1. Introduction

Deepfake Biometrics Criminal Liability concerns the criminal responsibility of individuals, companies, technology developers, and other intermediaries who create, manipulate, distribute, or fraudulently use artificial intelligence-generated biometric identities.

Deepfake biometrics involve the manipulation or artificial generation of human-identifying characteristics, including:

Facial biometrics: AI-generated faces, facial swaps, and manipulated facial recognition data.

Voice biometrics: Artificially cloned voices used to impersonate individuals.

Fingerprint biometrics: Fabricated or manipulated fingerprint data used to defeat authentication.

Iris and retinal biometrics: Artificially generated or altered eye-pattern data.

Behavioural biometrics: Manipulation of typing patterns, gait, gestures, and other behavioural characteristics.

Multimodal biometrics: Combining fabricated facial, voice, fingerprint, and behavioural information to impersonate a real person.

The central criminal-law problem is that biometric identity systems are increasingly used for banking, employment, immigration, healthcare, national identification, digital authentication, and criminal investigations.

When criminals use deepfake technology to bypass these systems, their conduct may constitute identity theft, impersonation, cheating, forgery, fraud, cybercrime, privacy violations, or offences involving national security.

The legal challenge is determining who should be criminally liable, what mental element must be established, and how digital and biometric evidence can prove the offence beyond reasonable doubt.

2. Meaning and Nature of Criminal Liability

Deepfake biometric criminal liability can arise at several stages:

Importantly, creating a synthetic face or voice is not automatically a crime. Criminal liability ordinarily requires proof of the relevant statutory elements, such as dishonest intention, fraudulent purpose, unauthorized access, deception, or prohibited distribution.

3. Indian Legal Framework Governing Deepfake Biometric Crimes

India does not have one comprehensive criminal statute exclusively dedicated to deepfake biometric offences. Instead, criminal prosecution relies on the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023 (BNS), and the Bharatiya Sakshya Adhiniyam, 2023 (BSA).

A. Information Technology Act, 2000

1. Section 66C – Identity theft

Section 66C criminalises fraudulent or dishonest use of another person's electronic signature, password, or other unique identification feature.

Application to deepfake biometrics:

Fraudulent use of biometric authentication credentials.

Using stolen or unlawfully obtained digital identity features.

Impersonating an individual through compromised authentication credentials.

Punishment: Imprisonment up to three years and a fine up to ₹1 lakh.

An important qualification is that a synthetic face or voice does not automatically fall within Section 66C. The prosecution must establish that the identifier used satisfies the statutory requirements.

2. Section 66D – Cheating by personation using computer resources

This provision is particularly relevant to deepfake biometric fraud.

Examples include:

Cloning a bank customer's voice to obtain financial information.

Using an AI-generated face to impersonate a government official.

Manipulating a video identity verification process to obtain a loan.

Using synthetic biometric characteristics to deceive another person into transferring money.

Punishment: Imprisonment up to three years and a fine up to ₹1 lakh.

3. Section 66E – Violation of privacy

Section 66E penalises intentional or knowing capture, publication, or transmission of images of a person's private area without consent, in circumstances violating privacy.

It may become relevant where deepfake technology is connected with unlawful private-area imagery. However, it should not be treated as a universal offence covering every synthetic intimate image.

4. Sections 67 and 67A – Obscene and sexually explicit electronic content

These provisions may apply when deepfake biometric manipulation is used to publish or transmit obscene or sexually explicit material.

Section 67 concerns obscene material, while Section 67A concerns material containing sexually explicit acts or conduct.

5. Section 79 – Intermediary liability

Digital platforms may receive conditional safe-harbour protection for third-party content.

However, intermediaries must comply with applicable due-diligence requirements. Their liability depends on statutory conditions, knowledge, applicable removal obligations, and their own participation in unlawful activity.

B. Bharatiya Nyaya Sanhita, 2023

The BNS provides additional criminal-law mechanisms.

