The Face in the Video Was Hers. But She Had Never Filmed It.
Assume the unsettling scenario of waking up to countless inquiries about an unauthorised, fabricated video that has a million views circulating online. The footage flawlessly replicates your face and identity, though the actions and statements are entirely forged. It is a profound violation of consent, wherein your likeness is used to portray events in which you never participated.
It wasn't until there was a case of very little importance that it began to take on earth-shattering importance, and when it concluded, it would start to tip the scales. The first conviction for a deep fake in India wasn't with trumpets and a fanfare, but with quiet certainty from a court verdict, solid forensic data, and a judge who understood what the future held.
In-depth look into the situation that has caused a whole country to question the very notion of digital identity, consent, and the criminal justice system.
This is not a fictional thriller scenario. This is the everyday reality for women across India, across the globe, in the age of deep fakes. AI has given the world many brilliant innovations. It has also, however, equipped the vindictive, the scorned, the fanatical with a weapon of terrifying proportions: the ability to reproduce another individual with such perfection that even that individual's loved ones can struggle to distinguish the forgery from the original.
For years, India looked on with a sense of creeping alarm as this problem festered, while the nation's judicial system raced to catch up. Complaints were filed, FIRS lodged, and criminal cases launched. But convictions…convictions were virtually non-existent. The wrongdoers were quietly confident in the knowledge that technology had moved ahead of law, and the law hadn't caught up yet.
Until there was one case, insignificant at the time of its inception, earth-shattering in its resolution, that began to tip the scales. The first deep fake conviction in India came not with a thundering declaration of change but with the calm delivery of a court verdict, hard forensic data, and a judge who grasped the ramifications of what was at hand. It set a precedent. And, in law, precedents have a reverberation that lasts for generations.
This is that story.
The Deep Fake Threat: Why Every Indian Needs to Be On Alert
But before we enter the courtroom, let's consider the crime itself. A 'Deep fake'- a word derived from 'deep learning' (a subset of the science of artificial intelligence) and 'fake'- is an edited or otherwise simulated photo or audio where a person’s face or body is pasted over someone else's with the aid of machine learning algorithms trained on samples of that person.
Only a decade ago, such an artifact would require a Hollywood production budget and visual effects expertise.
Today, a free app on your mobile can create a halfway decent deep fake video under 30 minutes, and several highly sophisticated tools can use a handful of source photographs (most of which can be acquired freely from public profiles) to create a synthetic video that seems to carry its subjects' likeness eerily convincingly.
The deep fake victims in India have experienced the worst possible form of deep fake, and as reported by statements from NCW, cybercrime cells in Indian states, and private digital rights groups in India, the biggest victims were females (mostly young ones - students, working women, public figures) whose photos from social media platforms such as Instagram, Facebook and LinkedIn are used as a weapon for harassment, blackmail, and revenge.
What makes it so evil is that as soon as it appears anywhere on a website, it normally won't leave until the woman has taken the pain of downloading it, then re-uploading, saving onto various other sites, and therefore experiencing trauma that no other type of victim of crime undergoes. It was in this environment- technologically advanced, legally unclear, and psychologically devastating- that one young woman from Kerala decided to pursue a complaint.
The Paradigm Shift
The details of the case, as documented in court records and widely reported across legal and technology publications, trace back to a complaint filed in Kerala — a state that has, in recent years, built a notably robust cybercrime response infrastructure. The complainant, a young woman whose identity remains protected under applicable privacy provisions, discovered that a man known to her had created and distributed an explicit deepfake video using her face.
The accused had sourced her photographs from her public social media profile and used an AI-powered face-swap application to superimpose her likeness onto an existing explicit video. He had then distributed this material through messaging applications and, according to the charge sheet, had used it as a tool of intimidation and harassment.
What followed was not simple. It never is. The victim first approached the local police, who — to their credit — did not dismiss the complaint, but who also lacked immediate clarity on which sections of law applied to a crime that existing statutes had not been explicitly written to address. This is a challenge that would echo throughout the legal proceedings: India's laws, though broad in scope, were written before deepfake technology existed.
