Deepfake and Morphed Photo Removal in India: Complaint, Sections and the Two-Hour Lane

One question decides the route. Does the image expose a private area, show you in full or partial nudity, depict you in a sexual act, or impersonate you? If so, Rule 3(2)(b) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 applies: within two hours of a complaint by you or by anyone on your behalf, an intermediary must take all reasonable and practicable measures to remove content in the nature of impersonation in an electronic form, including artificially morphed images of such individual. The phrase was drafted for exactly this. The clock was 24 hours until 20 February 2026, when G.S.R. 120(E) cut it to two.

A deepfake that is not intimate needs one more question. If it impersonates you, putting your face or voice to words or acts that are not yours, it is still impersonation in an electronic form, and your complaint can cite Rule 3(2)(b) and its two-hour clock. If it defames you without impersonating you, a fabricated story, a doctored caption or a fake screenshot, there is no such clock. The October 2022 amendment removed the word defamatory from Rule 3(1)(b); defamation now falls only under sub-clause (xi), the catch-all for content that violates any law, which the rules leave out of the 36-hour lane, so a grievance about it is acknowledged within 24 hours and resolved within seven days under Rule 3(2)(a)(i). Either way, the lasting remedy for a political or commercial deepfake is a notice under advocate signature and a court where needed, which is the subject of our guide to AI-generated defamation and deepfakes and is not repeated here.

The three-hour figure belongs to Rule 3(1)(d). It runs from the platform's receipt of a court order or a reasoned government intimation, and since Shreya Singhal v. Union of India (2015) that is the only way actual knowledge arises under Section 79 of the IT Act. There is no three-hour deepfake deadline; there is a three-hour clock once a court has spoken, and for an intimate morph you rarely need one, because the two-hour obligation already runs on your own complaint.

Preserve first: full-page screenshots with the address bar and date visible, every URL, the account that posted it, the message in which you first received it, and the original photograph the morph was built from. Do not delete conversations you are ashamed of; they show the image was never yours. Send us the URLs, never the file.

A morphed intimate image is reported on the National Cyber Crime Reporting Portal at cybercrime.gov.in under the category for women- and child-related crime, which can be filed without identifying yourself; the helpline is 1930. The complaint reaches the state cyber cell, which is an investigative route into the person who made and shared the image. It is not a removal desk: the cyber cell does not take the picture down, and a portal complaint on its own starts no platform clock.

Removal is a separate act by each platform, and it starts with a dated complaint to that platform's grievance officer, not the ordinary report button, stating that the image is a morph of you and citing Rule 3(2)(b). Instagram and Facebook have their own page in this hub; X, Reddit and YouTube carry the same two-hour obligation; Telegram channels go to its abuse desk. Google's request for fake explicit imagery is filed alongside, on the three conditions in its policy, because it removes the search result while the host still has to act.

StopNCII helps only where the morph was built from a real intimate image of you and you are over 18: a hash is generated on your own device, the image never leaves it, and partner platforms block matching uploads. A morph made from a clothed photograph has no intimate original to hash, so for most deepfakes re-uploads are caught by monitoring. Every other route in this section is on the day-one list of the paid sweep; StopNCII is the one step you take yourself, on your own device.

Yes, on several counts, although no Indian statute uses the word deepfake. Section 67 of the IT Act 2000 punishes publishing or transmitting obscene material in electronic form; Section 67A covers material containing a sexually explicit act, with heavier terms; Section 67B applies wherever the person depicted is a child, and is dealt with below. The table sets out the punishments.

Section 66E is the section most often cited for photo morphing, and it needs a caveat. It punishes intentionally capturing, publishing or transmitting the image of a private area of any person without consent. The Act's Explanation defines private area as the naked or undergarment clad genitals, pubic area, buttocks or female breast. A morph that pastes your face onto someone else's body does not, on the literal text, capture an image of your private area, so a complaint resting on 66E alone invites that answer. It is invoked alongside 67 and 67A, not instead of them.

Section 77B settles arrest and bail: offences punishable with three years or more are cognizable, and offences punishable with exactly three years are bailable. Sections 66E and 67, at three years on a first conviction, are therefore cognizable and bailable; Section 67A, at five years, is cognizable and falls outside the bailable rule.

The Bharatiya Nyaya Sanhita 2023 adds the reputation offences. Section 336(4) covers forgery of an electronic record intended to harm the reputation of any party, and a fabricated image is a false electronic record. Section 356 is defamation. Section 79 covers any act intended to insult the modesty of a woman, including intruding on her privacy. Section 351 is criminal intimidation where the morph is used to threaten, with sub-section (3) reaching seven years where the threat is to impute unchastity to a woman and sub-section (4) adding a term where the threat is anonymous. For anyone searching for the photo morphing IPC section: IPC 499 and 500 are now BNS 356, IPC 469 is BNS 336(4), IPC 509 is BNS 79, and IPC 506 and 507 are BNS 351(3) and (4). The IT Act sections are unchanged.