Example: A criminal generates a synthetic facial identity, creates a fabricated electronic identity document, and uses it to obtain financial benefits.

Depending on the evidence, prosecution may involve Sections 318, 319, 336 and 340, alongside applicable provisions of the IT Act.

Importantly, not every deepfake is a forged electronic record. The prosecution must establish the legal ingredients of forgery, including the relevant false-document or false-record requirement and the required intention.

C. Bharatiya Sakshya Adhiniyam, 2023

The BSA governs the admissibility and proof of electronic and digital records.

Sections 61–63 are particularly relevant to electronic records and their admissibility.

In deepfake prosecutions, investigators may need to establish:

The original source of the biometric information.

Whether the audio, image, or video was manipulated.

Whether the submitted digital record is authentic.

Whether the electronic evidence has been properly preserved.

Whether the applicable statutory certificate requirements have been fulfilled.

The existence of a deepfake detection report alone does not automatically establish criminal guilt.

4. Essential Elements of Criminal Liability

Criminal responsibility requires more than proving that AI-generated biometric material exists.

Five important elements should be examined.

1. Actus reus (criminal act)

The accused must have performed an act prohibited by the applicable law, such as impersonation, cheating, unauthorized use of credentials, or forgery.

2. Mens rea (criminal intention)

The prosecution must establish the mental element required by the particular offence.

For example, a person who deliberately clones a bank manager's voice to deceive a customer may demonstrate dishonest or fraudulent intention.

By contrast, an artist creating a clearly disclosed synthetic voice for entertainment does not automatically commit an identity-related crime.

3. Attribution

Investigators must connect the accused with the creation, transmission, or use of the fabricated biometric material.

Relevant evidence includes:

IP addresses and server logs.

Device identifiers.

Application records.

Payment transactions.

AI-generation histories.

Communications between conspirators.

Digital forensic reports.

4. Causation and harm

Where an offence requires deception, wrongful gain, wrongful loss, injury, or another consequence, the prosecution must prove the relevant statutory requirement.

5. Absence of applicable legal justification

Consent, lawful authority, statutory permissions, and other recognised defences must be considered according to the particular offence.

5. Criminal Liability of Different Participants

Deepfake biometric crimes frequently involve several participants.

6. Corporate and Organisational Criminal Liability

A particularly difficult issue arises when a company knowingly uses fabricated biometric identities to obtain financial or commercial benefits.

For example, an organisation might deliberately use synthetic faces to create multiple customer accounts, defeat customer-verification procedures, or manipulate identity authentication systems.

Potential liability may arise under applicable cheating, forgery, and IT Act provisions.

However, corporate criminal liability must be distinguished from the personal liability of directors and employees. A director is not automatically criminally responsible merely because they hold an executive position.

The prosecution must establish the relevant statutory basis for corporate attribution or the individual's own criminal involvement.

7. Important Case Laws and Judicial Principles

There is an important distinction between cases directly involving deepfakes and earlier judgments that establish principles applicable to deepfake biometric crimes. The following cases are particularly relevant to Indian legal analysis.

Case 1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

Supreme Court of India

Facts and legal issue:

The Supreme Court considered whether privacy is a fundamental right under the Indian Constitution. The case involved the constitutional protection of personal information and individual autonomy, including concerns relating to biometric identification.

Judgment:

The nine-judge Constitution Bench unanimously recognised privacy as a fundamental right protected by Article 21 and other freedoms under Part III of the Constitution.

Relevance to deepfake biometrics:

The judgment establishes constitutional foundations for protecting:

Biometric identity.

Facial and voice-related personal information.

Informational privacy.

Individual autonomy.

Protection against disproportionate surveillance.

Legal principle: Unlawful manipulation or exploitation of biometric identity may raise constitutional privacy concerns, particularly where State action or State-supported processing is involved.

The case does not itself establish a criminal offence for creating a deepfake.

