BEYOND THE CLICKS: AN ANALYSIS OF DATA PROTECTION CHALLENGES IN INDIA’s INFLUENCER BOOM

Article

VOLUME 3 ISSUE 2

– Ishita Kaistha¹

ABSTRACT

In the era of digitalization, social media has significantly transformed the paradigm of information dissemination, leading to emergence of influencers (hereby referred to as “DATA FIDUCIARIES”)² across diverse professional and creative sectors. These social media influencers are operating over platforms including Facebook, Instagram, YouTube, Twitter (now popularly known as “X”) Snapchat, LinkedIn and TikTok (hereby referred to as “SOCIALMEDIA INTERMEDIARIES”) as a primary medium for content distribution, propagation and audience engagement, which eventually facilitates large scale of data transfer. However, as a consequence this phenomenon gives rise to ‘privacy paradox’ i.e., “the conflicting need for transparency in online engagement along with the need to safeguard the personal data³”. This paper aims to provide comprehensive analyses of data processing practices of social media intermediaries and evolving legal responsibilities of the influencers by specifically focusing on the various layers of legal framework including Digital Personal Data Protection Act,2023 (DPDP); Information Technology Act,2000 and IT (INTERMEDIARY GUIDELINES) Amendment Rules,2026; Consumer Protection Act,2019; Advertising Standard Council of India (ASCI) Guidelines.

KEYWORDS:

Privacy Paradox, Data Fiduciaries, Social Media Intermediaries, Privacy Rights, Data Protection, Digital Age, Digital Platforms, Data Security, Data Protection Laws, Data Breach, Information Technology Act, Consumer Protection Act,2019.

INTRODUCTION

Social Media evolution has been fueled by human impulse for communication and business networking. The term “social media” is defined by Merriam-Webster as electronic communication platforms (such as microblogging services and social networking sites) that enable users to create online communities for the exchange of ideas, information, private messages and alternative content including videos⁴. As of 2026, approximately around 5.66 billion of users populate major social giants including Facebook, Instagram, WhatsApp, YouTube, TikTok, Snapchat and LinkedIn. With exponential rise in social media usage, the influencer economy has emerged as a dominant force in digital communication and marketing, exerting significant influence in shaping consumer behaviour and decision-making processes⁵.

Consequently, this sector in India is anticipated to reach approximately INR3,375 crore by 2026, with a CAGR of 18% that might surge to INR 6,174 crore by 2030⁶. While this drastic expansion has redefined marketing dynamics and user engagement, it has also raised concern regarding misuse of information and data privacy, specifically related to ‘Online Clicking Consumer Pattern’ wherein the users click on links and share their data because of high level trust placed in influencers and high convenience offered by Digital Platforms. Link in the Bio is one of the powerful mechanism of data transfer and consumer engagement in social media marketing that diverts the consumer to the third- party or external platform and deploy cookies, use trackers, pixels to record consumer behaviour including IP addresses, time spent and click-through rates, also provide forms for collecting personal information and the other most important mechanism used by the influencers are Swipe-up features in their social media stories. However, some influencers experiment creatively with synthetic content using deepfake or other AI generated tools, while others leverage it deceptively to manipulate users and amplify virality in order to “chase” clicks, reach and response.⁷ The boom in social media industry and influencer economy raise apprehension about personal data security. As data transfers across various digital platforms, the risks of unauthorized access, data breaches, and misuse have intensified. Notable breaches have targeted millions of users, exposing the vulnerabilities in existing data storage and sharing practices often leaving users with limited control over their information⁸.

In recent years, the increasing instances of data breach and misuse of personal data have raised alarming concerns about the effectiveness of existing data protection frameworks. While the government organisations have begun implementing stronger regulatory measures such as DPDP Act of 2023, IT Act of 2000, and the IT (INTERMEDIARY GUIDELINES) Amendment Rules, 2026 significant gaps remain in ensuring data security, transparency, and consumer rights⁹. Hence, it has been argued that Indian’s influencer driven economy amplifies data collection practices while user awareness and regulatory enforcement remain insufficient. This paper seeks to bridge the transparency gap by analysing the intersection of consumer behaviour on online platforms, role and responsibilities of influencers as data fiduciaries and social media platforms and DPDP Act.

