Grok, Deepfakes and Platform Liability: Lessons for US Platforms Operating in India

In January 2026, India’s IT ministry sent a formal notice to X over obscene images generated with its AI tool Grok and warned that the platform’s safe harbour was at risk. The episode is the clearest recent example of platform liability deepfakes India US company teams need to understand: a US platform, a US-built AI tool, Indian users and an Indian regulator prepared to use the safe harbour condition as pressure.

This guide uses the Grok episode to explain the rules for platform liability deepfakes India US company operators: how Section 79 safe harbour works, what the 2026 IT Rules add for synthetic content, what Indian criminal and civil exposure looks like, and a practical compliance checklist. It is written by an Indian law firm for US companies. US law points belong to US counsel.

What happened with Grok and X in January 2026

On 2 January 2026, the Ministry of Electronics and Information Technology issued a notice to X demanding removal of obscene and unlawful content generated through Grok and an action-taken report within 72 hours, later extended by 48 hours. The ministry also questioned whether X’s India-based compliance officers had the authority the rules require, and reports said the government was weighing whether to withdraw X’s safe harbour protection.

X responded around 7 January. Reports say it removed about 3,500 pieces of content and deleted more than 600 accounts, and that image generation on Grok was restricted to paid subscribers. Some accounts say X now automatically watermarks all Grok images and videos after a MeitY direction. We could not verify that claim in public reporting, so we do not rely on it.

The significance is not only the content. The ministry treated an AI feature of a platform as within its supervision, tied its demand to the platform’s legal immunity and asked about the seniority of compliance staff in India. This is the template for platform liability deepfakes India US company risk.

How safe harbour works and when it is lost

Section 79 of the Information Technology Act, 2000 protects an intermediary from liability for third-party content it hosts or transmits, if it observes due diligence and acts on actual knowledge of unlawful content. The Supreme Court’s 2015 decision in Shreya Singhal v. Union of India read actual knowledge to mean a court order or a notified government direction. Losing safe harbour means the platform can be treated like any other publisher.

There is no Indian equivalent of Section 230 of the US Communications Decency Act, so a US company cannot assume that US-style immunity follows its product into India. Indian safe harbour is conditional, and the conditions can be tightened by rules and, as the Grok episode shows, enforced through notices.

The deeper question for AI features is whether content generated by the platform’s own model counts as third-party content at all. That question is debated and untested, as discussed in our guide to AI intermediaries. A cautious US company should assume that an AI feature it controls may not enjoy safe harbour and should build controls as if it were the publisher.

For a US company, the corporate structure in India matters. Some platforms operate through an Indian subsidiary, others rely on a foreign entity only. Regulators will contact whichever local officers or entities they can identify, and the rules for significant social media intermediaries require resident officers. If your platform meets the user threshold, treat the local officers as a core control, not a formality, and make sure they can act without waiting for US approvals during a short deadline.

The 2026 IT Rules and synthetic content

The IT Amendment Rules, 2026, notified on 10 February 2026 and in force from 20 February 2026, bring synthetically generated audio, visual and audio-visual content within the intermediary framework. Platforms that enable such content must apply due diligence, and significant social media intermediaries, with more than five million registered users in India, must obtain a user declaration on whether content is synthetic and take reasonable steps to verify it. Text is outside the definition.

The framework also requires intermediaries to appoint India-based officers, publish a grievance mechanism, respond to complaints within the rules’ time limits and comply with lawful orders. The Grok notice questioned whether such officers had real authority, so a nominal appointment is not enough. Significant social media intermediaries have extra duties, including a chief compliance officer, a nodal contact person and a resident grievance officer, all residents in India.

These rules, and the ministry’s later advisories, mean that platform liability deepfakes India US company compliance should include labelling, provenance or watermarking features for AI-generated visuals where the rules apply, clear policies against non-consensual and obscene imagery, and fast takedown procedures. Details should be confirmed against the current text.