Sci API+1

Case 2. K.S. Puttaswamy v. Union of India (Aadhaar Judgment), (2019) 1 SCC 1

Supreme Court of India

Facts:

The Supreme Court examined the constitutional validity of the Aadhaar framework, including the collection, storage, and authentication of biometric information.

Judgment:

The Court upheld the Aadhaar framework subject to constitutional limitations and struck down or restricted certain provisions and applications.

Relevance:

This decision is important for determining the legality of biometric authentication, data storage, and access to identity information.

For example, if an individual unlawfully manipulates biometric authentication to obtain another person's government benefits, the relevant criminal provisions may apply.

Legal principle: Biometric authentication must operate within a legally authorised framework with appropriate safeguards.

National Digital Library of India+1

Case 3. Shreya Singhal v. Union of India (2015) 5 SCC 1

Supreme Court of India

Facts:

The Supreme Court examined Section 66A of the IT Act and the intermediary-liability framework under Section 79.

Judgment:

The Court struck down Section 66A as unconstitutional. It also interpreted intermediary liability and the knowledge requirements under Section 79.

Relevance to deepfake biometric crimes:

The judgment is important where manipulated biometric videos, cloned voices, or fraudulent identity material are uploaded and circulated through online platforms.

It helps distinguish between:

The person who creates the unlawful content.

The person who knowingly distributes it.

The intermediary hosting third-party content.

Legal principle: Online intermediaries cannot automatically be treated as criminally responsible for everything users publish. Their liability must be assessed under the applicable statutory framework and the Court's interpretation of intermediary obligations.

Case 4. Anvar P.V. v. P.K. Basheer (2014) 10 SCC 473

Supreme Court of India

Facts:

The case concerned the admissibility of electronic records in legal proceedings.

Judgment:

The Supreme Court established the importance of compliance with Section 65B of the Indian Evidence Act, 1872, for secondary electronic evidence.

Relevance to deepfake biometrics:

Suppose the prosecution submits:

A video showing a fabricated facial identity.

A recording of a cloned voice.

A manipulated fingerprint authentication report.

A digital recording allegedly showing the accused operating a biometric fraud system.

The authenticity and admissibility of these records must be established under the applicable evidence law.

The judgment is relevant to the evidentiary framework now replaced by the BSA, 2023.

Indian Kanoon+1

Case 5. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) 7 SCC 1

Supreme Court of India

Facts:

The dispute concerned the legal requirements for producing electronic records as evidence.

Judgment:

The Supreme Court reaffirmed the importance of the statutory certificate under Section 65B of the Evidence Act for secondary electronic records, subject to the recognised treatment of original electronic records.

Relevance:

This case is particularly significant in deepfake biometric investigations because digital recordings and authentication logs may be manipulated.

Investigators should preserve:

Original electronic files.

Metadata.

Device information.

Server logs.

Hash values and forensic copies.

Expert examination reports.

Under the present BSA framework, the corresponding electronic-record provisions must be applied.

Legal principle: Electronic evidence must satisfy statutory requirements for admissibility; its authenticity and evidentiary weight must also be evaluated.

Sci API+1

Case 6. Jaikishan Kakubhai Saraf alias Jackie Shroff v. The Peppy Store & Others, 2024:DHC:4046

Delhi High Court · 15 May 2024

Facts:

The plaintiff sought protection against unauthorised commercial exploitation of his name, voice, image, likeness, and personality attributes, including misuse involving artificial intelligence.

Judgment:

The Delhi High Court granted interim protection against specified unauthorised commercial uses of the plaintiff's personality attributes.

Relevance to deepfake biometrics:

This decision is significant for understanding the legal protection of a person's voice, facial identity, and distinctive personality characteristics against unauthorised AI-based exploitation.

For example, an individual who creates a synthetic voice resembling a real person's voice and uses it commercially without authorisation may face civil proceedings, while criminal proceedings would require proof of a separate criminal offence.

