TRAI on Promotional Messages & Calls
Introduction
The Telecom Regulatory Authority of India (TRAI), on March 13 2023, published a new rule to regulate telemarketing firms. Trai has demonstrated strictness when it comes to bombarding users with intrusive marketing pitches. In a report, TRAI stated that 10-digit mobile numbers could not be utilised for advertising. In reality, different phone numbers are given out for regular calls and telemarketing calls. Hence, it is an appropriate and much-required move in order to suppress and eradicate phishing scammers and secure the Indian Cyber-ecosystem at large.
What are the new rules?
The rules state that now 10-digit unregistered mobile numbers for promotional purposes would be shut down over the following five days. The rule claim that calling from unregistered mobile numbers had been banned was published on February 16. In this case, using 10-digit promotional messages for promotional calling will end within the following five days. This step by TRAI has been seen after nearly 6-8 months of releasing the Telecommunication Bill, 2022, which has focused towards creating a stable Indian Telecom market and reducing the phoney calls/messages by bad actors to reduce cyber crimes like phishing. This is done to distinguish between legitimate and promotional calls. According to certain reports, some telecom firms allegedly break the law by using 10-digit mobile numbers to make unwanted calls and send promotional messages. All telecom service providers must execute the requirements under the recent TRAI directive within five days.
How will the new rules help?
The promotional use of a cellphone number with 10 digits was allowed since the start, however, with the latest NCRB report on cyber crimes and the rising instances and reporting of cyber crimes primarily focused towards frauds related to monetary gains by the bad actors points to the issue of unregulated promotional messages. This move will act as a critical step towards eradicating scammers from the cyber-ecosystem, TRAI has been very critical in understanding the dynamics and shortcomings in the regulation of the telecom spectrum and network in India and has shown keen interest towards suppressing the modes of technology used by the scammers. It is a fact that the invention of the technology does not define its use, the policy of the technology does, hence it is important to draft ad enact policies which better regulate the existing and emerging technologies.
What to avoid?
In pursuance of the rules enacted by TRAI, the business owners involved in promotional services through 10-digit numbers will have to follow these steps-
- It is against the law to utilise a 10-digit cellphone number for promotional calls.
- You should stop doing so right now.
- Your mobile number will be blocked in the following five days if not.
- Users employed by telemarketing firms are encouraged to refrain from using the system in such circumstances.
- Those working for telemarketing firms are encouraged not to call from their mobile numbers.
- Users should phone the company’s registered mobile number for promotional purposes.
Conclusion
The Indian netizen has been exposed to the technology a little later than the western world. However, this changed drastically during the Covid-19 pandemic as the internet and technology penetration rates increased exponentially in just a couple of months. Although this has been used as an advantage by the bad actors, it was pertinent for the government and its institutions to take an effective and efficient step to safeguard the people from financial fraud. Although these frauds occur in high numbers due to a lack of knowledge and awareness, we need to work on preventive solutions rather than precautionary steps and the new rules by TRAI point towards a safe, secured and sustainable future of cyberspace in India.
Related Blogs
Introduction
Digital evidence has become part of almost every modern investigation. A photograph can place a person at a location, an audio recording can capture a conversation, and a video can appear to show an event as it happened. For years, the main forensic concern was whether such material had been altered. The rapid growth of generative artificial intelligence has added a harder question: even when a file is preserved exactly as received, can investigators still trust what it appears to show?
Deepfakes have made this question practical rather than theoretical. Synthetic or manipulated audio, video and images can imitate real people and real events with increasing realism. CERT-In describes deepfakes as a high-risk threat because they can support disinformation, fraud, social engineering and reputational harm.[1] NIST research likewise treats AI-generated media as a digital-forensics challenge that requires systematic evaluation of detection technologies.[2]
The result is an evidence problem. The answer is not to stop trusting digital evidence, but to become more disciplined about establishing its origin, integrity, context and authenticity.