The investigation, however, was thorough. Digital forensics experts were brought in to authenticate the video, trace its origin, and establish that it had been artificially generated. Metadata from the file, analysis of pixel-level inconsistencies characteristic of AI-generated content, and the digital trail of its distribution through messaging platforms formed the core of the prosecution's technical case. This forensic groundwork would prove critical — It demonstrated not just that a crime had been committed, but precisely how the accused was eventually charged under multiple sections, including provisions of the Information Technology Act, 2000 — specifically Section 67A, which deals with publishing or transmitting obscene material in electronic form; provisions relating to criminal intimidation and harassment under the Indian Penal Code; and sections about identity theft and the misuse of digital identity. The prosecution argued that the deliberate creation of a fabricated video was used.
Someone's likeness, without consent, for harassment and distribution, constituted a convergence of several existing offences.
The court agreed.
The Legal Architecture: How Existing Laws Were Stretched to Fit a New Crime
One of the most intellectually significant aspects of this case was the question it forced the judiciary to answer: when a crime is new, but the harm is recognisable, how does the law respond?
To overcome the ever-escalating menace of cybercrime, India uses the inherent flexibility of the Information Technology Act, 2000 (as amended in 2008), and the Bharatiya Nyaya Sanhita, 2023. The relevant legislation does not mention the term 'deepfake', but its provisions are employed to prosecute the inherent crimes of synthetic identity fraud and impersonation.
Despite all this, the argument put forward by the prosecution worked. Although the creation of non-consensual prompting imagery by AI was unlikely to have been foreseen under either provision. What the Legislature has done is say that if Statutes are enacted, this will lead to prosecution.
Neither contemplates the scenario of AI-generated non-consensual intimate imagery. And yet, the prosecution built a compelling case that existing provisions, read purposefully and applied with an understanding of legislative intent, were sufficient to secure a conviction.
As per Section 67A of the IT Act, a person violates the publishing/transmitting of sexually explicit material electronically. It was submitted on behalf of the prosecution and accepted by the court that the deepfake video squarely falls under Section 67A. It was irrelevant that the sexual content was fake/artificial. The use of the complainant's identity in a sexually explicit context was relevant, since it was done without her consent.
The identity theft angle was equally important. The Information Technology Act has provisions to the effect of identity theft and cheating by personation through the use of a computer resource. They are covered under sections 66C and 66D. They were also primarily designed for the prevention of financial fraud, but many legal scholars would argue that a broad correct interpretation of impersonating another by the courts is identity theft in circumstances of computer-generated visual images, when not financially motivated (but with a view to the victim's reputation). Yet regarding the question on the dimension of privacy, wasn't it a separate piece of legislation, whereas the data protection bill was already in existence?
In this case, it was argued through the lens of the right to privacy as recognised by the Supreme Court in the landmark Justice K.S. Puttaswamy judgment of 2017. Every individual has a reasonable expectation that their physical likeness will not be weaponised without their consent. The deepfake, the prosecution argued, was a direct violation of this constitutionally recognised right.
Inevitably, the prosecution faced the defence argument attempting to debunk the forensic evidence: how did they know it was AI, and why was the existing legislation not stringent enough to prosecute someone? Each point was debated and subsequently dismissed on the forensic record and interpretation of the legislative.
The conviction, when it came, was not just a verdict on one man's conduct. It was a judicial statement: Indian law, as it stands, is capable of addressing this crime. And those who commit it will be held to account.
The Forensic Science That Made the Case
The findings of the experts were such that there is certainty at the standard required in a criminal case as to the video being fabricated, as to how it was made and disseminated, as to the forgery undertaken on the complainant's face without his authority, and as to the actions of the accused, which are all incontrovertible. It is worth understanding just how the prosecution proved, beyond a reasonable doubt, that the video was a deepfake. This is not just a technicality; this will be a precedent for all future deepfake prosecutions in India.
Digital forensics analysts dissected the video using multiple methods. Second, there was a metadata analysis done of the video. The average human eye, under natural viewing circumstances, may miss these. Forensic software will not.
Second, the video underwent metadata analysis. The digital forensics team was able to ascertain which device belonged to the creator. This device contained the original images from which the face-swap AI app was used to manipulate the images in the complaint's social media account. Log and residue files showed that the video had been created. Log files revealed how the video was shared over messaging apps. The video's metadata, containing clues indicating that it was an AI-generated artefact, did not concur with authentic video files.
Third, the court followed the digital trail of how the video was created and distributed. The digital forensic investigators identified the creator's device, which contained the original images that were extracted from the complainant's social media accounts, and the face-swap AI application. Residual files indicating the generation process and logs indicating how the video was shared via messenger apps were also identified. This chain of evidence, from creation to distribution, was meticulously documented and provided to the court.