G.S.R. 120(E), notified on 10 February 2026 and in force from 20 February, wrote deepfakes into the IT Rules by name. Rule 2(1)(wa) defines synthetically generated information as audio, visual or audio-visual information which is artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that such information appears to be real, authentic or true, and which depicts a person or event so that it is likely to be perceived as indistinguishable from a real one. Routine, good-faith editing and compression are excluded.

Rule 3(3)(a)(i) puts a duty on the tool. An intermediary whose service enables synthetic content must deploy reasonable technical measures, including automated tools, to not allow any user to create, modify, publish or share synthetic content that violates the law, which the rule says includes material containing non-consensual intimate imagery content or invasive of another person's privacy, including bodily privacy (sub-clause (I)), and material that falsely depicts a natural person by misrepresenting that person's identity, voice, conduct, action or statement in a manner likely to deceive (sub-clause (IV)).

Rule 3(3)(a)(ii) requires every other piece of synthetic content to be prominently labelled and embedded with permanent metadata, including a unique identifier for the tool that made it, and Rule 3(3)(b) forbids the intermediary from enabling that label to be removed. Rule 4(1A) adds, for significant social media intermediaries, a user declaration before upload, technical verification of it, and a visible label. Rule 2(1A) makes the point that matters most here: information used to commit an unlawful act includes synthetically generated information.

Read together, the labelling duty is a labelling obligation, not a removal deadline. The removal deadline for an intimate deepfake is still the two hours in Rule 3(2)(b); a label does not make such an image lawful, and a platform that leaves it up after a complaint is outside the due diligence on which its Section 79 protection depends. What the 2026 rules add is a second target for the notice: the tool that generated the image, which now has its own obligation not to have allowed it.

Day one is filing. Rule 3(2)(b) complaints go to the grievance officer of every platform where the image has been found, each one dated; Google's request for fake explicit imagery, the adult sites' non-consensual content forms and Telegram's abuse desk are filed the same day; where a real intimate original exists, you register its hash with StopNCII on your own device. Every one of those routes can be filed by anyone. What is paid for is filing all of them in parallel on the day, and what follows.

What follows is the sweep. A morphed image rarely stays at one URL: it is reposted to aggregator sites, file lockers, forum threads and Telegram channels, and Google Images indexes all of them. We map the full spread, including copies you have not seen, and work every URL with the host, the CDN, the registrar and the search engines. Removing only the copy you know about is the classic failure here, because the remaining copies re-seed the search results within days.

Timings are typical, not promised. Indian-regulated platforms are bound to two hours by statute. The major international adult sites act on a correctly filed report typically within 24 to 48 hours. Google takes days; Telegram publishes no turnaround; small offshore hosts vary and are escalated to their upstream provider and, where a host refuses, to a court order and blocking through the partner law firm. Across the practice the success rate is 97%, stated as a rate, not a promise.

Three things we do not claim. We do not run proprietary detection technology; the tools that matter are the platforms' own hash-matching systems. We cannot delete a file already delivered to someone's phone, and anyone who promises that is not being straight with you. And we do not trace the person who made the image ourselves: identification comes through the court process run by our partner law firm, Unified Chambers And Associates, by an application for disclosure of the account holder's basic subscriber information, the order the Bombay High Court made on 5 August 2026 in a deepfake suit.

This category is quoted as a sweep after the spread is mapped, so you know the number before committing, with concessional rates for individuals and no emergency surcharge. Fees are payable in advance and are refunded in full for any URL not removed within the timeline agreed for it, including where a platform refuses. An NDA is executed before any case discussion.

A deepfake that puts words in a minister's mouth or a fake endorsement by an actor is an impersonation, defamation and personality-rights matter. The person depicted can file the Rule 3(2)(b) complaint, but the lasting relief comes from the civil court. On 5 August 2026, in Nitin Gadkari v. Meta Platforms Inc. and others, Justice Arif Doctor of the Bombay High Court described the AI-generated material before him as absolutely vile and abusive, and directed the platforms to take down the listed content and any further content the plaintiff flags, and to disclose the basic subscriber information of the accounts that posted it. That is the shape of the civil route: an order, disclosure and a standing mechanism, and once a court order is served the platform is on the three-hour clock under Rule 3(1)(d).

During elections a further lever exists. The Election Commission's direction of 6 May 2024 tells political parties to take down deepfake audio and video within three hours of it coming to their notice, and to report unlawful content and fake accounts to the platform concerned. That binds parties, not platforms, and it matters when the deepfake is coming from a rival campaign. The sections, the ex parte injunction and tracing are in our guide to AI-generated defamation and deepfakes; the standing arrangements for public figures are on the politicians and celebrities pages.

If the person in the image is under 18, real or morphed, it is child sexual abuse material and not a reputation matter. Section 67B of the IT Act punishes anyone who publishes, creates, collects, browses, downloads or distributes material depicting a child in a sexually explicit manner, and the Protection of Children from Sexual Offences Act 2012 applies alongside it. Rule 3(3)(a)(i)(I) names child sexual exploitative and abuse material first among the synthetic content a tool must not allow.

The only route is an immediate report to the police, to cybercrime.gov.in under the category for women- and child-related crime, or on 1930. RepuLex does not take on any matter in which the person depicted is under 18, paid or unpaid, and will not accept an instruction to handle such an image quietly instead of reporting it.