The evidence problem begins before the laboratory
When a suspicious video reaches an investigator through WhatsApp, Telegram, email or social media, the file may already have passed through several transformations. It may have been compressed, re-encoded, cropped, renamed or stripped of metadata. A screenshot may preserve what is visible but lose the original file structure. A forwarded audio clip may contain no reliable information about where it was first recorded.
For that reason, forensic examination should begin with acquisition and provenance, not with a quick “deepfake detector” result. Investigators should ask: Who supplied the file? Where was it obtained? Is there an original version? What device or account produced it? What happened to the file before it reached the investigator?
Cryptographic hashing remains important because it can demonstrate that an acquired working copy has not changed during examination. But a valid hash does not prove that the underlying event was genuine. A perfectly preserved fake is still a fake.
What a professional examination should look for
A reliable assessment combines several forms of evidence rather than relying on one technical indicator.
Source and acquisition. The original artefact should be preserved whenever possible. Investigators should record the acquisition method, date and time, source account or device, and any known transformations before collection. A documented chain of custody is essential when material may later support a legal, disciplinary or regulatory decision.
Metadata and file structure. Metadata may provide useful clues about creation, encoding, editing software and timestamps. File structure, compression behaviour and related technical characteristics can also reveal inconsistencies. However, these indicators are supporting evidence, not proof on their own, because metadata can be removed or rewritten during normal processing.
Content-level examination. Forensic analysis can include frame-by-frame video review, audio waveform and spectral examination, and inspection for inconsistencies in lighting, reflections, facial movement, lip synchronisation or background elements. Such signs may help guide an investigation, but they are not a permanent checklist. Generative systems continue to improve.
Independent corroboration. This is often the strongest step. If a recording allegedly shows that a person was in a particular place at a particular time, investigators can compare it with CCTV, access-control records, device artefacts, communications, location information, eyewitness accounts or other independent records. The goal is to determine whether the wider evidence supports the event represented by the media.
A real-world lesson: the Pikesville case
The 2024 Pikesville High School incident in Maryland provides a practical example of why authenticity cannot be assumed from appearance alone. An audio recording circulated online that was presented as the principal making racist and antisemitic comments. On January 17, 2024, Baltimore County Public Schools said it could not yet confirm the recording’s veracity and opened an investigation.[3]
Several months later, the school district reported that investigators, with assistance from the FBI and other experts, had verified that the audio had been created using artificial intelligence.[4] Police subsequently arrested the school’s former athletic director in connection with the fabricated recording.[5]
The forensic lesson is larger than the incident itself. The recording had social consequences before its authenticity was established. In a fast-moving online environment, the first version of an event can travel much further than the later correction. Deepfake investigations therefore have to consider not only whether media is authentic, but also how quickly unverified material can influence decisions.
From deepfake detection to content provenance
Detection tools will remain useful, but they should be treated as part of an examination rather than an automatic verdict. NIST’s Guardians of Forensic Evidence work reflects the need to evaluate how analytic systems perform against changing forms of AI-generated media and how well they generalise beyond controlled conditions.[2]
Another important direction is content provenance. The Coalition for Content Provenance and Authenticity (C2PA) has developed a technical framework for recording verifiable information about how digital content was created and changed. Content Credentials can bind provenance information to an asset using cryptographic techniques, allowing later users to inspect a recorded content history when that information is available.[6]
Provenance does not mean that every claim associated with a file is automatically true. It adds context: who created it, what actions were taken and how the asset changed. In a deepfake environment, that context can be as important as the content itself.
Why this matters in India
The issue is especially relevant to India’s fast-growing digital environment. CERT-In’s 2024 advisory identifies misinformation, fraud and reputational damage among the risks associated with synthetic media.[1] In August 2026, the Government of India stated that the regulatory framework addresses AI-generated deepfakes and noted amendments to the IT Rules in February 2026 concerning harms arising from synthetically generated information, including requirements related to labelling and traceable metadata for permissible AI-generated content.[7]
For organisations, deepfake response should therefore not be treated only as a media or public-relations issue. It can become an incident-response and forensic issue. A suspicious executive voice note, a manipulated employee video or a fabricated screen recording may require preservation, technical examination and independent corroboration before any action is taken.