The forensic experts were able to conclude with the level of certainty needed for criminal conviction that the video was artificial, that the creation and distribution process, the forgery that was performed using the complainant's face without their consent, and the actions of the accused are indisputable. The method of analysis in this criminal case now becomes a template for future cases involving deepfakes.
The Human Story Behind the Legal Battle
Legal analysis, however important, risks reducing a human story to a collection of statutes and precedents. At the centre of this case was a woman who chose to fight when every social instinct told her not to.
There is a slight note of heroism in the fact that the tradition this precedent comes from is Kerala, a state that has the highest female literacy rate in the country, has had precedents for female participation in public life for a long time, and a cybercrime investigational infrastructure that has repeatedly proven itself capable of and inclined towards taking this crime type seriously. She went through lengthy inquiries, demands for forensic analysis, a criminal court, and wait; the slow and relentless wait for legal justice to take place in its own time. The centre of this story is, of course, a woman who chose to take on a fight against all societal inclinations.
In India, the stigma for being the victim of a deepfake, more specifically, a sexualized deepfake, is placed upon the victim, not the perpetrator. Women who come forward are often not believed and subjected to victim-blaming and the additionally horrific experience of public deliberation of their personal circumstances. The private becomes violently public. Families may even withdraw support out of embarrassment.
Careers are derailed. The psychological toll is enormous.
Careers are ruined, and the psychological damage is tremendous.
The complainant in this story chose to lodge an FIR and pursue the prosecution to completion – an option that not all victims may be in a position to pursue. She endured long investigation processes, demands for forensic verification, the confrontation of a criminal trial, and the waiting, the long, slow, grinding anticipation of legal justice being served at its own pace.
Her bravery, in many respects, is what makes this precedent. She paved the way for this judgment to be made simply by filing the FIR and ensuring the prosecution progressed to a level at which it could set this new standard.
The conviction is as much her victory as it is the prosecution’s, and in a very tangible way, it is her gift to every subsequent woman who will face a similar injustice.
There is a subtly heroic element that this precedent comes from Kerala, a state which boasts the highest female literacy rate in the country, which has had a strong precedent for female involvement in public life, and which boasts a cybercrime investigational infrastructure that has consistently proven itself willing to take this form of crime seriously. It is not surprising that the first conviction would come from this state.
What the Verdict Means: A Precedent in Three Dimensions
Legal Precedent
Case Law: It is seen through this conviction that India already possesses ample provisions in the legal system (The IT Act, IPC, and the constitutional right to privacy) to combat the offences of deepfakes. To the victim, it has carried the needed assurance that petitioning the system is not futile, as it is capable of investigation, prosecution, and conviction of the guilty parties. This is significant for the prosecutors across the nation as they have a landmark case to present before the judges when arguing the applicability of relevant sections. It also serves as a signal for the lower courts: "When the harm is real, when the technology has been used as a weapon, the law should not retreat on the pretext that the weapon is new.
Legislative Pressure
Legislative impetus: The judgment has further spurred ongoing reforms to legislation. India's Digital Personal Data Protection Act, passed in 2023, has brought about a regime for the use of data based on consent, which has great significance in the cases of deep fake- a person's face being personal data. Activists and scholars are citing this case in their advocacy for specialised legislation for deepfakes, and they are making a convincing point because the judiciary has proved they can do the needful; now it's time for the legislature to be proactive.
Social Precedent
In my opinion, the most crucial dimension of the verdict is the social aspect. It has proven to the wrongdoer that technological superiority does not grant immunity from penal law. To the victims, it has brought the much-needed message that approaching the system is not in vain, as it is equipped to conduct investigations, prosecution, and convict the guilty. To the general public, it's a message that your face and your identity are not a favour but your right. Infringe it, and be ready for the consequences.
The Global Perspective: India's Role in International Action
The huge number of people online, the unbelievable speed at which applications like WhatsApp and other chat programs have spread, and the low complexity to implement face-swapping using AI put deepfake criminal activities on the fast track of proliferation. This holding suggests that the Indian court system can cope with this form of technology at a sophisticated level.
Around the world, legislative responses to the issue have differed. The EU will introduce the new AI Regulation, one of the most detailed pieces of legislation worldwide on AI, which will demand labels like "synthetic" on synthetic media. Similarly, South Korea has gone as far as to criminalise possession of such material, whereas the UK's Online Safety Act makes it a crime to share deepfake intimate images without consent. In the EU, a new AI Regulation, among the world's most comprehensive laws targeting artificial intelligence, requires that synthetic media be labelled as "synthetic".
