October is recognised globally as Cyber Awareness Month. This year, the Maharashtra government kicked off the campaign with a clear message: cyber threats are no longer technical glitches; they’re social emergencies. It has become a social emergency, one that affects every user with a smartphone, a bank account, or even a social media profile. What was once dismissed as “technical fraud” now strikes at the core of personal dignity and national security. Actor Akshay Kumar, speaking at the launch event in Mumbai, shared a chilling anecdote of how his daughter was asked for inappropriate photos while playing an online game.
The incident wasn’t just disturbing; it was emblematic of how deeply cybercrime has infiltrated our everyday lives. India’s digital populationexceeds 800 million. With this expansion comes vulnerability of scale; every new user is a potential target. The National Crime Records Bureau reports that cybercrime cases have risen by 31% in India. The victims are not confined to corporations or government departments; they include students, small entrepreneurs, senior citizens, and increasingly, women and children. The instruments of attack are diverse and creative.
India’s legal framework is not blind. The Information Technology Act, 2000 (as amended in 2008), remains India’s principal cyber-law framework. It criminalizes identity theft and “cheating by personation” under Sections 66C and 66D. But these statutes were drafted in the pre-AI era. While India’s cyber statutes address conventional digital offenses, they remain ill-equipped to confront the emergent risks posed by generative artificial intelligence. For illustration, if you see, when an AI image generator recreates a person’s face with a mole or tattoo identical to the real one, it violates privacy and likeness.
But Section 66E (punishing violation of privacy through capturing or publishing private images) applies only when a person intentionally captures or transmits an image. AI does not “capture”, it “creates.” Hence, the act slips through the statutory cracks. The IT Act does not govern how such data may be collected or used.
The only safeguard lies in the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which cover personal data like health records, financial information, and passwords; not facial features, voice patterns, or creative works.
If a deepfake of a student is shared online, it destroys their social standing. Yet, the IT Act would only allow action under Section 67(obscenity) or IPC Section 499 (defamation). Both require proof of intent or knowledge, which is impossible when content is created autonomously by an AI.The Digital Personal Data Protection Act, 2023, prohibits processing of personal data without consent (Section 4(1)), but developers argue that AI-generated likenesses are not “real” and therefore fall outside the law. This is a dangerous loophole, since a non-consensual synthetic image can have the same impact as a real one. Indian courts have recognised “personality rights” mainly in celebrity cases, like ICC Development(International)Ltd v. Arvee EnterprisesandAnr (2003) and Titan Industries v. Ramkumar Jewellers (2012), but there is no statutory framework protecting ordinary citizens’ digital identity.
Globally, the EU’s Artificial Intelligence Act and OECD AI Principles already impose duties of transparency, explainability, and watermarking for AI-generated content. India, however, has only advisory measures from MeitY (2024) asking intermediaries to label AI-made material and remove deepfakes. Without a binding law, enforcement depends on voluntary compliance.
In the meantime, citizens must practice what can be called “digital self-defence.” Limit facial data online, use reverse-image search to detect misuse, and avoid uploading biometric likenesses to unverified sites. These personal steps are small but essential until the law expands to keep pace with technology’s speed.
Author Name- Isha R, a second-year B.A. LL.B student.
