If a stranger posts a defamatory deepfake of you on social media, the law knows exactly who to blame - the user and sometimes the platform that hosted it. But what happens when no user wrote anything at all and the AI itself generated the image, the caption and the claim? India doesn't have a clean answer yet - and that gap is what MeitY is now trying to close.

The law was written for platforms that host. AI platforms create.

A rule built for a different problem Section 79 of the IT Act, 2000 gives internet platforms "safe harbour"

• legal protection from liability for what their users post. The logic is straightforward: a platform can't be expected to police every piece of content a user uploads in real time, so as long as it removes flagged material when notified, it isn't treated as the author of the harm. That logic depends entirely on one assumption: the platform is a passive host and a human user is the one who actually created the problematic content. AI breaks that assumption completely. When a generative AI model produces a deepfake or an AI chatbot generates a defamatory claim about a real person, there was no user "posting" anything in the traditional sense - the system itself generated the content, often by pattern-matching across scraped internet data and then editorializing in ways that are genuinely hard to trace back to any single source.

Who actually gets hurt when this gap exists Picture a woman whose public Instagram photos get scraped and turned into a non-consensual deepfake by an AI tool she's never heard of, on a platform she never used. Under India's current data law, this scenario sits in an uncomfortable legal blind spot: the Digital Personal Data Protection Act, 2023 exempts publicly available personal data from its protections, meaning the very fact that her photos were public makes them fair game for scraping under existing rules. The AI platform isn't quite a "publisher" the way a newspaper is and it isn't quite a neutral "host" the way a comment section is either - it's something the current legal categories weren't built to describe. This is precisely the gap MeitY is now trying to close with a standalone AI law - not a patch to the IT Act, but a separate framework built around consent for synthetic media and around defining exactly how much autonomy an "agentic" AI system should be allowed before its actions require a clearly identifiable, liable party standing behind them.

Why "agentic" is the harder half of the problem Deepfakes are the visible, easily explained version of this issue.

Agentic AI - systems that don't just generate a single output but autonomously plan and execute multi-step actions, retaining and reusing data along the way - is the version regulators are far more anxious about, precisely because accountability gets murkier with every additional autonomous step the system takes on its own.

That's why the government specifically flagged Singapore's newly announced agentic AI governance framework as a reference point and why even historically lighter-touch regulatory jurisdictions are re-examining their stance.

The exam-relevant insight here isn't "India is regulating AI"

• it's that the entire liability architecture built for the user-generated content era assumed a human always sits behind the harmful output. AI has quietly broken that assumption and the law is only now catching up to say so.