Me, Myself and AI: Chasing Deepfakes Across Borders Without Losing Your Rights

Introduction

The rapid growth of generative artificial intelligence (Gen-AI) and unhindered access to applications that enhance interface between users and AI has created new frontiers for personality and identity rights.¹ Deepfake technologies harness photographs, voices and other personal traits of real people to clone or manipulate them with near-perfect realism. The resulting manipulated data of individuals is often globally disseminated across many platforms with little to no restriction.² India does not have any standard legal framework to regulate the creation and global dissemination of such data. Heavy reliance is placed on the diplomatic skills of its envoys and on a patchwork of laws governing privacy, defamation and intellectual property doctrines to address prejudiced artificial intelligence (AI) generated content.³ Against this backdrop, two interlinked issues have been highlighted to give a glimpse of the scale of the challenge that the Indian legal system faces from the misuse of Gen-AI. The first is the fragile balance of an individual’s personality rights against the constitutional guarantee of free speech when making sensitive references, parody and satire. The second is the inability of Indian courts to address cross-border misuse of deepfakes restricted by limited jurisdictional powers. Traditional conflict of law principles and existing treaties only offer partial remedies but there is no standard mechanism through which Indian courts can assert or coordinate jurisdiction to ensure meaningful protection.⁴ However, excessively broadening legal controls can have a chilling effect on legitimate expression and a framework should aim at both safeguarding personal rights of individuals and legitimate expressions.⁵ These issues call for a deeper examination of the legal paths and remedies available to individuals who are targeted by deepfakes, particularly when such content is created and disseminated outside India.

The tensions between personality rights in Indian law versus freedom of speech under Article 19(1)(a) of the Constitution

Freedom of speech under Article 19(1)(a) of the Indian Constitution is not unfettered and often comes in conflict with right to privacy.⁶ In Indian Express Newspapers (Bombay) (P) Ltd. v. Union of India⁷, the Court clarified that freedom of speech has to be balanced against an individual’s right to preserve their reputation and dignity. In reference to parodies and satire, while judicial interpretations of Article 19(1)(a) in cases such as S. Khushboo v. Kanniammal⁸ and Ashutosh Dubey v. Netflix Inc.⁹ do broaden the scope of freedom of speech, they also limit the freedom from crossing into the territory of defamation or obscenity. Thus, deepfakes that mock or parody public figures could fall into this category but the challenge remains with the claimant to distinguish between constitutionally protected satirical content and harmful, misleading or malicious representations.

Unlike the right to freedom of speech, the term “personality rights” is not explicitly defined under any Indian statute. Its scope is instead inferred from laws governing privacy, defamation, and the misappropriation of an individual’s likeness.¹⁰ Judicial interpretations of privacy and defamation have further clarified that an individual can exercise control over their name, image, voice and other personal attributes, and prevent their unauthorised commercial use.¹¹ K.S. Puttaswamy v. Union of India¹², recognised the right to privacy to come within the purview of Article 21 of the Indian Constitution and thus laid the foundation for individuals to exercise control over their personal data, image and likeness. This case is particularly relevant when bringing a claim against deepfakes, since, it recognises the unauthorised use of individual’s likeness to be violative of their privacy. Furthermore, claims against deepfakes and synthetically generated data can also be part of a defamation claim, since Indian defamation law pursuant to Sections 499 and 500, Penal Code protects individuals from false statements.¹³ Judicial interpretations in the case of Anil Kapoor¹⁴ also show that a claim of defamation may also extend to AI-generated content if the deepfakes are unauthorised and distort reality to harm an individual’s reputation.¹⁵ This understanding can be further extended by the interpretation seen in Subramanian Swamy v. Union of India¹⁶ which clarified that freedom of speech does not extend to an act that defames an individual. In 2016, the Delhi High Court in Titan Industries Ltd. v. Ramkumar Jewellers¹⁷ acknowledged the concept of the right to publicity, stating that an individual has the right to control the commercial use of their identity. While this judgment pertains to commercial exploitation, it can be applied broadly to protect against the unauthorised use of likeness, voice, and identity in deepfakes. Indian courts have not yet directly addressed the nature of AI-generated content with respect to personality rights. However, from the aforementioned judgments, it can be construed that misappropriating someone’s likeness for malicious purposes is an infringement on an individual’s personal rights.