1. CLICK WITHOUT CONCERN AND THE EMERGENCE OF THE PRIVACY PARADOX

The Click vs. Concern Gap highlights the tension between the pursuit of online engagement of users and increasing concerns over data protection, explicit consent and regulatory compliance in India’s influencer boom digital economy. This dilemma represents the form of “Privacy Paradox” wherein the users express growing apprehension regarding data privacy yet their online behaviour of impulsive clicking on a link, swiping-up stories, rapid browsing and immediate acceptance of terms & conditions, indicates that data privacy is frequently treated as a secondary concern when weighed against social gratification¹⁰. Moreover, factors like high trust in the influencer, social pressure and hedonic consumption further reinforce this paradox, leading users to give priority to convenience and gratification that data protection. Therefore, opting for benefits over privacy is referred to as “privacy calculus”.

This dynamic between privacy paradox and privacy calculus is reflected in practical instances within the social media influencer ecosystem where users’ engagement frequently leads to data collection, misuse and privacy risks. Some of the notable categories of data exploitation within the influencer ecosystem are as follows: –

Exploitation by Virtual Influencer During Interaction: Interaction with Artificial Intelligence Driven personas such as Lil Miquela in the metaverse leads to security risks as the cybercriminals often infiltrate these digital interactions or deploy malware-laden links to safeguard personal sensitive data such as bank details from the followers¹¹.
Fraudulent Giveaways and Data Harvesting: Influencers organize “freebie” contests or campaigns that necessitate followers to submit their confidential information, such as their name, date of birth, email, phone number and address in order to claim the prize. However, data collected from users is for unethical purposes, such as selling to third parties or used for identity theft¹².
Link in the Bio Scams or Swipe up stories: Influencers while promoting a brand, product, giveaways or exclusive content, often directs followers to external links in their social media biographies (bios) that may redirect users to malicious websites or phishing links that collect personal data, install malware or trick users into making fraudulent payments¹³.
Deceptive Influencer Endorsements: Users are often encouraged to sign up on fraudulent websites or applications promoted by influencers claiming to unrealistic offer, exclusive discounts or early access to products. Such schemes exploit user trust to harvest personal data or financial information¹⁴.
.Impersonation¹⁵ based Phishing through Direct Messages: Followers develop a personal connection with influencers, which can make them susceptible to deception as the cyber criminals impersonate influencers and send phishing links via direct messages to extract login credentials (such as IP address, Social Media Profile) or financial data¹⁶.
Accepting all Cookies: Acceptance of cookies facilitates the collection of data such as browsing behaviour, IP address, location, preferences or device identifiers, this data is then transferred to the data fiduciaries or third-party entities often enabling behavioural tracking, targeted advertising and analytics. Notable, there is a visible shift in most websites today, as they are providing users with the option “to decline all cookies” or “manage and reject the non- essential cookies” instead of making it compulsory to “accept all cookies” in order to have an access to the content of the website. It is however, yet positive sign towards privacy compliance and not a risk factor.

The digital platforms are hence, structured in such an interactive manner that they reduce complex decision-making into effortless actions such as single-click, swipe or tap. Even though users might possess awareness about the online data exploitation, the compelling allure and assumed sincerity of the influencers content frequently override protective behaviour, leading individuals to act in accordance with influencer led directives¹⁷.Due to which, the users unknowingly unveil their data, rendering themselves vulnerable to misuse.

2. LEGAL FRAMEWORK REGULATING THE INFLUENCER-DRIVEN SOCIETY

In rapidly expanding influencer economy, the widening “click vs. concern gap” reflects a growing behaviour paradox between user engagement and privacy awareness. However, the SC in Justice

K.S. Puttaswamy (Retd.) v. UOI¹⁸ recognised Right to Privacy as a fundamental right under Article 21 of Indian Constitution, therefore, protection of personal data has emerged as an crucial aspect of right to privacy and has become a matter of serious concern in drastically evolving digital sphere. The WhatsApp new privacy policy case law, which permitted sharing of user data with its parent company, Facebook, was challenged in Karmanya Singh Sareen v. UOI¹⁹, where the “petitioners contented that the new policy infringed upon the fundamental right to privacy u/Art 21 of the Indian Constitution. The case gained infamy in context of broader discussion surrounding digital privacy and data protection. The question under discussion was whether Internet networking systems that let users send and receive text, audio, and video messages as well as data and make and receive audio and video conversations qualify as “telecommunication” services and are therefore governed by relevant regulatory bodies. However, the court noticed absence of appropriate statute for regulation of data protection and privacy in the digital platform”.

