What is the IT Rules 2026 deepfake takedown timeline in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What exactly changed in the IT Rules in February 2026?

Five substantive changes, and the intent-based labelling standard is the one that matters most. Takedown of flagged unlawful content was cut from 36 hours to 3 hours. Non-consensual intimate imagery was given a 2-hour window, down from 24. User-reported grievances must now be resolved within 7 days, down from 15. AI-generated content was brought into the legal ambit, with a requirement to declare it and a platform duty to deploy technical measures to verify and prominently label AI images and audio, embedded with unique metadata for instant identification. And platforms must inform users of the AI regulations every 3 months. A 10% visual-area disclaimer proposal was dropped in favour of an intent-based focus on synthetically generated content intended to mislead or falsify, which the industry welcomed as clearer, though it leaves the 'indistinguishable from real' standard subjective.

Which platforms are actually covered by the AI labelling duty?

The AI provisions focus on Significant Social Media Intermediaries, defined as platforms with 50 lakh or more registered users in India, while all technology intermediaries are expected to embed disclaimers. That distinction has a practical consequence for a victim or a brand: a large platform owes you a labelling and verification duty, and a metadata trail you can point to, while a smaller one owes you less. It also means the enforcement you can actually rely on is concentrated on the large platforms, and your takedown strategy should be built around them first. If a deepfake circulates on a small forum or a mirror, the 3-hour clock is not the mechanism that will help you; a notice to the intermediary and a copyright or personality-rights claim are.

How should a victim use the 3-hour and 2-hour windows?

By being first, complete and specific. The 3-hour clock starts on notification, so a notification that is vague starts a clock that ends with a refusal. A complete notice contains the URL, a full-page screenshot showing the address bar and a visible timestamp, the original media file with a hash, the account details, and a short statement of the ground: false identity and impersonation, non-consensual intimate imagery, or copyright. For the 2-hour window on non-consensual intimate imagery, file through the platform's dedicated route and through the police and cybercrime.gov.in in parallel, because a criminal case adds weight to the platform's prioritisation. And file everything, because a platform can act on the fastest-valid route and a valid notice on a slower route simultaneously, and the earliest removal is the one that matters when material can be mirrored in minutes.

What are the limits of the 2026 timeline, and what do they not fix?

Four limits worth being honest about. The clock binds the platform, not the uploader, and a 3-hour takedown is meaningless if the same file reappears on 20 accounts by the following morning. The rules are Indian and enforcement is Indian, so a host outside India can be slow or unreachable, which is why a monitored campaign with a takedown workflow is what actually holds. The intent-based labelling standard is subjective, and industry lawyers have noted that, so the label on a given item is contestable. And none of this addresses the fraud itself: a perfectly compliant platform can carry a deepfake advertisement that persuades somebody to approve a UPI collect request, and that is stopped by verification procedure, not by a labelling duty. The 2026 timeline changed removal and disclosure. It did not change the need for a callback rule.

What are the frequently asked questions?