On 22 October 2025, the Ministry of Electronics and Information Technology (MeitY) released the draft amendment to the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (Intermediary Rules). The amendment seeks to provide for synthetically generated information, specifically AI-generated content like deepfakes. The government’s move towards the regulation of such content is well-intentioned, as the explanatory note to the amendment highlights how such content is used to produce non-consensual intimate or obscene images, spread fabricated news and commit financial fraud by way of impersonation.
But the amendment is demonstrative of another example of over-regulation in the context of technology. The development of Information Technology legislation in India is a testament to the fact that previous well-intentioned provisions have also been unable to pass the muster the constitutional test. For instance, in Shreya Singhal v. Union, the Supreme Court struck down Section 66A of the IT Act as it violated Article 19(1)(a) by specifying vague grounds to curtail free speech. Similarly, in Kunal Kamra v. Union of India, the Bombay High Court delivered a split verdict wherein Justice G.S. Patel expressed his apprehension with respect to the ’Fact Checking Unit’ of the Central Government constituted under Rule 3(1)(b)(v) of the Intermediary Rules for its potential to have a chilling effect on the freedom of speech and expression.
The 2025 amendment also poses a similar challenge in balancing rights and public interest. Firstly, as per the proposed Rule 2(wa), the definition of ‘synthetically generated information’ is too broad and vague as it covers any information which is artificially or algorithmically created, generated, modified or altered using a computer resource, in a manner that such information reasonably appears to be authentic. The term ‘any information’ may consist of videos, images and text. If a content creator uses ChatGPT to refine his caption for an Instagram post, he will be required to declare the same before it gets uploaded. According to the proposed sub-rule (1A) of Rule 4, a significant social media intermediary (SSMI) is required to obtain such declaration. Further, the SSMI is obliged to deploy technical measures to verify the accuracy of such declarations and display the content as ‘synthetically generated’. Grammar improvement tools like Quillbot are used worldwide by people from all walks of life, ranging from students to academics. Similarly, video and photo editing tools are used to enhance quality and add effects. The definition, by being too expansive in its scope, may pose regulatory challenges as SSMIs would probably resort to an aggressive automated take-down approach. This will curtail artistic freedom in the era of technology without providing a legitimate basis.
The amendment to sub-rule (3) of Rule 3 of the Intermediary Rules introduces a mechanism which, though masquerading as a method of identity, may be potentially exploited as a means of excessive surveillance. The said rule provides for due diligence by intermediaries who enable, permit, or facilitate the creation, generation, modification or alteration of information synthetically. Such intermediaries are duty-bound to ensure that any synthetic information is ‘labelled or embedded with a permanent unique metadata or identifier’. Labelling and identification may prove to be fruitful in detecting synthetic content. This can be done by complying with global practices which incorporate AI watermarking. But embedding content with metadata can jeopardise individual liberty and privacy.
Simply put, metadata refers to ‘data about data’. For example, an image is data, and the details of that image such as its provenance, size, device, date and time of generation, are metadata. In the movie ‘The Hand That Rocks the Cradle (2025)’, the intent, motive and history of a person were traced using random items in her dustbin. Metadata may also consist of such items, which may seem to be insignificant but may have severe privacy implications.
A report by the American Civil Liberties Union of California titled ‘Metadata: Piecing Together a Privacy Solution’ highlights the risks associated with metadata. The report states, “…metadata can reveal who we are, who we know, what we do and care about and plan to do next.” The Report and Recommendations of The President’s Review Group on Intelligence and Communications Technologies highlighted how access to metadata could have a chilling effect on expressive freedoms. In 2012, John McAfee, who was accused of murder, was traced with the help of geographical coordinates revealed from an image shot by Vice Magazine.
Given the laxity of India’s legal regime with respect to the disclosure of information, there is a possibility that metadata may emerge as a tool to suppress marginalised voices and track them at the same time. Under Section 17 of the Digital Personal Data Protection Act, 2023 (DPDP Act), the government can exempt state instrumentalities and private data fiduciaries from the provisions of the Act in the interest of sovereignty, integrity, security or public order. Hence, even if metadata is considered to be personal data insofar as it identifies an individual, entities and state authorities can still be exempted from compliance with privacy safeguards.
Many content creators employ technology in order to conceal their identity to avoid harassment and surveillance. AI-generated voiceovers, unique image patterns and animations are used by them to convey their message. Though state interest might compel the use of invasive methods in exceptional circumstances, the casual adoption of such methods in a diverse country like India may lead to digital marginalisation of genuine content creators. For example, if a Dalit woman highlights the caste atrocities faced by her through a YouTube channel with the help of synthetically generated graphical depictions and modification of her voice using AI, the mandate to attach metadata to that synthetic content may be used to study content patterns and ultimately censor her content. Similarly, if a Muslim journalist who highlights crimes against religious minorities uses AI software to edit videos and add effects, the presence of metadata will enable deep surveillance of the journalist’s activities, location patterns and affiliations.
This excessive intrusion is violative of the necessity as well as the proportionality test laid down in K.S. Puttaswamy v. Union of India. Moreover, it defeats the fundamental privacy principles of purpose limitation and data minimisation. As India is set to implement the DPDP Act, it becomes imperative to give a pervasive effect to privacy principles in order to safeguard individual liberties. The proposed amendment seeks to override individual privacy through the introduction of metadata traceability.
As synthetic content is being misused in many cases such as the creation of obscene or politically motivated deepfakes, regulation of such content is not only desirable but is necessary. At the same time, such regulation should neither have the effect of curtailing artistic expression nor should it slyly introduce intrusive mechanisms which violate constitutional guarantees like the freedom of speech and right to privacy. Whether the amendment will be able to stand the test of constitutionality or not is yet to be seen. But at the same time, the legislators and policymakers working on the draft amendments must consider a modification that is limited to the identification of synthetic content rather than the surveillance of individuals.
Abdul Hannan Qazi is a final-year law student at Jamia Millia Islamia. He is the Co-founder of Tech Prosecutor and is the Founding Member and Operations Head at Project Mishkat. He can be reached at abdulhannanqazi27@gmail.com.
The post ‘Metadata’ conundrum: How draft amendment to the IT rules enables surveillance, undermines privacy appeared first on Maktoob media.