If implemented, this system architecture would significantly aid law enforcement agencies and the judiciary in identifying and litigating deep fake offences.
India has thus moved from being on the sidelines to having an active role. This conviction indicates that the Indian judicial system can handle this type of technology at a complex level. What is required now is for the legislative system to equip the courts with the necessary tools to address these issues with greater precision.
The Gaps That Remain
It would be intellectually dishonest to say the ruling is an end to things. That's not the ending. That's just the preamble to what's to come.
India does not yet have a standalone law specifically addressing deepfakes. This means that each new case must again navigate the question of which existing provisions apply — a process that consumes time, resources, and legal energy, and which may produce inconsistent outcomes across different courts and different states. A dedicated legal framework would remove this uncertainty.
Firstly, the question of capacity. The perpetrator was fortunate to have a victim with the sense and fortitude to press charges and see it through the whole gruelling procedure. This is extremely time-consuming, extremely expensive, and involves a vast amount of judicial effort, besides resulting in potentially conflicting judgments between different courts in the country or between states. The outcome cannot be replicated with a victim residing in an obscure village or in a poorly developed state that has incompetent cybercrime cells, in the present scenario.
However important the verdict, it cannot be viewed as replacing access to justice for the entire population. This means every time a complaint of deepfake is filed, the same argument about applicable existing provisions has to be made.
This wastes time, money, and a lot of judicial energy, and can even lead to contradictory verdicts across different courts in the country or in different states. A specific law would solve this issue of uncertainty.
Secondly, there is the issue of capacity. The cybercrime cell, which took up the case, is one of the better-equipped in the country. But in most police stations across India, the police are largely unaware of the deepfake phenomenon and lack the necessary tools or training to tackle such cases empathetically. A victim in a remote rural area, or a less developed state with weak cybercrime cells, cannot expect the kind of outcome as the complainant in this case.
Thirdly, platform accountability cannot be effectively addressed by a single court verdict. Deepfakes appear and are disseminated on platforms run by entities located in the USA, Ireland, or Singapore. Bringing these entities to justice and compelling them to respond rapidly, remove content, share data with the Indian police, and ensure they prevent re-upload requires regulatory coordination beyond the scope of any domestic judicial pronouncement.
Finally, the question of access to justice remains an issue. This victim had the precision and courage to lodge a complaint and then support the case through the entire endurance process.
He was fortunate, as well, in that the territory he occupied could be managed. How many victims do we not have at least one of these? Conviction is not immaterial; however, it can't be all that is available in terms of access to justice.
What Must Come Next: A Blueprint for Action
The momentum generated by this conviction should be channelled into specific, actionable reforms. Several are already being discussed in legal and policy circles.
Firstly, there is a particular deepfake law required. Laws should: provide a narrow definition of deepfakes and criminalise their creation and distribution when non-consensual and used for, for example, libel, harassment, or blackmail.
These findings need to translate into practical and tangible changes. This should then lead to realistic and pragmatic policy changes. Some are already being discussed in legal and policy communities. In the first place, there should be separate legislation for deepfakes. So it's now time that the Government brings in legislation that defines a deepfake and that any deepfake created or circulated without consent that is used for defamatory, harassing, or extortion purposes is illegal and prescribes an appropriate punishment.
A deepfake law should also incorporate commercial applications, which is another set of harm arising from celebrity and public figure deepfakes.
Second, the forensic capacity needs to be systematically built. Each state must have at least one cybercrime cell that has the means, skills, and people to investigate deepfakes. The methods used for the investigation of this case, that is, the analysis at the pixel level, forensics based on metadata, and at the device level, should be part of the training curriculum of each cybercrime unit in the country.
Third, platforms need to be accountable. Already, India's IT rules 2021 stipulate action for non-consensual intimate content. These rules need to be broadened and clarified to address AI-generated content, with a strong enforcement mechanism in place. Response time for the removal of deepfakes following a complaint should be measured in hours, not days.
Fourth, on the grass-roots level, an awareness must be generated. It is essential that students, as members of the wider community, learn to detect deepfakes, to understand the rights of victims, and ways to report deepfakes. The platform's obligation must be emphasised. Moreover, the obligation of every person sharing the video has to be inculcated (even if he or she does not create it), as by sharing the video, he or she is also torturing the victim.