Conclusion
Deepfakes do not make digital evidence useless. Deepfakes make handling of evidence more dangerous. The professional response is not to believe everything or to doubt everything. The professional response is to build a process around evidence: preserve the original where possible document how evidence was acquired, calculate and record hashes, examine metadata and technical characteristics use detection tools while understanding their limitations compare media with independent evidence and examine provenance information where it is available.
Importantly investigators and decision-makers should separate three questions: Is the file intact? Is the content authentic? Does the content actually prove the event being alleged? Deepfakes can pass the test while failing the other two.
In the age of AI evidence will increasingly be judged not only by how convincing it looks but, by how well its origin, integrity, context and history can be demonstrated. That is the standard that can help preserve trust when seeing and hearing're no longer enough.
References
1. CERT-In, “Deepfakes - Threats and Countermeasures,” Advisory CIAD-2024-0060, 27 November 2024. View source
2. NIST, “Guardians of Forensic Evidence: Evaluating Analytic Systems Against AI-Generated Deepfakes,” 27 January 2025. View source
3. Baltimore County Public Schools, “January 17, 2024, Community Update: Message from Superintendent Dr. Myriam Rogers Regarding Pikesville High School.” View source
4. Baltimore County Public Schools, “April 24, 2024 Staff and Community Update: Message from Superintendent Dr. Myriam Rogers Regarding Pikesville High School Investigation.” View source
5. The Baltimore Banner / WYPR, “Ex-athletic director framed principal with AI-generated voice, police say,” 25 April 2024. View source
6. Coalition for Content Provenance and Authenticity (C2PA), “Content Credentials: C2PA Technical Specification,” Version 2.1. View source
7. Government of India, Ministry of Electronics & Information Technology, “Government Strengthens Regulatory Framework to Address AI-Generated Deepfakes,” 6 August 2026. View source
.jpg)
Introduction
The Indian Cabinet has approved a comprehensive national-level IndiaAI Mission with a budget outlay ofRs.10,371.92 crore. The mission aims to strengthen the Indian AI innovation ecosystem by democratizing computing access, improving data quality, developing indigenous AI capabilities, attracting top AI talent, enabling industry collaboration, providing startup risk capital, ensuring socially-impactful A projects, and bolstering ethical AI. The mission will be implemented by the'IndiaAI' Independent Business Division (IBD) under the Digital India Corporation (DIC) and consists of several components such as IndiaAI Compute Capacity, IndiaAI Innovation Centre (IAIC), IndiaAI Datasets Platform, India AI Application Development Initiative, IndiaAI Future Skills, IndiaAI Startup Financing, and Safe & Trusted AI over the next 5 years.
This financial outlay is intended to befulfilled through a public-private partnership model, to ensure a structured implementation of the IndiaAI Mission. The main objective is to create and nurture an ecosystem for India’s AI innovation. This mission is intended to act as a catalyst for shaping the future of AI for India and the world. AI has the potential to become an active enabler of the digital economy and the Indian government aims to harness its full potential to benefit its citizens and drive the growth of its economy.
Key Objectives of India's AI Mission
● With the advancements in data collection, processing and computational power, intelligent systems can be deployed in varied tasks and decision-making to enable better connectivity and enhance productivity.
● India’s AI Mission will concentrate on benefiting India and addressing societal needs in primary areas of healthcare, education, agriculture, smart cities and infrastructure, including smart mobility and transportation.
● This mission will work with extensive academia-industry interactions to ensure the development of core research capability at the national level. This initiative will involve international collaborations and efforts to advance technological frontiers by generating new knowledge and developing and implementing innovative applications.
The strategies developed for implementing the IndiaAI Mission are via Public-Private Partnerships, Skilling initiatives and AI Policy and Regulation. An example of the work towards the public-private partnership is the pre-bid meeting that the IT Ministry hosted on 29th August2024, which saw industrial participation from Nvidia, Intel, AMD, Qualcomm, Microsoft Azure, AWS, Google Cloud and Palo Alto Networks.
