A deepfake of your chief executive runs on a seven day clock, unless you hold a court order

The February 2026 amendment to the Information Technology Rules is reported as a three hour takedown rule. For a company whose chief executive has been deepfaked into endorsing a fake investment scheme, that is the wrong number. The three hour clock in rule 3(1)(d) starts only on actual knowledge, and since November 2025 actual knowledge arises in two ways alone: a court order, or a reasoned written intimation from an officer not below the rank of Joint Secretary. The two hour clock belongs to an individual complaining about his own impersonation or intimate imagery, not to a company complaining about its brand. What a company gets by right is the ordinary grievance route: acknowledgement in twenty four hours and resolution in seven days, with no remedy against the mirror copies. Which is why every order in this space in 2025 and 2026 is an injunction.

Who does the labelling rule actually bind?

The amendment of 10 February 2026 defines synthetically generated information and then attaches duties to it. The duties are addressed to intermediaries, and in one case to a resource that enables a user to create or alter such content. The statutory definition of an intermediary is a person who, on behalf of another person, receives, stores or transmits a record, or provides a service in respect of it.

So a company publishing its own material on its own website, app or marketing channel is not acting on behalf of another person and is not an intermediary. The labelling, metadata and declaration duties do not touch it. The position changes the moment its own resource carries somebody else's content: a customer forum, a reviews section, a comment field, an upload feature, a marketplace. On that function the company does receive and store records on behalf of others.

The line is functional rather than nominal. The Delhi High Court held in the Louboutin case that a platform remains an intermediary so long as it is a mere conduit or passive transmitter, that calling itself an intermediary does not make it one, and that active contribution removes the exemption altogether. Curation, promotion, control of pricing and guarantees were among the factors that took that site across the line. A business running a moderated brand community should assume it is on the active side.

Which clock applies to a company?

Three clocks exist and a company qualifies for the slowest of them.

The two hour clock applies where an individual complains about content exposing him in an intimate form or impersonating him. It is keyed to the individual. A company complaining that its brand has been faked does not fit.

The three hour clock applies on actual knowledge, and the rule now defines how actual knowledge arises: by an order of a court of competent jurisdiction, or by a reasoned written intimation from an authorised officer of Joint Secretary rank or above. A letter from the company's lawyers is neither.

The ordinary grievance clock is what is left: acknowledgement within twenty four hours, resolution within seven days. Beyond it sits the Grievance Appellate Committee, with thirty days to appeal and an endeavour to decide within thirty calendar days.

There is a useful asymmetry here. The chief executive, personally, can use the two hour route for the impersonation of himself. The company cannot. Where the video depicts a named individual, the individual's own complaint is the fastest statutory lever available, and it is often overlooked because the matter is handled as a corporate communications problem.

Why the three hour clock is narrower than it reads

The knowledge trigger is not an oversight. In Shreya Singhal the Supreme Court read down the provision withdrawing safe harbour, holding that the actual knowledge it speaks of means knowledge that a court order has been passed requiring removal, and read the corresponding rule down in the same way. The holding is reproduced verbatim in the later Visakha Industries decision.

The November 2025 substitution of rule 3(1)(d) brought the rule into line with that holding: a private complaint no longer creates actual knowledge. The February 2026 amendment then changed thirty six hours to three. Read together, the rule became more protective of speech and faster on remedy at the same time. The cost of the speed is that somebody has to go to court first.

Whether the Joint Secretary route survives the judgment is itself contested, and we return to that below.

What the courts are actually doing

Relief is being granted, quickly, as a common law and intellectual property action rather than under any deepfake statute, with injunctions under Order XXXIX of the Code of Civil Procedure and John Doe and dynamic blocking relief.

The most useful order for a business is Sanjiv Goenka v. Google LLC, decided by the Delhi High Court on 15 April 2026, because the plaintiff is a businessman rather than a performer. The court found that much of the material went beyond parody, lampooning or caricature, and restrained misappropriation of name, image and likeness for commercial or personal gain, expressly naming generative AI, machine learning, deepfakes, chatbots, face morphing and superimposition. It directed the platforms to take down the links the plaintiff supplied, to disclose basic subscriber information, and to block further infringing material as it was reported.

In Raj Shamani v. John Doe, decided on 17 November 2025, the Delhi High Court ordered compliance within seventy two hours and required the platforms to act on mirror content within forty eight hours of it being flagged. It declined interim relief against parody, satire and criticism videos and sent them to a separate action. A Bombay High Court order of 1 October 2026 continued ad interim relief against morphed and AI generated content including chatbot personas.