This has thus necessitated the development of cohesive and comprehensive regulatory legal framework to bridge the gap by ensuring that user consent is crucial and not merely a by-product of passive digital participation. The key legislations addressing this concern are discussed below:

Digital Personal Data Protection Act, 2023 (DPDP)

According to DPDP Act of 2023, Influencers fall within the ambit of Data Fiduciaries defined under section 2(i) of the Act as “Data Fiduciary as any person who determines the purpose and means of processing personal data“.²⁰ Being data fiduciaries, the influencers have certain responsibilities and obligations towards their followers in regards with collecting and processing of the personal data such as name, address, email-id, phone numbers, IP address, DOB and payment information. While collecting the data the consent taken shall be explicit consent i.e., free, specific, informed, unambiguous, unconditional from data principal with clear affirmative actions.²¹ However, it is required that the request to data principal for consent shall be accompanied by the notice²² ²³outlining the purpose for which the personal data is being processed and the manner in which those rights are to be exercised.

Section 8 of the act lays down that when the stated purpose of the data collected is fulfilled the data fiduciaries are obligated to delete or destroy the data or to direct the data processor to do so unless it is necessary to retain for any legal compliance²⁴. As per Section 8(3) the breach notification has to be reported to the Data Protection Board within seventy-two (72) hours and the affected data principal must be informed within forty-eight (48) hours. In addition, the data fiduciary must publish the business contact information of the Data Protection Officer (DPO) or any other individual responsible on behalf of data fiduciary in order to answers any question if raised by data principal regarding the processing of the personal data under Section 8(9) of the act.

The Act also lays down the requirements related to the handling of personal data of the children under Section 9 of DPDP, Act 2023 such as “the verifiable consent of the parents and reliable age authentication systems”.

Similar to the GDPR, the DPDP Act under Section 11 contains “Right to Access”²⁵ “that allow users to request data fiduciaries what information an organization has about them and how it uses that information”. The data principals are precisely permitted to obtain a summary of the data shared, a list of all other entities with whom the data has been shared, and an overview of the data they have provided, together with any additional information pertaining to personal data and it’s processing that may be required. Any failure to comply with the security standards prescribed in the regulation could be subject to punishment up to INR 250 crores, the highest penalty in the DPDP act.

Advertising Standard Council of India Principles of Influencer Advertising (2023)

In August 2023, “Guidelines for Influencer Advertising in Digital Media” (“ASCI Guidelines”) were published by “Advertising Standards Council of India (ASCI)”, self-regulatory organisation that exerts dominant influence in the advertising landscape. Notably, these guidelines for the first time formally defined the words like “influencer”, “virtual influencer” “material connection” and “digital media” within Indian Regulatory Framework²⁶. These guidelines make it mandatory for a clear, specific and prominent “disclosures” for any content posted by the social media influencers in context with the “material connection” with the advisers especially when the influencer mentions or voice over their thoughts about the products and services of the advertising agency irrespective of their impartial opinion or own personal estimation²⁷. However, if an influencer shares content without any such material connection and is voicing their opinion on that product or brand, then the post is not considered as an endorsement and does not require a disclosure. If a material connection exists but is not disclosed, it would be a violation of the guidelines.²⁸ The Disclosure labels must be showcased conspicuously ensuring they are readily noticeable on influencer’s post to the extent that viewers cannot reasonably outlook them and must be presented in the language of the advertisement. The regulations strictly forbid disclosure of labels to appear on “about me” or “in the bios” or “end-of- the-post” or “video” or to be buried in group of hashtags and links or anywhere that requires a special click or additional actions to access²⁹.