Components of IndiaAI Mission
The IndiaAI Compute Capacity: The IndiaAI Compute pillar will build a high-end scalable AI computing ecosystem to cater to India's rapidly expanding AI start-ups and research ecosystem. The ecosystem will comprise AI compute infrastructure of 10,000 or more GPUs, built through public-private partnerships. An AI marketplace will offer AI as a service and pre-trained models to AI innovators.
The IndiaAI Innovation Centre will undertake the development and deployment of indigenous Large Multimodal Models (LMMs) and domain-specific foundational models in critical sectors. The IndiaAI Datasets Platform will streamline access to quality on-personal datasets for AI innovation.
The IndiaAI Future Skills pillar will mitigate barriers to entry into AI programs and increase AI courses in undergraduate, master-level, and Ph.D. programs. Data and AI Labs will be set up in Tier 2 and Tier 3 cities across India to impart foundational-level courses.
The IndiaAI Startup Financing pillar will support and accelerate deep-tech AI startups, providing streamlined access to funding for futuristic AI projects.
The Safe & Trusted AI pillar will enable the implementation of responsible AI projects and the development of indigenous tools and frameworks, self-assessment check lists for innovators, and other guidelines and governance frameworks by recognising the need for adequate guardrails to advance the responsible development, deployment, and adoption of AI.
CyberPeace Considerations for the IndiaAI Mission
● Data privacy and security are paramount as emerging privacy instruments aim to ensure ethical AI use. Addressing bias and fairness in AI remains a significant challenge, especially with poor-quality or tampered datasets that can lead to flawed decision-making, posing risks to fairness, privacy, and security.
● Geopolitical tensions and export control regulations restrict access to cutting-edge AI technologies and critical hardware, delaying progress and impacting data security. In India, where multilingualism and regional diversity are key characteristics, the unavailability of large, clean, and labeled datasets in Indic languages hampers the development of fair and robust AI models suited to the local context.
● Infrastructure and accessibility pose additional hurdles in India’s AI development. The country faces challenges in building computing capacity, with delays in procuring essential hardware, such as GPUs like Nvidia’s A100 chip, hindering businesses, particularly smaller firms. AI development relies heavily on robust cloud computing infrastructure, which remains in its infancy in India. While initiatives like AIRAWAT signal progress, significant gaps persist in scaling AI infrastructure. Furthermore, the scarcity of skilled AI professionals is a pressing concern, alongside the high costs of implementing AI in industries like manufacturing. Finally, the growing computational demands of AI lead to increased energy consumption and environmental impact, raising concerns about balancing AI growth with sustainable practices.
Conclusion
We advocate for ethical and responsible AI development adoption to ensure ethical usage, safeguard privacy, and promote transparency. By setting clear guidelines and standards, the nation would be able to harness AI's potential while mitigating risks and fostering trust. The IndiaAI Mission will propel innovation, build domestic capacities, create highly-skilled employment opportunities, and demonstrate how transformative technology can be used for social good and enhance global competitiveness.
References
● https://pib.gov.in/PressReleasePage.aspx?PRID=2012375
Introduction
The much-awaited DPDP Rules have now finally been released in the official Gazette on 3rd January 2025 for consultation. The draft Digital Personal Data Protection Rules, 2025 (DPDP Rules) invites objections and suggestions from stakeholders that can be submitted on MyGov (https://mygov.in) by 18th February 2025.
DPDP Rules at Glance
- Processing of Children's Data: The draft rules say that ‘A Data Fiduciary shall adopt appropriate technical and organisational measures to ensure that verifiable consent of the parent is obtained before the processing of any personal data of a child’. It entails that children below 18 will need parents' consent to create social media accounts.