Criminal, civil and personality-rights exposure

Beyond safe harbour, Indian law creates direct exposure. Publishing or transmitting obscene material and sexually explicit material is an offence under Sections 67 and 67A of the IT Act, and the Bharatiya Nyaya Sanhita, 2023 has provisions on obscenity and related offences. Content involving minors triggers the Protection of Children from Sexual Offences Act, 2012. Officers of a company can be named where an offence is committed with their involvement or neglect.

Civil claims are growing. Indian courts, led by the Delhi and Bombay High Courts, have granted injunctions protecting the personality rights of public figures against deepfakes and AI voice and image cloning, and have directed platforms to remove content. Private individuals can also seek removal and damages for non-consensual intimate images.

Regulatory orders can add to these. The government can direct blocking under Section 69A of the IT Act, and platforms that miss deadlines may face the safe harbour consequences described above. A US company should therefore map criminal, civil and regulatory exposure separately, because a single deepfake incident can trigger all three.

Insurance and contracts need a look. Check whether cyber, media liability and directors and officers policies cover regulatory proceedings and content claims in India, and whether exclusions apply to AI-generated content. Review indemnities with Indian advertisers, developers and cloud providers. If your AI feature is built on a third-party model, understand what the model provider will and will not take responsibility for, because the platform will be the party in front of the Indian regulator.

A compliance checklist, remedies and quick answers

Appoint real India-based officers with authority, resources and direct access to leadership. Maintain a clear grievance channel and respond within the rules’ time limits. Review AI features for abuse paths: block prompts and outputs that sexualise real people or minors, add rate limits, log outputs and prepare a rapid shutdown switch. Label or watermark AI-generated visuals where required, and keep records of declarations and verification. Prepare a playbook for government notices: who receives them, how counsel reviews them, how quickly action is taken and how the response is documented. Train teams, test the process and keep a log. If you receive a notice like the one X received, respond within the deadline, take down what is clearly unlawful, explain your controls and ask for time in writing if needed, and take advice on challenging an overbroad order. Insurance and indemnities should be reviewed for regulatory and content risks. The lesson of the Grok episode for platform liability deepfakes India US company teams is that India treats AI features as part of the platform, and expects local accountability.

Related reading: whether an AI product is an AI intermediary under Section 79, MeitY’s October 2026 AI labelling advisory, the draft IT Rules change on binding MeitY advisories, labelling AI-generated content under the IT Rules 2026, deepfakes and personality rights in India, the Sahyog portal and content takedowns and the DPDP Act for US SaaS companies; also the Ofcom ruling and Indian apps with UK users; also deepfake removal in India; also TAKE IT DOWN Act compliance for platforms built in India and Section 230 and India’s IT Rules.

Quick answers

Can a US platform rely on Section 230 in India?

No. Section 230 is US law. In India, safe harbour is under Section 79 of the IT Act and is conditional on due diligence and compliance with rules and orders.

What did the Grok episode show about platform liability deepfakes India US company operators face?

That the government may tie demands about an AI feature to the platform’s safe harbour, set short deadlines, question the authority of local compliance officers and expect removal of unlawful content and accounts.

Do the 2026 IT Rules require watermarking of AI images?

They require due diligence for synthetically generated audio and visual content, including declarations and labelling by platforms where they apply. Check the current rules for the exact labelling and metadata requirements, as proposals have been reported separately.

Did X watermark all Grok images after the notice?

Some accounts say so, but we found no public reporting that confirms it, so we do not rely on it.

Does the US Section 230 protect a platform in India?

No. Section 230 is US law. In India, safe harbour is under Section 79 of the IT Act and depends on due diligence and compliance with rules and orders.

Final word

Halverton & Co. is an Indian law firm advising US companies, founders, investors and law firms on Indian law, including intermediary compliance, government notice responses, personality rights and AI content liability for US platforms operating in India. We practise in Jharkhand, Maharashtra and before the Supreme Court of India, and work alongside US counsel, who advise on US law. Halverton & Co.: Where tech needs law! If you have a question about Indian law, write to us at office@halvertonandco.com, or get in touch.

This article reflects developments reported up to late October 2026. It is for general information only, is not legal advice, and does not create an attorney-client relationship. Halverton & Co. is an Indian law firm and does not advise on US law; US-law points should be confirmed with US counsel.