A Legal First, Built on a Ticking Clock
On February 10, 2026, India's Ministry of Electronics and Information Technology (MeitY) notified the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 — officially G.S.R. 120(E) — giving the country's estimated 500-plus million social media users the world's first binding statutory framework specifically governing synthetically generated information. The rules entered force ten days later, on February 20. The speed of implementation was itself a signal: this is a government moving with urgency on AI-generated content. The question is whether urgency has come at the cost of proportionality.
The Genuine Harms Behind the Rules
Before examining what the rules get wrong, it is worth spending a moment on what they are trying to fix — because the problem is real. India's vast digital market has become a fertile ground for deepfake-enabled harms: non-consensual intimate imagery (NCII) synthesised from social media photographs; AI voice-cloned audio mimicking politicians ahead of state elections; and impersonation schemes that have defrauded thousands of citizens. Under the predecessor IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, platforms had up to 36 hours to comply with government takedown orders and 24 hours to remove NCII-adjacent content — timelines that critics argued allowed viral deepfakes to complete their damage before any enforcement response arrived. The 2026 rules are a genuine attempt to close that gap.
What the Amendment Actually Does
The rules introduce the term Synthetically Generated Information (SGI) — legally defined as any audio, visual, or audio-visual content created or materially altered algorithmically to appear authentic or indistinguishable from a real person or real-world event. Routine edits, accessibility features, and good-faith transformative work are carved out from the definition, which provides at least some creative latitude.
The amendment then imposes a tiered obligation structure across the intermediary ecosystem:
- Rule 3(3) requires all intermediaries whose platforms enable SGI creation to embed permanent, tamper-resistant metadata — unique identifiers that neither platforms nor end users can strip. Video must carry visible watermarks; audio must carry spoken disclaimers.
- Rule 4(1A) targets Significant Social Media Intermediaries (SSMIs) — those with more than five million registered users in India — requiring them to collect user declarations about synthetic content before publication and to deploy technical mechanisms to verify those declarations.
- Takedown timelines are dramatically compressed: court or government orders must be acted on within three hours (previously 36 hours); NCII and deepfake complaints within two hours (previously 24 hours); general unlawful content within 36 hours (previously 72); and user grievances acknowledged within seven days (previously 15).
The most legally significant innovation is Rule 2(1B), which resolves what scholars have called the "Good Samaritan Paradox." Under the 2021 framework, platforms that proactively removed content risked having that editorial action cited against their Section 79 safe harbor immunity under the IT Act, 2000 — perversely penalising responsible moderation. Rule 2(1B) explicitly severs this link: removing SGI in compliance with the rules cannot itself be used to deny safe harbor. This fix — which the United States has debated around Section 230 for three decades without resolution — should allow platforms to invest in automated watermark-detection and content-classification systems without those investments being weaponised in litigation. It is a genuine contribution to global platform law, and one that other jurisdictions would benefit from studying.
The Compliance Clock Problem
The problem is not the goal; it is the physics. Publishing rules on February 10 and enforcing them from February 20 gave even major platforms ten days to redesign compliance workflows, retrain moderation staff, build watermarking pipelines, and integrate SGI-detection systems into production environments. Trade bodies including the US-India Strategic Partnership Forum publicly requested a phased rollout or suspension of the three-hour regime. The government declined.
The three-hour window for government directives carries a specific structural risk. Unlike judicial orders — which embed inherent due-process safeguards through the court system — the 2026 rules allow compliance timelines to be triggered by executive "advisories" and "standard operating procedures" issued by ministries. Facing a three-hour deadline and the total loss of Section 79 immunity as the penalty for non-compliance, platforms face a binary: review nothing carefully and remove everything flagged, or review carefully and miss the window. The commercial outcome is predictable. As the Internet Freedom Foundation has warned, automated classifiers operating under this kind of temporal pressure cannot reliably distinguish political satire from a synthetic deepfake, or a parody account from impersonation. The incentive in a three-hour window is always to over-remove.
This is not theoretical. Meta's transparency reporting for India showed an exponential rise in content restricted between January 2024 and December 2025, a period of expanding government takedown requests. The 2026 rules structurally accelerate that pressure.
A Draft Second Amendment Extends the Risk
In April 2026, Human Rights Watch documented a proposed Second Amendment to the IT Rules that would extend the framework in a concerning direction: treating ordinary social media users who comment on news and current affairs as digital publishers, subject to the same content-regulation tier as registered news outlets. A proposed Inter-Departmental Committee would gain authority to review content on the basis of executive referrals — not court orders — with enforcement options including forced apologies and removal orders. The Second Amendment is at proposal stage as of publication, not in force. But its trajectory reveals how the 2026 framework's infrastructure is being positioned as a foundation for expanding executive control over online discourse, not just a targeted response to deepfake harms.
What Proportionate Regulation Looks Like
India's IT Amendment Rules 2026 demonstrate that it is possible to define synthetic media in law, mandate provenance metadata, and resolve the Good Samaritan Paradox — all within a single rulemaking. That is a meaningful achievement. Proportionate implementation of the same goals would pair those innovations with a minimum 24-hour compliance window for non-emergency government directives, a mandatory judicial checkpoint before any executive advisory triggers the three-hour clock, and independent annual audits of platform over-removal rates. The frame should be: accountability for synthetic harms, with due process for the speech that surrounds them. What India has instead is a framework that makes compliance speed the primary metric. In content moderation, systems optimised for speed are systems optimised for silence.