Words such as “ad”, “advertisement”, “collaboration”, “paid partnership”, “affiliate”, “employee”, “gift”, “sponsored” and “include paid-promotion” should be used as a “label” by the influencers in the sponsored content to enable their followers or users to distinguish between the personal opinions and the paid promotional content of the influencer. Moreover, the obligations provided in the advertisement code vary according to the platform’s interface and is adapted to specific format and type as per the content. These requirements particularly regarding duration of disclosure label are articulated within ASCI Guidelines as follows:

“If the advertisement is only a picture or video post without accompanying text (such as Instagram stories or Snapchat), the discloser label needs to be superimposed over the picture and video and it should be ensured that the average consumer is able to see it clearly.³⁰;
1. The disclosure label must be displayed for minimum three (3) seconds duration in videos that are of fifteen seconds or less;For videos exceeding fifteen (15) seconds but less than two minutes, the disclosure label must remain visible for at least one-third (1/3) of the total duration of the video;
1. In videos of two (2) minutes or longer, the disclosure label must be displayed for the entire duration during which the advertised brand, its attributes, advantage or related aspects are presented.
The disclosure label must to be announced before and after each live stream. The text or caption must provide adequate information if the post remains viewable after the live broadcast ends;
Audio media must include a prominent announcement of the disclosure at the beginning and conclusion of each playback, as well as before and after any intermissions.”

To make sure the influencers follow the ASCI rules for self-regulation on digital media, influencers and advertising agencies must work together to make sure that labels put along the postings are appropriately reported.³¹ In Indian Medical Association vs. Union of India³², Supreme Court in concern with the misleading advertisement held that, “before the advertisement is printed or broadcasted, the adviser or advising agency shall submit a self-declaration on lines mentioned in Rule 7 of the Cable Television Networks Rule, 1994. The endorsers must also have sufficient expertise with the promoted food product and make sure that the same is not deceptive. The court further held that celebrities and social media influencers are accountable to the same extent for issuing false or misleading advertisement like they have advertised any product or service. Endorsements that are made having as public personalities, celebrities, influencers, etc., has a huge impact on public at large therefore, it is essential that they exercise due responsibility while endorsing any product and be held liable for such endorsement”.

Central Consumer Protection Authority (‘CCPA’) and Consumer Protection Act, 2019

To safeguard “consumers from unfair trade practices” and “misleading advertisement”, the Endorsement Know-Hows! rules were created by the “Ministry of Consumer Affairs, Food, and Public Distribution”. The roles and duties of various parties, including “manufacturers”, “service providers”, “advertisers”, “advertising agencies”, “celebrities”, and “endorsers”, are defined in these rules.³³ The law expressly forbids any kind of deceptive advertising in any form, format or medium. The Act has introduced a transformative shift from “traditional doctrine of caveat emptor” to a “system in which sellers and endorsers including any public figure, celebrities or social media influencers shall be held accountable for any misleading endorsement, because of the power of persuasion these personalities have on the process of decision making of their followers at large”. It is pertinent to mention herein that the “Endorsement Know-How!” rules are released in accordance with the guidelines for “Prevention of Misleading Advertisements and Endorsements for Misleading Advertisements, 2022” issued under the Consumer Protection Act,2019. The Endorsement Guidelines strictly prohibits the endorsers not to mislead or deceive the public in any way while advertising a product or service and they must follow the rules set forth by the Consumer Protection Act of 2019 and the other various regulations made in this regard.

Some important provisions of the abovementioned act regulating the endorsers or influencers are discussed herein below:

i Section 2(28) defines Misleading advertisements³⁴ as any promotional material misleading the audience by deceptively describing a product or service, gives false guarantee, conveys an express or implied representation that is false and misleading and intentionally conceal important fact or information. This clause has literally shifted the sphere of responsibility from “buyers or consumers beware” to “sellers or endorsers beware” before selling or endorsing any product or service. Case Law: One of the famous cases, Kwality Walls Ice Cream (HUL) Case (2022): Artificial Flavour Misrepresentation³⁵, where “Kwality Walls ice creams were advertised and aired by HUL as being created from genuine milk. Concerns were raised in CCPA that the product included soy oil rather than milk. According to the Consumer Protection Act of 2019, Section 2(28), the advertising was deemed deceptive. CCPA issued a show-cause notice and ordered HUL to withdraw the advertisement. Hence, HUL updated the advertisement to include precise details”.