Prosecuting AI-generated deepfakes and synthetic media under existing Indian legal doctrines and its territorial limits

(i) Defamation

The existing legal framework on defamation in India attaches liability to harmful and untrue statements made about individuals but does not directly accommodate AI-generated media. Given the nature of deepfakes, they may not immediately be categorised as defamation but the legal limits can be stretched to cover them.¹⁸ For instance, under Section 499 IPC, publication of any imputation harming an individual’s reputation may give rise to a civil claim for libel, which can potentially extend to AI-generated deepfakes.¹⁹ Deepfakes can also be criminalised pursuant to Sections 66-C, 66-D, 66-E, 67, 67-A, 67-B and 79, Information Technology Act, 2000 (IT Act, 2000).²⁰ These provisions delineate “identity theft” as the dishonest replication of a person’s signature, image and voice. Furthermore, they also attach criminal liability to cheating by impersonation through computer resources, which directly govern the creation and dissemination of deepfakes, especially when found to be obscene or sexually explicit electronic content. Most importantly, Sections 66-E and 79 punishes privacy violations as a result of publishing or transmitting images of an individual’s private areas without their consent, making this provision directly applicable to non-consensual sexualised deepfakes. Obligations are also placed on social media platforms to exercise due diligence to comply with the Intermediary Guidelines under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 such as expedient response to act on notices and removal of deepfake content. In 2023, in the case of Anil Kapoor²¹, the Delhi High Court, granted an omnibus, ex parte injunction to restrain the defendants as well as anyone and everyone from using Anil Kapoor’s name, image, voice, likeness or other personal attributes for commercial exploitation without consent. While the order can be considered the leading precedent on personality rights and AI misuse, it however, does not discuss the non-commercial use of such images and their implications on the rights of an individual.²² A similar ruling was also subsequently upheld in Jaikishan Kakubhai Saraf v. Peppy Store²³ (Jackie Shroff case). Precedents through public interest writ petitions such as Chaitanya Rohilla v. Union of India²⁴ and Rajat Sharma v. Union of India²⁵ also highlight the need for government regulation on mechanisms such as dynamic injunctions in addition to individual damages to deal with the systemic risks of deepfakes and synthetic data. In the last two years, a wave of interim takedowns on behalf of celebrities such as Aishwarya Rai Bachchan, Abhishek Bachchan and Nagarjuna also highlight judicial recognition of the urgency of removing AI-generated content pursuant to their privacy rights, personality rights and rights against defamation.²⁶ Such claims however, can be limited by territorial restrictions.

Traditional conflict of law principles in India are ill-suited for complex digital content like deepfakes, which may be created in one jurisdiction but disseminated globally.²⁷ The IPC and IT Act, 2000 govern offences committed within India, creating jurisdictional challenges for content generated abroad, even if it affects Indian citizens.²⁸ Current laws on defamation, privacy, and misrepresentation do not provide specific guidance for extraterritorial AI content.²⁹ Enforcement however can be sought under Section 75 IT Act, 2000 which extends the jurisdiction of Indian courts to also cover offences arising through digital activities that affect citizens of India even if the offence was committed outside the country.³⁰ Theoretically, this can provide the courts with the relevant jurisdiction over foreign platforms that host or disseminate defamatory or privacy violating content. Enforcement is however an issue if the foreign jurisdiction or the foreign platform refuses to cooperate.

(ii) Copyright and trade mark

The existing copyright framework under Section 13, Copyright Act, 1957 protects original works covering artistic and literary works.³¹ Deepfakes however are created by the manipulation of existing images or likeness of individuals and may thus not fit within the traditional concept of copyright. While this does raise the moral question of whether misuse of a person’s likeness without their consent infringes their moral rights under Section 57, Copyright Act, 1957, it does permit a claim to be brought if such distortion or misrepresentation of their likeness was done without their consent.³² Section 57, Copyright Act, 1957 allows authors and performers to demand attribution and prevent distortions that harm their reputation, it also treats unauthorised use copyrighted images or videos in deepfakes as infringement. Additionally, deepfakes using well-known brand names or catchphrases may trigger liability under Section 29, Trade Marks Act, 1999, which addresses trade mark infringement or passing off.³³

In Neela Film Productions (P) Ltd. v. TaarakMehtakaooltahchashmah.com³⁴, the Court noted that, even deepfake AI-generated content of fictional characters can construe infringement of copyright and trade mark of the characters registered to the media house. The Court also granted an ex parte ad interim injunction, restraining defendants and a John doe order to restrain all unknown parties including websites, e-commerce platforms, and YouTube channels from infringing Neela Film Productions’ copyright and trade mark rights. It is imperative to note that, while it may be possible to decide the law of the place which will apply to crimes on the basis of where the harm occurs (through the principle of lex loci delicti), it may become difficult in cases related to deepfakes that are created outside the jurisdiction of India.³⁵ The laws related to crimes committed through artificial intelligence that are beyond the comprehension of existing recognised cybercrimes are unclear and will thus complicate its enforcement pursuant to Indian legal standards.³⁶

