How to File a Complaint Under the IT Rules 2026 Against Deepfakes in India

Kaustav Chowdhury
3 hours ago
4 min read

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026, notified by the Ministry of Electronics and Information Technology (MeitY) on February 10, 2026, and effective from February 20, 2026, introduced India's first comprehensive legal framework for addressing deepfakes and synthetically generated information (SGI). The Rules impose a three-hour takedown deadline on intermediaries for certain categories of harmful synthetic content and create a structured complaint mechanism for victims. This guide explains the step-by-step process for filing a complaint against deepfakes under the new framework.

What Qualifies as Synthetically Generated Information Under the 2026 Rules?

The 2026 Amendment Rules define synthetically generated information (SGI) as 'information that appears to be reasonably authentic or true but is artificially or algorithmically generated, modified, or altered using a computer resource.' This includes AI-generated photographs, deepfake videos, artificially produced audio (with or without images), and any other content that is indistinguishable from authentic content.

The definition is deliberately broad and technology-neutral. It covers content generated by generative AI tools, face-swapping applications, voice cloning software, and any other technology that produces synthetic content capable of deceiving a reasonable person. The IT Intermediary Guidelines Second Amendment Rules 2026 set out the detailed obligations for platforms hosting such content.

Step 1: Document the Deepfake Content

Before filing a complaint, it is essential to preserve evidence of the deepfake content. Take screenshots and screen recordings of the content as it appears on the platform. Record the URL, the username or channel name of the person who posted it, the date and time of posting, and any engagement metrics (views, shares, comments) that are visible.

If possible, download the content for offline preservation. Courts and law enforcement may require the original evidence, and content can be removed by the poster before authorities act. Maintaining a chain of evidence from the outset strengthens any subsequent legal proceedings.

Step 2: File a Complaint with the Platform's Grievance Officer

Under the IT (Intermediary Guidelines) Rules, every significant social media intermediary (SSMI) with more than 50 lakh registered users in India must appoint a Grievance Officer who is a resident of India. The Grievance Officer must acknowledge the complaint within 24 hours and resolve it within 15 days.

However, for deepfake content that falls within the categories specified in the 2026 Amendment, the platform must act within three hours of receiving the complaint. The three-hour takedown deadline applies to content that involves non-consensual intimate imagery, impersonation intended to deceive, and content that threatens public order or national security.

To file the complaint: locate the platform's grievance mechanism (usually found in the Help Centre or Terms of Service page), submit a written complaint identifying the specific content, explain why it constitutes synthetically generated information under the 2026 Rules, and request takedown within the three-hour window if the content falls within the specified categories.

Step 3: Escalate to the Grievance Appellate Committee

If the platform's Grievance Officer fails to act within the prescribed timeframe, or if the response is unsatisfactory, the complainant can escalate to the Grievance Appellate Committee (GAC) established by the Central Government under the 2023 Amendment to the IT Rules. The GAC is empowered to review the platform's decision and issue binding directions.

The appeal to the GAC must be filed within 30 days of receiving the Grievance Officer's response, or within 30 days of the expiry of the 15-day resolution period if no response is received. The GAC must dispose of the appeal within 30 days.

Step 4: File a Police Complaint or Approach the Cyber Crime Portal

Deepfakes can constitute criminal offences under multiple laws. Section 66E of the IT Act penalises capturing, publishing, or transmitting a person's private images without consent. Section 67 covers obscene content. Section 67A covers sexually explicit content. Under the BNS 2023, provisions on defamation (Section 356), criminal intimidation, and outraging modesty (Section 75) may also apply.

Victims can file a complaint through the National Cyber Crime Reporting Portal (cybercrime.gov.in), which is the centralised platform for reporting cyber offences across India. Complaints can also be filed at the nearest police station; under the zero FIR provisions of the BNSS 2023, any police station must register the FIR regardless of jurisdiction.

Step 5: Seek Civil Remedies

In addition to criminal remedies, victims of deepfakes can pursue civil remedies including injunctions, damages, and specific performance. Courts can grant interim injunctions directing platforms to remove content pending trial. The Deepfake Laws in India 2026 article provides a detailed overview of available civil remedies.

The right to privacy, recognised as a fundamental right under Article 21 by the Supreme Court in K.S. Puttaswamy (2017), provides the constitutional basis for seeking relief against deepfakes that violate personal dignity, reputation, or privacy.

Key Takeaways

1. The IT (Intermediary Guidelines) Amendment Rules 2026, effective February 20, 2026, impose a three-hour takedown deadline on platforms for certain categories of harmful synthetic content.

2. Victims should document deepfake content with screenshots, URLs, and timestamps before filing any complaint.

3. The first step is filing with the platform's Grievance Officer; the complaint must be acknowledged within 24 hours.

4. If the platform fails to act, escalation to the Grievance Appellate Committee and filing at the National Cyber Crime Reporting Portal are available remedies.

5. Deepfakes may attract criminal liability under Sections 66E, 67, and 67A of the IT Act, and civil remedies including injunctions are available under the right to privacy framework.