Legal principle: AI technology does not automatically eliminate legal protection for identifiable personality attributes.

This was a civil personality-rights decision, not a criminal conviction for biometric deepfake fraud.

DHCCaseInfo+1

Case 7. Anil Kapoor v. Simply Life India & Others, 2023 SCC OnLine Del 6914

Court: Delhi High Court.

Legal significance:

The Court's personality-rights jurisprudence provides protection against unauthorised commercial exploitation of a person's identity and distinctive attributes.

Application:

Where deepfake technology is used to commercially exploit someone's face, voice, or likeness, this line of authority may support civil remedies.

However, a criminal prosecution must independently satisfy the ingredients of the applicable penal provision.

Important observation about precedent

As of November 2026, the above judgments provide important legal principles, but they should not be described as convictions specifically for deepfake biometric criminal offences. A reported Indian criminal precedent conclusively establishing a comprehensive offence of deepfake biometric impersonation remains a distinct legal-development issue.

8. Deepfake Biometric Criminal Liability: Practical Illustrations

Illustration A: AI voice-cloning banking fraud

A criminal obtains recordings of a bank customer's voice and creates an AI-generated replica.

The criminal contacts a bank employee, impersonates the customer, and attempts to transfer money.

Potential provisions:

IT Act Section 66D.

BNS Section 318, where cheating is established.

BNS Section 319, where cheating by personation is established.

Additional provisions relating to forgery, depending on the documents or records used.

Illustration B: Facial recognition manipulation

A criminal uses a synthetic face to bypass a biometric verification system.

The criminal then opens a fraudulent financial account.

Potential legal consequences include prosecution under applicable provisions of the IT Act and BNS, depending on whether identity theft, unauthorized access, personation, or cheating can be established.

Illustration C: Deepfake biometric evidence in criminal proceedings

An accused person alleges that the prosecution's facial-recognition video was fabricated using AI.

The court must examine:

Whether the original recording exists.

Whether the video has been altered.

Whether metadata supports its authenticity.

Whether the facial-recognition methodology is reliable.

Whether the expert evidence is scientifically defensible.

A manipulated video cannot safely be treated as genuine merely because it appears realistic.

Illustration D: Synthetic identity and government-benefit fraud

A person generates several artificial biometric identities to obtain benefits intended for genuine beneficiaries.

Depending on the facts, the conduct may attract cheating, forgery, personation, and applicable IT Act offences.

9. Investigation and Digital Forensic Requirements

Deepfake biometric investigations require specialised technical expertise.

Can You Spot the Fake Turkey: AI Detection Mastery | AI Video Detector

1. Digital forensic examination

Investigators should preserve the original devices, source files, metadata, and relevant system logs.

Deepfake Detection Methods Course — Free | Certificate in 7 Languages - Catch Wisdom

2. Biometric verification

Compare the disputed facial, voice, fingerprint, or iris data with reliable reference material, while accounting for system error.

Audio Forensics | 4D Forensics

3. Audio and video authentication

Examine inconsistencies, editing traces, synthesis indicators, and provenance information.

Cracking the Code on Becoming a Cyber Crime Investigator

4. Chain of custody

Document who collected, transferred, accessed, analysed, and stored every relevant item of digital evidence.

AI-detection software should be treated as an investigative aid rather than conclusive proof. A negative detection result does not necessarily establish authenticity, and a positive result does not by itself establish who created the manipulation.

10. Constitutional and Human Rights Dimensions

Deepfake biometric criminal liability also involves constitutional protections.

Article 14 – Equality before law

Government agencies must apply biometric verification procedures fairly and consistently. False biometric identification should not result in arbitrary denial of public services.

Article 19 – Freedom of speech and expression

The law must distinguish between harmful biometric impersonation and legitimate expression, including satire, parody, artistic works, and political commentary.

Article 21 – Right to life, dignity and privacy

Unauthorised biometric manipulation may affect personal autonomy, dignity, reputation, and informational privacy.