(iii) Privacy

Going by the analysis drawn in the Puttaswamy case³⁷ and R. Rajagopal v. State of T.N.³⁸, the right to control one’s likeness and prevent its unauthorised use falls under their right to privacy. Thus, deepfakes by their very nature when made without consent should be subject to privacy protections. In Kamya Buch v. JIX5A³⁹, the Delhi High Court granted ad interim relief to the claimant whose reputation was harmed due to non-consensual dissemination of her morphed images involving explicit content. The Court ordered multiple online platforms to take down content related to her to protect the privacy of her identity. Similarly, in Ankur Warikoo v. John Doe⁴⁰, a social media influencer obtained a John Doe injunctive order to restrain all entities from using his name, image, voice and likeness (including AI or deepfake) for personal or commercial gain. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require all social media companies and streaming services to take a proactive approach against generation of harmful content such as deepfakes, that are in violation of Indian laws. Even though these regulations impose a duty of care on intermediaries, they do not address cross-border enforcement issues. In the absence of international cooperation, Indian courts may not be able to compel companies to remove harmful content or comply with court orders.⁴¹ Furthermore, the position of the Indian legal system pertaining to AI or deepfake technologies is also limited and thus countries with less stringent laws pertaining to these crimes may not recognise or enforce court decisions made by Indian courts. In turn, this may also undermine the efficacy of legal recourse in India for people seeking to take down content related to them in platforms operating in other countries.⁴²

Introducing mechanisms to address cross-jurisdictional creation of deepfakes or misuse of AI-generated content under the Indian legal framework

The current limitations on extraterritorial jurisdiction of deepfakes can make its prosecution difficult. The approach to prosecuting deepfakes and other synthetically generated AI content in India must be updated.

Necessity to introduce mechanisms for recognition and enforcement of Indian court orders against foreign platforms

Given the rapid advancements in AI and the global nature of digital content, the urgency for an international legal framework that addresses cross-border identity violations, specifically addressing deepfake is necessary. The current treaties and national laws in India are insufficient to deal with such challenges and a multifaceted approach must be taken. A few of the recommended mechanisms may be as follows:

(i) Creation of a global treaty on digital content: Currently there is no specific law anywhere in the world that addresses deepfakes and its extraterritorial nature head on. India must advocate for the establishment of an international treaty that specifically addresses the misuse of AI-generated content that sets clear norms and regulations for AI-driven content including deepfakes and provide mechanisms for cross-border recognition and enforcement of judgements related to privacy violations and other harms caused by digital misuse.⁴³

(ii) Extra-territorial application of Indian law: To address concerns of cross-jurisdictional difficulties in protecting and enforcing laws against deepfakes, provisions must be introduced for Indian courts to apply domestic laws extraterritorially. In the absence of a global treaty, this can be done by entering into multiple bilateral treaties that share a mutual objective of preventing deepfake dissemination. To further effectuate approach, India must seek broader international cooperation on enforcement, particularly from countries with lot of tech activity.⁴⁴

(iii) Updating Indian domestic laws: While the United States lacks a federal definition of deepfakes, Texas defines them under Texas Election Code, Section 255.004⁴⁵ as “deceptive audio or visual material” that reasonably appears to depict a public official saying or doing something they did not do, created with intent to influence an election and known to be deceptive.⁴⁶ The IT Act, 2000 and the Digital Personal Data Protection Act, 2023 of India must be similarly updated to specifically address AI-generated content, especially deepfakes. Clear provisions that address protection of an individual’s likeness, voice and image against AI-based manipulation must be introduced.⁴⁷ The provisions must also make specific references to governance and remedies of content hosted in foreign platforms. These include penalties for deepfakes created or disseminated with prejudice and for non-compliance with intermediary rules for all content platforms.⁴⁸

Conclusion

In the kaleidoscopic world of AI, anyone and everyone can be cloned, animated and morphed into anything. Deepfakes are a very powerful tool in such pursuits and have been a game changer in the digital landscape. While the Indian legal system does have several overarching laws governing privacy, defamation and copyright, its position is more like an outdated firewall when attempting to prosecute AI-based crimes. Its efficacy is limited to its borders but vulnerable in circumstances involving cross-border crimes. Courts have not shied away from extending the existing doctrines to cover AI-generated content but are constantly faced with the dilemma of having to protect personality rights without diminishing the importance of free speech. However, the extraterritorial nature of deepfakes challenges this balance. To make matters worse, international cooperation on this subject continues to be fragmented. However, all hope is not lost and pursuing global treaties, bilateral agreements and updating the current domestic laws governing AI-generated content may serve as a robust preventing mechanism in the absence of specific laws governing such content. Deepfakes may bend reality, however, with thoughtful reforms they can be controlled and the people responsible for the creation and dissemination of such data can be held accountable from any part of the world. This would ensure that in an AI-dominate future, creativity can coexist with human rights.