ii Section 2(47) defines Unfair Trade Practices as any fraudulent, misleading or unethical method used to promote the sale, use or supply of any goods or service, which directly applies to deceptive representation through advertisement or endorsement by the influencers or celebrities.³⁶ Case Law: In Patanjali Coronil Case, “Coronil”, an Ayurvedic product, was introduced in 2020 with the promise of curing COVID-19. It was widely promoted in national media and was subsequently scrutinized by multiple state and central agencies. Therefore, disclaimers were imposed by the Ministry of AYUSH and recommendations were issued by CCPA”³⁷.

iii Section 21 empowers CCPA³⁸ to investigate and issue directions against misleading advertisements. The authority may order modification or discontinuation of the misleading advertisement.

iv Section 21(3) & (5) applies totally to the Endorsers, as it prohibits the endorsers of false and misleading advertisements from endorsing any product or service for a up to one year which may extent up to three years in the event of subsequent offences the endorser commits under Section 21(3). Further, Section 21(5) the endorser is exempt from penalties under sub-clauses (2) & (3) if the endorser has exercised due diligence in verifying the claims in the advertisement.³⁹

v Section 89 mandates Punishment for False & Misleading Advertisement, this provision lays down punishment for the manufacturer & service provider for creating or promoting false and misleading advertisement. Violator of regulation shall be punished with up to two years of imprisonment and a fine of ten lakh rupees. For every subsequent offence the punishment may extent to five years of imprisonment and a fine may extent to fifty lakh rupees⁴⁰.

Stock Exchange Board of India (SEBI) Guidelines for Financial Influencers (“Fin-influencers”)

SEBI has taken strict actions to restrict the currently surging powers of the unregistered “fin- influencers” and prohibiting the proliferation of unapproved investment advice⁴¹. SEBI has curbed registered intermediaries such as stock brokers, mutual funds, and investment advisers are no longer allowed to do business with unregistered organizations that offer investment advice or that make unapproved claims about the return or performance of securities, according to a circular dated August 26, 2024.

In the following year i.e., in January 2025, SEBI established a new guideline u/s 16A of SEBI (Intermediaries)(Amendment) Regulation,2024 in which it banned finfluencers from using the real- time stock data, promise to return and required a minimum of three months’ time lag before any educational reference to securities. Furthermore, outside of SEBI-licensed entities, it is illegal to make predictions about the future performance of shares or to provide investing advice via voice, video, or screen sharing. Consequently, any individual or entities providing regarding investments advice in securities or issuing research reports for consideration is required to be registered as an Investment Adviser or Research Analyst, comply with prescribed qualification criteria and adhere to stringent disclosure and regulation requirements. The famous “The She Wolf Stock Market Case” illustrates how influencer-driven financial promotions led to market manipulation⁴².

Copyright Act,1957

The act provides comprehensive framework applicable to influencers and digital creators, primarily through protection of original work, including digital content like videos, reels, photographs, blogs, podcasts and other audio-visual work under Section 13. The act provides exclusive rights for reproduction, distribution, and communication to the public under Section 14. As per Section 17, the original creator of the copyright will be the first owner except in case of employment or commission, where influencer- brand partnership complicate the assessment of liability. Meanwhile, unless there are some limited fairs dealing restrictions as under the provisions of Section 52, any unauthorized use of third-party material will be considered infringement under Section 51. Further, Section 57 safeguard the moral rights of the creators including “the right of attribution” and “the right to integrity” which gives the author identity as the original author of the work and to be able to claim damages or prevent wrongful harm to their reputation caused by distortion or misuse of their work. This is especially crucial in the digital realm, where creators’ identities are often misrepresented or stolen.

3. LAWS GOVERNING THE SOCIAL MEDIA PLATFORMS (INTERMEDIARIES)

The IT Act,2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules,2021 do not explicitly regulate influencers but indirectly govern their conduct in the digital era.

Information Technology Act,2000

The IT Act, 2000 regulates social media platforms (“intermediaries”) and grants them “Safe Harbour” protection under the provisions of Section 79 of the Act. This provision shields social media intermediaries from liability for third-part content if they act as a facilitator and follow the due diligence guidelines. The provisions governing the influencers are discussed as follows⁴³: Section 43A(Compensation for failure to protect data); Section 66(Computer Related Offenses) violation of the provision may lead up to three years of imprisonment or fine up to 5 lakhs or both; Section 66C (Identity theft) the violator face up to 3 years of imprisonment or fine up to 1 lakh ; Section 66D(Cheating by Personation using computer resources) such as fake profiles, phishing, fraudulent emails etc. leading up to three years imprisonment or fine up to 1 lakh; Section 67(Publishing or Transmitting obscene material in electronic form) violating the same shall lead to up to 3 years imprisonment or 5 lakhs of fine for first offense and escalating for subsequent offences; Section 67A (Criminalizes publishing, transmitting, or sharing sexually explicit material in electronic form) first time offender shall be liable for five years of imprisonment and 10 lakhs of fine increasing up to 7 years of subsequent conviction and Section 72 (Breach of confidentiality and privacy) offense is punishable with the imprisonment for up to two years or fine extending to 1lakh or both.

