How do you protect your face from AI misuse in India?
Key takeaways
- Your face is biometric data under the DPDP Act 2023, and a face image used to train a model without consent is a personal data breach in law once the Rules 2025 commencement tranches apply.
- A face authentication through Aadhaar or a video KYC flow can be defeated by synthetic media, which the I4C warned about in June 2026.
- Under the IT Rules 2021 as amended in February 2026, Significant Social Media Intermediaries with 50 lakh or more Indian users must label AI-generated content and embed unique metadata for identification.
- AI-assisted phishing and business email compromise in India are now written in clean, business-specific language, so a grammar check is no longer a defence.
- A monitored likeness watch, at Rs 12,000 to Rs 30,000 per month in India, catches re-uploads within hours of publication, which a one-time check does not.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What makes a face worth stealing?
Three qualities, and you can influence all of them. Volume: a model needs many frames, and a public feed of well-lit front-facing video is ideal training material. Quality: high resolution, steady light, neutral expression and minimal compression make a face easier to reconstruct. Scarcity: a face that appears rarely, from odd angles, in poor light, is expensive to model. So the practical levers are to publish less clean front-facing video, to make your public images stylised or low-resolution where you can, and to keep the genuinely valuable material, family photos, professional headshots, a wedding video, on private accounts. That is not a cure, but it raises the cost of the misuse materially, and cost is what deters most attempts.
What should you change on your accounts this week?
Six changes, in order of effect. Turn off photo and video reuse permissions for third-party apps, because that setting decides who may train on your content. Switch two-factor authentication from SMS to an authenticator app or a passkey on WhatsApp, Instagram, Google and your email, because a cloned voice defeats a phone-based check while a passkey does not. Make your email account the recovery anchor for everything else, and give it a hardware key. Set the privacy of your profile and story to friends-only where possible, and disable location tagging. Remove old tagged photos of yourself that a stranger uploaded. And set an alert on your own name so you hear about impersonation early, because the first week is when a deepfake does the most damage.
What should you do if a stranger photographs your face for AI training?
In a public place in India, there is no general right to be unphotographed, but the outcome depends on what happens next. If the image is used to train a model or to make a synthetic image of you without consent, several routes open. A grievance to the platform under the IT Rules 2021, a notice to the intermediary that is hosting the synthetic content, a complaint to the police or on cybercrime.gov.in, and civil relief for personality-rights infringement. Under the IT Rules amendments of February 2026, Significant Social Media Intermediaries with 50 lakh or more registered Indian users must deploy technical measures to verify AI-generated content and label it, which is the hook to argue that a labelling duty has been breached. Keep the evidence, because a takedown without a dated file and a URL is a request, not a case.
How do you keep an eye on your own likeness cheaply?
Two layers, and the second is the one people skip. The first is free: set a Google alert on your name in quotes plus your city, check the impersonation reports on Instagram and WhatsApp monthly, and search your own name on the platforms that matter. The second is a monitored watch, which is what most people who have already been targeted need. A likeness watch in India runs Rs 12,000 to Rs 30,000 per month, and it does three things: it searches for new images of your face, it checks whether the media has been tampered with, and it files takedowns on the platforms where it appears. A one-time check tells you where you stand today; a watch tells you about tomorrow.
| Control | Effort | What it changes |
|---|---|---|
| Limit clean front-facing public video | Ongoing | Reduces the training material available for a model of your face |
| Passkey or authenticator instead of SMS 2FA | One hour | A cloned voice or a spoofed caller no longer passes the second factor |
| Turn off third-party photo reuse permissions | 20 minutes | Stops apps training on your published content by default |
| Watch for impersonation by name and image | Monthly, or monitored | Catches a published deepfake in days rather than weeks |
| Keep a dated evidence pack of your own images | One hour, once | Proves which media is authentic when a deepfake is disputed |
What are the frequently asked questions?
Get a straight answer on this
Send us three public links where you appear, and we will return a likeness exposure map with the specific changes to make first.
Send us the details See pricing