AI • Technology • Digital safety
Deepfakes, children’s safety and privacy risks from smart devices were among the topics at India’s Trust and Safety Festival, held on 14 and 15 October at the India International Centre in New Delhi. The festival describes itself as a civil society-led convening on trust and safety in the digital world, and its second edition comes as AI tools make fake images, voices and videos easier to produce than ever. The question for families is practical: are India’s rules enough, and what should each of us do?
What India already has
India is not starting from zero. Two sets of rules matter most.
1. IT Rules amendment on AI-generated content. The Centre notified amendments to the IT Rules on February 10, 2026, which came into force on February 20. They bring “synthetically generated information”, including deepfakes, within the rules for the first time and require clear labelling of AI-created audio, video and visual content. The changes include:
- A three-hour deadline for removing flagged unlawful content, along with labelling and provenance requirements and shorter grievance timelines.
- Larger platforms (those with more than 50 lakh registered users in India) must obtain user declarations on whether content is AI-generated and use technical measures to verify them.
- Under one legal summary, takedown time for non-consensual sexual imagery, including deepfake nudity, is cut to two hours. Check the exact provisions with a lawyer before relying on them.
2. The data protection law. The Digital Personal Data Protection Act treats anyone under 18 as a child and requires verifiable parental consent before a platform processes a child’s data. Some narrow exemptions apply, such as for healthcare, education and real-time safety. The DPDP Rules were notified in November 2025 with an 18-month rollout, so the children’s data provisions are expected to be fully enforceable only around May 2027. There has been talk of shortening that timeline, so check the latest.
Where the gaps are
Having rules does not mean children are protected. The main gaps to watch:
- Text is outside the deepfake rules. The definition covers audio and visual material only. Chatbot messages or AI-written text, which can also be used to manipulate or groom, are not covered.
- Labels don’t undo harm. A label on an AI-generated clip does not help a child whose face has been used in a fake image. Speed of removal and the ability to trace the source matter more.
- Enforcement at scale. Rules apply to platforms, but harmful content also spreads through private messaging groups and smaller apps, where detection is harder.
- Children’s data rules are not yet fully in force. Until the DPDP provisions are enforceable, protections for children’s data rest partly on platform policies.
- Smart devices. Connected toys, speakers, cameras and wearables can collect voice, images and location data. The festival’s discussion flagged privacy risks from such devices, and it is a space where parents often have little clarity on what is collected.
- Age checks create their own risks. Verifying age and parental identity can mean collecting more data, so designs need to protect privacy.
What parents can do
- Talk early and often. Tell children that photos, voices and videos can be faked, and that they should come to you if something worrying appears, without fear of punishment.
- Limit what is public. Keep children’s accounts private and avoid posting clear, high-resolution photos of their faces publicly.
- Check settings on devices. Review microphone, camera and location permissions on smart toys, speakers and apps, and turn off what is not needed.
- If a fake image or video of your child appears: do not forward it. Take screenshots and note links, report it on the platform, and file a complaint at cybercrime.gov.in or call 1930. For child safety support, Childline is 1098. Confirm these numbers on the official sites.
What schools can do
- Include deepfakes and AI literacy in digital safety lessons, covering how to spot fakes and what to do.
- Set a clear reporting process that treats victims supportively and handles incidents quickly and confidentially.
- Treat student data carefully. Under the DPDP law, schools handling children’s data will need verifiable parental consent in most cases.
- Train teachers to recognise signs of distress, bullying and online grooming.
What technology companies should do
- Design for children by default: private settings, limited contact from strangers, and no behavioural advertising to minors, which the DPDP law restricts.
- Detect and label AI-generated content, and act within the new takedown deadlines.
- Offer easy reporting with fast responses, and publish transparency reports on child-safety actions.
- Be careful with data from smart devices and children’s products. Collect the minimum and explain it plainly.
What the government can do
- Enforce, not just notify: publish compliance data on takedowns and labelling.
- Bring forward children’s data protection where possible, and clarify how age verification will work without over-collecting data.
- Cover gaps: consider how AI-generated text, voice cloning and chatbots interact with child safety.
- Support victims: faster complaint handling, helplines and legal aid.
- Fund awareness: school programmes, regional-language materials and training for police.
So, is India ready?
India has moved faster than many countries on labelling and takedown rules, and the data protection law sets a high bar for children’s data. But readiness depends on enforcement, on the DPDP provisions actually coming into force, and on whether families and schools have the awareness to use the protections available. For now, the safest approach combines rules, platform responsibility and informed parents.
Frequently Asked Questions
What are deepfakes?
AI-generated or AI-altered audio, images or videos that make something appear real when it is not.
Are deepfakes illegal in India?
India’s IT Rules now cover AI-generated content with labelling and takedown duties for platforms, and creating or sharing harmful or sexual fakes can attract criminal liability under other laws. Seek legal advice for a specific case.
What does the DPDP Act say about children?
Anyone under 18 is a child. Platforms must get verifiable parental consent before processing a child’s data, with limited exemptions. Full enforcement is expected around May 2027.
How fast must platforms remove deepfakes?
The amended rules set a three-hour deadline for certain flagged unlawful content, with a shorter window for sexual deepfakes, as summarised in legal commentary.
Where can I report a fake image of my child?
Report it on the platform, then file a complaint at cybercrime.gov.in or call 1930. Do not forward the content.