The IT (Intermediary Guidelines) Rules,2021 (as amended)

The MeitY notified the IT (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rule,2026 to amend the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules,2021. The Amendment Rules came in force on 20 February,2026⁴⁴. These rules are⁴⁵:

Under revised rule 2(1)(wa) of the IT Rules, 2021 grants legal recognition to synthetically generated information (“SGI”) in order to prohibit deepfakes and AI-produced audio, video, or audio-visual content on online intermediaries;
Content should be conspicuously identified as “AI” label and integrated with relevant meta data or unique identifiers to ensure traceability of its origin as per the new rules. Moreover, at the same time, intermediaries are legally prohibited from removing, altering or suppressing such AI labels or information;
Within three hours of receiving the court order or notice, the intermediaries are required to delete or prevent access to the identified illegal information according to the modified Rule 3(1)(d) of the IT Rules, 2021. Earlier the timeline for removal process was 36 hours;
Under the revised Rule 3(2)(a)(i) of the IT Rules, 2021 intermediaries are required to address user’s complaints within seven days from the date of receipt of receiving the complaint. Previously, this timeline was 15 days that has now been shortened to ensure faster grievance resolution.
According to the modified rule 3(3)(a)(i) of the IT Rules, 2021 intermediaries are required to notify users at least once a year that using their services for prohibited content may result in immediate termination of access. Content such as forged documents, misleading impersonation, non-consensual intimate imagery (NCII), and child sexual abuse material (CSAM) that leads to termination;
The newly introduced rule 4(1A) mandates that the significant social media intermediaries (SSMI) to require users to declare at the time of uploading whether the content is SGI.

It is pertinent to mention herein that the failure to comply with these rules may lead the platforms to lose their ‘safe harbour’⁴⁶ protection.

CONCLUSION: BRIDGING THE GAP BETWEEN CLICK & CONCERN

Amid the digital boom, the rise of the influencers market has intensified concerns around protecting personal data and privacy right. The landmark K.S Puttaswamy vs. Union of India⁴⁷ judgment marked a significant turning point by recognizing the right to privacy as fundamental under Article 21 of the Indian Constitution, thereby laying the foundation for protection of personal data regime in India.

The first milestone in evolution of data protection lies in recognizing individual as an important party with respect to their personal data, thereby imposing obligations on entities handling such data. The enactment of DPDP, Act draws inspiration from the global privacy framework such as the GDPR, indeed marks progressive step in India’s data protection regime, however, it adopts a comparatively flexible approach data due to which it has several loopholes and differences that create unique challenges in the influencer marketing era primarily due to its narrower scope, reliance on “government exemptions”, lack of “legitimate interest” as a processing ground, vague “deemed” consent, “limited scope” as it applies primarily on the data collected online while data collected offline falls out of its ambits, ambiguous “right to forgotten”, “overly broad exemptions” and “lowers penalty”. GDPR, on the other hand, implements a far stricter and more organized framework that places strict requirements on data controllers and processors. These requirements are supported by an enforceable mechanism, decentralized supervisory bodies, and severe fines. Despite their differences, both frameworks have important things in common, such as “consent, extraterritoriality, fiduciary accountability, and right to informational self-determination.” Nonetheless, the DPDP Act still faces difficulties with enforcement independence, sensitive data protection in a wider context, and implementation effectiveness. While the IT Act,2000 does not expressly recognise the concept of “end-to-end encryption” (E2EE) it nonetheless, provides a legal framework for the regulation. Section 69 of the act gives government the authority to intercept or decrypt information, on the other hand Section 84A permits the central government to mandate encryption standards. Further, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, require platforms to identify the “first originator” of information, a requirement that fundamentally undermines the integrity of true end-to-end encryption. Therefore, the end-to-end encryption in India exists at the intersection of privacy protection and law enforcement interests, leading to recurring tensions between the user confidentiality and regulatory demands.

