additional obligations under Rule 4(1A). They must require users to declare whether the content they are uploading is synthetically generated, verify those declarations through automated processes, and classify and label SGI appropriately before it goes live.

False declarations by users could attract penalties under the Bharatiya Nyaya Sanhita or POCSO, depending on the nature of the content. For SSMIs, failure in this pre-publication process is treated as a lapse in due diligence.

Proactive Technical Measures

All intermediaries offering AI tools must deploy "reasonable and appropriate technical measures" to prevent unlawful SGI from being published. This is a proactive, not reactive, obligation. The shift is significant: platforms are no longer merely expected to remove harmful content after it appears. They are expected to prevent it before it circulates.

The phrase "reasonable technical measures" is left intentionally flexible, with "technical feasibility" as the ceiling for what is expected. But that flexibility cuts both ways. Platforms that have not invested in detection infrastructure will find it difficult to argue that no reasonable measures were available to them.

User Awareness and Quarterly Notices

Intermediaries must inform users every three months about their rights, legal liabilities, and the rules around SGI. This is not a one-time disclosure buried in a terms-of-service document. It is a recurring, structured communication obligation.

What Happens If a Platform Gets It Wrong: Safe Harbour at Risk

This is where the IT Rules 2026 become most consequential for legal and compliance professionals.

Section 79 of the IT Act, 2000, has long been the structural backbone of India's platform economy. It provides intermediaries with what is commonly called "safe harbour": protection from legal liability for third-party content, as long as platforms follow due diligence requirements and comply with valid government orders.

The 2026 amendment fundamentally reconditions this protection. An intermediary that knowingly permits, promotes, or fails to act upon unlawful SGI, or that fails to comply with the three-hour takedown mandate after receiving a valid order, loses its Section 79 safe harbour protection. This exposes the platform to direct civil and criminal liability for content it hosts.

The phrase "knowingly permits" introduces what many legal analysts describe as a quasi-strict liability standard for the most serious categories of SGI harm. Platforms that deploy AI detection systems which probabilistically flag content will need to decide how to treat uncertain cases, knowing that getting it wrong could cost them their legal shield.

For foreign platforms operating in India, this is equally applicable. The rules cover all intermediaries offering services to Indian users, regardless of where the company is incorporated.

Critical Perspectives: What the Law Gets Right, and Where It Raises Concerns

No significant legislation arrives without debate, and the IT Rules 2026 are no exception.

On the positive side, digital rights organizations and legal experts have welcomed the explicit exemption of good-faith uses and pure text content from the SGI framework. The carving out of lawful from unlawful SGI, and the use of "technical feasibility" as the standard for compliance, are seen as sensible calibrations.

However, critics have raised several concerns worth noting. The three-hour takedown window, while symbolically powerful, is operationally punishing. Many platforms, especially smaller Indian startups, may not have the infrastructure to meet this deadline without either over-removing content or under-investing in accuracy. The risk of erroneous takedowns affecting satire, parody, political commentary, and artistic expression is real.

Civil liberties groups like SFLC.in have specifically flagged the "deemed failure" standard, which can result in loss of safe harbour upon mere awareness of an SGI violation, as potentially leading to overmonitoring and excessive censorship. The absence of prescribed technical standards for watermarking and metadata, combined with a requirement that labels be permanent and tamper-resistant, creates a compliance target that platforms must shoot at without knowing exactly what the bullseye looks like.

The Bigger Picture: India's Place in the Global AI Governance Conversation

India joining the group of countries with formal synthetic content law is significant for more reasons than domestic compliance. With over a billion internet users and a rapidly growing AI ecosystem, India is increasingly seen as a bellwether for how large democracies choose to govern AI.

The IT Rules 2026 align India with the direction of the EU AI Act, which similarly mandates provenance marking for synthetic content, while also going further on enforcement speed. They reflect a broader global trend: China introduced its Deep Synthesis Provisions in 2023, California passed AB 1836 on AI in entertainment, and South Korea has its own AI regulation framework in development.

For legal professionals in India, this is a foundational moment. The coming years will bring litigation around what constitutes "knowing permission" of unlawful SGI, what qualifies as "reasonable technical measures," and how courts balance the three-hour takedown mandate against constitutional free speech protections under Article 19(1)(a). These are open questions that will need judicial answers.

What This Means for You: Lawyers, Businesses, and Everyday Users

If you are a lawyer or law student, the IT Rules 2026 synthetic content framework is already generating new questions in client advisory work: privacy rights, platform liability, AI-generated evidence in court, and the intersection of synthetic content with electoral law, criminal law, and intellectual property.

If you are a business operating a digital platform, content tool, or AI service in India, compliance with deepfake regulations in India is no longer optional or aspirational. It is a condition for retaining safe harbour under the IT Act.

If you are an everyday user, the rules give you sharper tools. Faster grievance redressal, stronger platform obligations around harmful synthetic content, and the right to seek identity disclosure of those who misuse AI to harm you are now part of the legal framework.

The IT Rules 2026 are a beginning, not an endpoint. The forthcoming Digital India Act is expected to go further, especially into questions of liability for fully autonomous AI agents, where the law has yet to catch up with the technology.

For now, the message from MeitY is clear: if AI-generated content can cause harm, the law will hold someone accountable. The question every platform, lawyer, and creator must now answer is: who is that someone, and what must they do?

FAQs

Q1. What is “synthetically generated information” under the IT Rules 2026?

Under the IT Rules 2026 synthetic content India framework, “synthetically generated information” (SGI) refers to AI-generated or AI-manipulated audio, video, or visual content that appears authentic but depicts events, people, or situations that did not actually occur. This includes deepfake videos, AI voice clones, face swaps, and manipulated media designed to look real.

Q2. What are the new takedown obligations for platforms under the IT Rules 2026?

The IT Rules 2026 require intermediaries to remove or disable access to unlawful synthetic content within three hours of receiving a valid government or court order. For highly sensitive categories such as non-consensual intimate imagery or morphed sexual content, platforms must act within two hours of receiving a complaint from a user.

Q3. Do the IT Rules 2026 apply to all AI-generated content?

No. The law specifically targets harmful or misleading synthetic media that mimics reality. Routine photo editing, accessibility features, educational illustrations, research content, and purely text-based AI-generated content are generally excluded from the SGI framework, provided they are not intended to deceive or cause harm.

Q4. What happens if a platform fails to comply with the IT Rules 2026 synthetic content India obligations?

If a platform knowingly allows unlawful SGI to remain online or fails to comply with takedown and labeling obligations, it risks losing its Section 79 “safe harbour” protection under the IT Act. This means the platform could face direct civil and criminal liability for user-generated content hosted on its services.