A Mirror to the Future: What This Case Tells Us About Who We Are Becoming
This first-ever conviction for a deepfake in India is a reaction. It is possible to decouple a single face from a single person; to remove that one person's face, twist it, and then turn that face into a weapon directed at that one person, all without their knowledge or without ever leaving their house, all the way from the other side of the globe.
He would have had to have known you, and human powers of mimicry have their limits, to have been able to do that to you. It's a snapshot into a world that hasn't yet come to terms with its digital twin.
A person's dignity is not negotiable; this holds even in the space where code meets pixels. The physical world - of faces, voices, bodies, and presence - and the digital world, where representations of those same faces, voices, and bodies circulate, persist, and can be altered. If a person were to pretend to be you, they needed to be present near you, and the human ability of mimicry had boundaries to what it could achieve. Your face was your face. Your voice was your voice. If someone wanted to impersonate you, they had to be near you, and the limits of human mimicry constrained what they could do.
Artificial intelligence has permanently severed that connection. A person's face can now be separated from their person - taken, manipulated, and redistributed as a weapon against them, without their knowledge and from across the world. This is a civilisational shift, not merely a technical one. And civilisational shifts require civilisational responses: in law, in ethics, in culture, and in our understanding of what it means to be a person in a digital age.
India's first deepfake conviction is a response. It is society, through its institutions, saying that this is not acceptable. The face of a person is not a resource to be mined. The identity of a person is not a tool to be weaponised. The dignity of a person is not negotiable, even in the space where code and pixels meet.
It is a beginning, and beginnings, however modest, carry within them the possibility of everything that follows.
Conclusion: Justice, One Precedent at a Time
India's first deepfake crime conviction will not be remembered as the case that solved the problem. No single conviction ever does. What it will be remembered for is the moment the legal system caught its breath, oriented itself to a new kind of crime, and moved forward.
It proved that the Indian judiciary could understand AI-generated evidence, evaluate it rigorously, and apply existing law with the purposive intelligence that justice requires. It demonstrated that investigative systems, when adequately resourced and properly motivated, can trace a digital crime from creation to conviction. And it gave every woman who has discovered a deep fake of herself a reason to believe that reporting is not an act of futility.
The perpetrator in this case made a common mistake — one that many who operate at the intersection of technology and cruelty make. He assumed that because the weapon was new, the law could not reach him. He assumed that because the forgery was digital, it would escape the consequences attached to physical harm. He was wrong. And the record of his wrongness now stands, in a court document, as a warning to everyone who might follow him.
Technology will keep advancing. The deepfakes of 2030 will be indistinguishable from reality in ways that today's versions are not. The arms race between those who create synthetic media and those who detect it will continue, with no foreseeable end. But the principle established in this conviction — that the person whose identity is violated has legal recourse, and that the state has both the authority and the obligation to provide it — is not subject to obsolescence. Principles, unlike software, do not have version numbers.
In a world where faces can lie, the law must be the thing that does not.
References & Sources
- Information Technology Act, 2000 (as amended 2008) — Ministry of Law and Justice, Government of India
https://www.indiacode.nic.in - Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 — Supreme Court of India
https://translaw.clpr.org.in - Digital Personal Data Protection Act, 2023 — Ministry of Electronics and Information Technology
https://prsindia.org - IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
https://www.meity.gov.in/ - National Crime Records Bureau (NCRB) — Cyber Crime Statistics Reports, 2021–2023
https://www.ncrb.gov.in/ - National Commission for Women — Reports on Online Violence Against Women
https://www.ncw.gov.in/ - European Union Artificial Intelligence Act (EU AI Act), 2024
https://artificialintelligenceact.eu/ - UK Online Safety Act, 2023 — DCMS
https://www.legislation.gov.uk - Henry Ajder et al., 'The State of Deepfakes: Landscape, Threats, and Impact' — Deeptrace Labs
https://regmedia.co.uk/2019/10/08/deepfake_report.pdf - Sugam Sharma & Anirudh Singh Rana, 'Deepfakes and the Law in India' — Indian Law Review
https://www.researchgate.net - Internet Freedom Foundation (IFF) — Policy Papers on Deepfakes and Digital Consent, 2022–2024
https://internetfreedom.in - Kerala Police Cyberdome — Annual Reports and Case Briefings
https://keralapolice.gov.in.