Article 20(3) – Protection against self-incrimination

The constitutional protection against compelled self-incrimination becomes relevant when investigating agencies seek biometric or other personal evidence from an accused.

The distinction between physical identification evidence and compelled testimonial communication is important. The Supreme Court's reasoning in Puttaswamy and earlier constitutional jurisprudence should be considered when evaluating such investigative measures.

11. Regulatory and Enforcement Challenges

Several difficulties complicate criminal prosecution.

The Indian Government has also addressed deepfake-related risks through the IT Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, including their subsequent amendments.

Government statements in 2026 identify the IT Act, BNS, and intermediary framework as relevant legal mechanisms for addressing AI-generated deepfakes.

Press Information Bureau+2

12. Critical Legal Analysis

The existing Indian framework provides several routes for prosecuting deepfake biometric crimes, but three major gaps remain.

First: Absence of a dedicated biometric deepfake offence.

Existing laws address identity theft, personation, cheating, and forgery. However, they do not comprehensively define all forms of synthetic biometric impersonation.

Second: Difficulty in establishing criminal intention.

Generative AI makes it possible for different individuals to create, modify, distribute, and use synthetic biometric material.

Criminal responsibility should therefore be assessed according to individual conduct, knowledge, intention, participation, and control.

Third: Difficulty in proving biometric authenticity.

Traditional forensic methods may not always detect sophisticated synthetic media. Courts increasingly need reliable technical expertise, reproducible examination methods, and properly preserved digital evidence.

13. Suggested Legal Reforms

India could strengthen its framework through:

A clearly defined offence addressing intentional and harmful synthetic biometric impersonation.

Special safeguards for facial, voice, fingerprint, and iris authentication systems.

Stronger penalties for biometric identity fraud causing substantial financial or personal harm.

Clear standards for preserving and authenticating AI-generated evidence.

Effective international cooperation for investigating cross-border biometric fraud.

Proportionate duties for AI developers and online platforms.

Strong protection for victims of non-consensual biometric manipulation.

Safeguards against wrongful criminal prosecution based on unreliable AI-detection technology.

Any new criminal offence should distinguish malicious deception from lawful research, security testing, consent-based synthetic media, and legitimate creative expression.

14. Conclusion

Deepfake Biometrics Criminal Liability represents an emerging area of cybercrime, criminal jurisprudence, digital evidence, constitutional privacy, and artificial intelligence regulation.

In India, the Information Technology Act, 2000, particularly Sections 66C, 66D and 66E, together with relevant provisions of the Bharatiya Nyaya Sanhita, 2023, provide important mechanisms for prosecuting fraudulent biometric impersonation.

The judgments in K.S. Puttaswamy, Shreya Singhal, Anvar P.V., Arjun Panditrao Khotkar, and Jackie Shroff v. The Peppy Store provide significant constitutional, evidentiary, intermediary-liability, and personality-rights principles.

Nevertheless, a distinction must be maintained between civil infringement of personality rights and criminal biometric impersonation. Criminal liability cannot arise merely because someone has used AI to imitate another person's face or voice. The prosecution must prove the ingredients of a recognised criminal offence.

Ultimately, the objective of criminal law should be to protect biometric identity, prevent digital impersonation, preserve evidentiary integrity, and ensure accountability without unnecessarily criminalising legitimate AI innovation.

15. Important Legal References for Further Research

Primary research sources:

Supreme Court – Puttaswamy judgment

Supreme Court – Arjun Panditrao judgment

Delhi High Court – Jackie Shroff judgment

Government of India – Deepfake regulatory framework

Research note: This analysis focuses on Indian law. The cited judgments are relevant precedents by analogy; they should not be misrepresented as direct criminal convictions for deepfake biometric offences.

I can also develop this subject into an 800–1,000-word academic law research paper with additional comparative case laws from the UK, USA and European Union.