The pattern is consistent: the order comes early, the platform compliance window is days, and the real value is the standing mechanism against mirrors, which no grievance route provides.

What it costs, worked

Assume a single deepfake video of the chief executive promoting a fake investment scheme, replicated across forty links on three platforms, and a company with no intermediary function of its own. Those are our assumptions.

The grievance route costs internal time and buys a week per platform, with no guarantee of removal and nothing against mirrors. The appellate route is real but adds up to two further months, giving an outer envelope of about sixty seven days from first complaint to decision. The injunction route produces relief in days, platform compliance measured in hours once served, and the dynamic mechanism.

On court fees, the central Court-fees Act, 1870 caps the fee on a plaint at three thousand rupees, and an injunction suit is valued at the amount stated in the plaint. Whether a State amendment raises that ceiling in the court you file in has to be checked, and we have not checked it for Delhi. Professional cost is a quotation and not a researched figure, so this note does not give one.

The comparison to put to a board is therefore not cost against cost. It is that only one of the three routes reaches the copies that appear after you win.

Does your customer forum change your position?

It can, and this is the question worth asking before an incident rather than during one. If the company's own resource hosts third party content, the company owes the rule 3 due diligence: published terms, a grievance officer, the statutory clocks, and, if it offers users a generative feature, the labelling, provenance and no tampering duties.

Losing the safe harbour creates no new offence. It removes a shield, and the ordinary consequences attach: liability as publisher in defamation, the content offences under the Information Technology Act, the forgery provisions of the Bharatiya Nyaya Sanhita, 2023 where the company participates in making or transmitting the false electronic record, and contempt where a court ordered takedown is not honoured.

Where practitioners differ

Whether an Indian company can sue in its own name for personality rights at all. Every order we read concerns a natural person. The workable position is that the company sues on trade mark, passing off, copyright and defamation, and relies on the individual's personality rights where the fake depicts a named person.

Whether moderating a customer forum costs a company its intermediary status. The Louboutin test is factor based and gives no bright line, and views differ on whether routine spam moderation is active contribution.

Whether the Joint Secretary intimation route in the amended rule survives Shreya Singhal, which spoke of knowledge through the medium of a court order, or whether it rests on the separate limb permitting notification by the appropriate Government or its agency.

Whether parody and satire deepfakes are injunctable. One court found the material before it went beyond parody; another sent the parody videos to a separate action. The boundary is unsettled.

Whether a company using generative tools in its own advertising owes any labelling duty. On the text of rule 3 it does not, because it is not an intermediary. We traced no provision requiring AI disclosure in advertising.

What changes by sector

Financial services. The largest criminal overlap, because a faked endorsement of a scheme engages cheating by personation both under the Information Technology Act and under the Bharatiya Nyaya Sanhita, 2023. The firm's own marketing is read against the advertising controls in the Consumer Protection Act, 2019, under which the Central Consumer Protection Authority may penalise a manufacturer or endorser up to ten lakh rupees, and up to fifty lakh rupees for a repeat, and may bar an endorser for a year and up to three years on repetition. A synthetic brand ambassador is an endorser problem in waiting.

Healthcare and pharma. The same advertising exposure, with the additional layer of the 1954 Act on objectionable advertisements of drugs and magic remedies, which we flag rather than state because we have not read its provisions for this note. The characteristic risk is a synthetic doctor, or a filmed patient endorsement that no patient gave, and it is a marketing risk rather than an intermediary one.

Technology services. The only sector where the company plausibly is an intermediary, and the only one where the duty on a generative resource bites. A vendor shipping an AI image or voice feature to Indian users should assume the labelling, provenance and no tampering duties apply to it.

Manufacturing. The least regulatory overlap and the most brand counterfeiting. Synthetic product videos and fake recall notices are addressed as trade mark and passing off actions on the template the 2025 and 2026 orders set, together with the forgery provision aimed at a false electronic record intended to harm reputation.

What this note does not claim

It does not reproduce the words of the Bharatiya Nyaya Sanhita, 2023 provisions it describes. The gazette text truncates past section 77 on the hosts available to us and the wording was read on a reproduction, so the sections are described and not quoted, and the wording needs a page check against the gazette before this note is published. The passages of Shreya Singhal relied on were read as reproduced in a later Supreme Court judgment rather than in the original. It does not describe the holdings of five further orders we located but did not read. It does not state whether Grievance Appellate Committees are presently constituted and functioning, which we did not verify. No Supreme Court decision on synthetic media was found, and the absence of one we could find is not proof that none exists. The cost figures are statutory caps and assumptions, not a quotation.