Last year, a friend of mine got a WhatsApp call. The caller’s face was her younger brother. The voice was her younger brother. He was crying, said he had been picked up by police, and asked her to send ?40,000 right away to a UPI ID. She almost did it.
Her real brother was sitting in his Pune office, on a regular Tuesday, doing nothing of the sort.
This is what we’re up against now. And if you’ve been reading this blog, you already know the routine – fake CBI officers, “Digital Arrest” video calls, morphed photos, voice notes from “your son.” The scams have gotten so good that spotting them is no longer enough. You also need to know how to fight back once you’ve been hit.
That’s where the IT Amendment Rules, 2026 come in. They quietly came into force on 20 February 2026, and most people still have no idea what they actually changed. So let’s talk about it – because for once, the law is actually on the victim’s side.
So What Actually Changed?
On 10 February 2026, the Ministry of Electronics and IT (MeitY) notified some pretty serious amendments to the old IT Rules from 2021. They went live ten days later.
The big new word you need to know is SGI – Synthetically Generated Information. It’s the law’s way of saying “deepfakes and AI-faked content,” but written so it covers everything: voice clones, morphed photos, AI-generated videos, fake “screenshots,” all of it.
If something is artificially created or altered to look real and pretend to be a real person or event – it’s SGI. And SGI now has rules.
Don’t panic about your Instagram filters or that AI-touched-up wedding photo, though. Routine stuff is excluded – colour correction, auto-captions, accessibility tools, AI-assisted writing in your work emails. The law is going after the deceptive stuff, not the harmless stuff.
The Part That Actually Matters: The Clock
Here’s the thing that genuinely changed the game. Before 2026, if a deepfake of you went up on Instagram, the platform had 24 hours to take it down after you complained. By the time they got to it, half your office had already seen it.
The new rules cut that down to 2 hours. That’s not a typo.
| What’s Being Taken Down | Old Timeline | New Timeline |
| Deepfake porn / impersonation / non-consensual imagery | 24 hours | 2 hours |
| Content flagged by court / government notice | 36 hours | 3 hours |
| Grievance officer’s final response | 15 days | 7 days |
| User reminders about content rules | once a year | every 3 months |
| AI-content labelling | optional, vague | Mandatory + permanent metadata |
Two hours. That’s the time it takes to watch half a movie. That’s the new window platforms have to act when someone reports a deepfake of you.
And if they miss the deadline? They lose their “safe harbour” protection under Section 79 of the IT Act. In plain English – they can be sued as if they made the deepfake themselves. Which is why Meta, Google, and X have been quietly tripling the size of their India compliance teams since February.
Mandatory Labels (And the “No-Strip” Rule)
The second big change is that AI content can no longer pretend to be real.
If a video is AI-generated, the platform has to slap a clear, visible label on it. If it’s audio, there has to be a spoken disclaimer at the start. And the file itself has to carry permanent metadata – basically a digital fingerprint – that traces back to the tool that made it.
Now here’s the clever bit. The rules also say platforms can’t offer any tool that lets you remove those labels. No “remove watermark” buttons. No “strip metadata” features. The label is supposed to travel with the file, even if someone screenshots it and forwards it on WhatsApp.
What To Do If You Get Deepfaked
Okay, this is the part that actually matters to you. Here’s what to do – in order, no skipping steps.
- Report it on the platform RIGHT NOW.
Don’t wait. Don’t gather evidence first. Don’t think about it. Open the app, find the report button, and flag the content as impersonation or non-consensual intimate imagery (whichever applies). The 2-hour clock starts the second you hit submit. Screenshot the complaint reference number – this is your proof that the timer started. - Take screenshots before it disappears.
Once you’ve reported it, then save evidence. URL, username, timestamp, the content itself. Keep it in a folder. You’ll need it. - Email the platform’s Grievance Officer.
Every big platform has to publish this email. State clearly that the content is SGI under Rule 2(1)(wa) and that you’re invoking the 2-hour takedown timeline. Mentioning the rule number signals you know what you’re talking about – it usually triggers their compliance team to take you seriously instead of sending a generic auto-reply. - File an FIR with cyber police.
Go to cybercrime.gov.in or call 1930. The relevant offences now sit under the Bharatiya Nyaya Sanhita, 2023 – the new criminal code that replaced the IPC. Identity theft, cheating by personation, sexual harassment, defamation, forgery of electronic records – most deepfake cases tick at least two or three of these. The cyber cell can also legally demand the platform unmask whoever uploaded it. - If it’s serious – go to the High Court.
If a deepfake is causing real damage (financial fraud, viral spread, reputational harm), don’t just wait. File for an injunction at your High Court. Indian courts have already granted these in deepfake cases involving celebrities like NTR Jr., and a court order makes the 3-hour government takedown clock start at every platform that hosts a copy.
A Few Honest Caveats
I’d be doing you a disservice if I made it sound like the rules are perfect. They’re not.
Free speech groups like the Internet Freedom Foundation have flagged real worries – a 2-hour deadline doesn’t leave much room for the platform to actually think before pulling something down. Satire gets caught in the net. Journalism gets caught in the net. Political memes get caught in the net. The rules don’t really distinguish between “deepfake of a politician taking a bribe” and “obvious parody of a politician.”
There’s also the smaller-platform problem. Meta can afford a 24/7 legal team in Bangalore. Your favourite niche app probably can’t. Some Indian startups may genuinely struggle with this.
But for the specific stuff this blog covers – the scams, the digital arrest calls, the morphed photos used to extort, the voice clones used to defraud parents – the new rules are a real upgrade. The clock is finally working for the victim instead of against them.
This is general awareness, not legal advice. If you’ve been hit by a deepfake or impersonation scam, file a complaint at cybercrime.gov.in, call 1930, and consider talking to a cyber lawyer. Don’t sit on it – the 2-hour clock doesn’t start until you do.1
- This is general awareness, not legal advice. If you’ve been hit by a deepfake or impersonation scam, file a complaint at cybercrime.gov.in, call 1930, and consider talking to a cyber lawyer. Don’t sit on it — the 2-hour clock doesn’t start until you do. ↩︎