In the latest amendment, the Consumer Protection Act redefined the role of social media influencer as “legal endorser”. This classification serves as the foundation for new liabilities, transforming influencers from passive content creator to active participants within the advisory ecosystem. The CCPA Guidelines,2022 and ASCI Guidelines,2023 has provided prominent regulations that lays down two important pillars ‘transparency through mandatory disclosure’ and ‘accountability through due diligence’. This has made it compulsory for the influencers to verify the content before posting, also under the concept of shared accountability, both the brand and the influencer shall be held accountable. Ultimately, this law servers one critical purpose that is to “Protect the Users” from deceptive content.

Hence, it would be incorrect to contend that the Indian Legal System lacks strict measures to protect the users within the influencer-driven ecosystem; however, persisting regulatory gaps render such protection incomplete. It is therefore, important to strengthen legislative frameworks, enhance transparency and explicit consent and ensure balance between privacy rights and national security interests. Simultaneously, addressing antitrust concerns and fostering international regulatory cooperation remain essential to building a robust data protection regime. Effective enforcement of these measures will enable India not only protect to safeguard its citizens’ privacy on online platforms but also promote innovation and sustainable growth in the digital economy. The future of privacy protection depends on our collective efforts to developing a secure, equitable, and transparent digital ecosystem.

FOOTNOTES

Author is a practicing Advocate in various District Courts and High Court of Delhi ↩︎
Legal Responsibilities of Social Media Influencers in India by LEXCLAIM” Retrieved from: https://lexclaim.com/blog/2026/01/20/legal-responsibilities-of-social-media-influencers-in- india/#:~:text=Influencers%2C%20being%20data%20fiduciaries%2C%20have,in%20cases%20of%20legal%20retentio n accessed on 12^th April 2026. ↩︎
The privacy paradox – Investigating discrepancies between expressed privacy concerns and actual online behaviour – A systematic literature review” Retrieved from https://www.sciencedirect.com/science/article/pii/S0736585317302022 last accessed on 12^th April 2026. ↩︎
Definition of social media by Merriam Webster”. Retrieved from :https://www.merriam- webster.com/dictionary/social%20media last accessed on 13^th April 2026. ↩︎
Supra Note 2. Last accessed on 13^th April 2026. ↩︎
“India must regulate influencers to protect Consumers & Economy”, retrieved from: https://www.outlookbusiness.com/columns/unchecked-influence-deepfakes-consumer-risk-india last accessed on 13^th April 2026. ↩︎
Ibid. ↩︎
Swadha Dubey and Dr. Razit Sharma, The Privacy Paradox: The Future of Personal Data Protection in the Big Data Age, International Journal of Law Management & Humanities, Vol.7 Issue 6; Page 1647, 2024, retrieved from https://ijlmh.com/wp-content/uploads/The-Privacy-Paradox-The-Future-of-Personal-Data-Protection-in-the-Big-Data- Age.pdf last accessed 13^th April 2026. ↩︎
Ibid ↩︎
“Privacy in social media: The Paradox doesn’t exist.” Retrieved from https://thedailyeconomy.org/article/privacy-in- social-media-the-paradox-doesnt- exist/#:~:text=Some%20reasons%20for%20this%20include:%20*%20**Privacy,their%20friends%20or%20coworkers
%20are%20using%20them last accessed on 14^th April 2026. ↩︎
Virtual Influencers and Data Privacy: Introducing Multi Privacy Paradox. Retrieved from https://www.sciencedirect.com/science/article/pii/S0148296324000882 last accessed on 14^th April 2026. ↩︎
“Social Media Giveaways & Sweepstake: how scammers trick you into handling over data”. Retrieved from https://www.totaldefense.com/security-blog/social-media-giveaways-sweepstakes-how-scammers-trick-you-into- handing-over- data/?srsltid=AfmBOopQTPWzTDFQB75TYcVvuz6OFbyFctFUZwXsywxVgWPHUAktPyqc#:~:text=08.21.25- ,Social%20media%20giveaways%20&%20sweepstakes:%20how%20scammers%20trick%20you%20into%20handing, giveaways%20seem%20official%20and%20trustworthy last accessed on 15^th April 2026 at 11:00am, Delhi. ↩︎