- The identity of the parents and their age can be verified through reliable details of identity and age available with the Data Fiduciary, voluntarily provided identity proof or virtual token mapped to the same. The data fiduciaries are also required to observe due diligence for checking that the individual identifying themselves as the parent is an adult who is identifiable, if required, in connection with compliance with any law for the time being in force in India. Additionally, the government will also extend exemptions from these specific provisions pertaining to processing of children's data to educational institutions, and child welfare organisations.
- Processing of Personal Data Outside India: The draft rules specify that the transfer of personal data outside India, whether it is processed within the country or outside in connection with offering goods or services to individuals in India, is permitted only if the Data Fiduciary complies with the conditions prescribed by the Central Government through general or specific orders.
- Intimation of Personal Data Breach: On becoming aware of a personal data breach, the Data Fiduciary must promptly notify the affected Data Principals in a clear and concise manner through their user account or registered communication method. This notification should include a description of the breach (nature, extent, timing, and location), potential consequences for the Data Principal, measures taken or planned to mitigate risks, recommended safety actions for the Data Principal, and contact information of a representative to address queries. Additionally, the Data Fiduciary must inform the Board without delay, providing details of the breach, its likely impact, and initial findings. Within 72 hours (or a longer period allowed by the Board upon request), the Data Fiduciary must submit updated information, including the facts and circumstances of the breach, mitigation measures, findings about the cause, steps to prevent recurrence, and a report on notifications given to affected Data Principals.
- Data Protection Board: The draft rules propose establishing the Data Protection Board, which will function as a digital office, enabling remote hearings, and will hold powers to investigate breaches, impose penalties, and perform related regulatory functions.
Journey of Digital Personal Data Protection Act, 2023
The foundation for the single statute legislation on Data Protection was laid down in 2017, in the famous ‘Puttaswami judgment,’ which is also well recognised as the Aadhar Card judgment. In this case, ‘privacy’ was recognised as intrinsic to the right to life and personal liberty, guaranteed by Article 21 of the Constitution of India, thus making ‘Right to Privacy’ a fundamental right. In the landmark Puttaswamy ruling, the apex court of India stressed the need for a comprehensive data protection law.
Eight years on and several draft bills later, the Union Cabinet approved the Digital Personal Data Protection Bill (DPDP) on 5th July 2023. The bill was tabled in the Lok Sabha on 3rd August 2023, and It was passed by Lok Sabha on 7th August, and the bill passed by Rajya Sabha on 9th August and got the president's assent on 11th August 2023; and India finally came up with the ‘Digital Personal Data Protection Act, 2023. This is a significant development that has the potential to bring about major improvements to online privacy and the handling of digital personal data by the platforms.
The Digital Personal Data Protection Act, 2023, is a newly-enacted legislation designed to protect individuals' digital personal data. It aims to ensure compliance by Data Fiduciaries and imposes specific obligations on both Data Principals and Data Fiduciaries. The Act promotes consent-based data collection practices and establishes the Data Protection Board to oversee compliance and address grievances. Additionally, it includes provisions for penalties of up to ₹250 crores in the event of a data breach. However, despite the DPDP Act being passed by parliament last year, the Act has not yet taken effect since its rules and regulations are still not finalised.
Conclusion
It is heartening to see that the Ministry of Electronics and Technology (MeitY) has finally released the draft of the much-awaited DPDP rules for consultation from stakeholders. Though noting certain positive aspects, there is still room for addressing certain gaps and multiple aspects under the draft rules that require attention. The public consultation, including the inputs from the tech platforms, is likely to see critical inputs on multiple aspects under the proposed rules. One such key area of interest will be the requirement of verifiable parental consent, which will likely include recommendations for a balanced approach which maintains children’s safety and mechanisms for the requirement of verifiable consent. The Provisions permitting government access to personal data on grounds of national security are also expected to face scrutiny. The proposed rules, after the consultation process, will be taken into consideration for finalisation after 18th February 2025. The move towards establishing a robust data protection law in India signals a significant step toward enhancing trust and accountability in the digital ecosystem. However, its success will hinge on effective implementation, clear compliance mechanisms, and the adaptability of stakeholders to this evolving regulatory landscape.