“Link in the Bio Dangers: Spotting Scam” Retrieved from: https://www.urlert.com/blog/link-in-bio-scams-guide last accessed on 15^th April 2026. ↩︎
“How to deal with fake collab messages on Instagram: Essential tips”. Retrieved from: https://www.remove.tech/creator-blog/how-to-deal-with-fake-collab-messages-on-instagram-essential- tips#:~:text=A%20brand%20collaboration%20scam%20occurs,than%20provide%20a%20legitimate%20partnership.
Last accessed on 15^th April 2026. ↩︎
Impersonation defined under Section 416 Indian Penal Code & Section 319 Bhartiya Nyaya Sanhita: “pretending to be someone else, substituting one person for another, or representing that someone is a person other than who they are, with intent to cheat.” ↩︎
“Influencers and cyberattacks on social media. How to protect yourself?” Retrieved from https://www.esedsl.com/en/blog/influencers-and-cyberattacks-on-social- media#:~:text=When%20an%20influencer%20or%20company,volume%20of%20data%20they%20generate.Last accessed on 15^th April 2026. ↩︎
Supra Note 12. ↩︎
Justice K.S. Puttaswamy(Retd) v. UOI (2017) 10 SCC 1. ↩︎
Karmanya Singh Sareen vs. Union of India (SLP(C) No. 804/2017) ↩︎
Section 2(i) of the Digital Personal Data Protection Act,2023. Retrieved from https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf last accessed 15^th April 2026. ↩︎
Section 6 of the Digital Personal Data Protection Act,2023 Link https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf last accessed 15^th April 2026. ↩︎
Section 5 of the Digital Personal Data Protection Act,2023. Retrieved from https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf last accessed 15^th April 2026. ↩︎
The Notice shall be in the languages as specified in the Schedule 8^th of the Constitution of India, Link https://www.mha.gov.in/sites/default/files/EighthSchedule_19052017.pdf last accessed 15^th April 2026. ↩︎
Section 8 of DPDP Act,2023. Retrieved from https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf last accessed on 15^th April 2026. ↩︎
“Section 11 of the Digital Personal Data Protection Act,2023.” Retrieved from https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf last accessed 15^th April 2026. ↩︎
“ASCI issues final Guidelines for Influencer Advertising on Digital media, launches ASCI, Social platform;” Retrieved from https://www.ascionline.in/wp-content/uploads/2022/09/press-release-influencer-guidelines-2021.pdflast accessed on 15^th April 2026. ↩︎
Ibid ↩︎
“Influencer Advertising on Digital Media: An Indian Political Economy of Communications Perspective”. Retrieved from: https://www.epw.in/engage/article/influencer-advertising-digital-media-indian last accessed on 15^th April 2026. ↩︎
Supra Note 26 ↩︎
Ibid ↩︎
“Legal Responsibilities of Social Media Influencers in India.” Retrieved from https://lexclaim.com/blog/2026/01/20/legal-responsibilities-of-social-media-influencers-in- india/#:~:text=Influencers%2C%20being%20data%20fiduciaries%2C%20have,in%20cases%20of%20legal%20retentio n last accessed on 16^th April 2026. ↩︎
IMA v. UOI (Writ Petition (Civil) No. 645/2022) ↩︎
“Endorsement guidelines for Celebs and Social Media Influencers, Ministry of Consumer Affairs, Food and Public Distribution, Posted on 20^th January 2023 by Press Information Bureau (PIB).” Retrieved from https://www.pib.gov.in/PressReleasePage.aspx?PRID=1892527&reg=3&lang=2#:~:text=used%20or%20experienced.-
,The%20guide%20is%20released%20in%20alignment%20with%20the%20guidelines%20set,(Release%20ID:%201892 527) last accessed on 16^th April 2026. ↩︎
“Misleading Advertisement, Section 2(28) of the Consumer Protection Act,2019.” Retrieved from https://ncdrc.nic.in/bare_acts/CPA2019.pdf last accessed on 17^th April 2026. ↩︎
Bhavitha Raj. G and Jyotirmoy Banerjee; “Misleading Advertisements and the Role of the Central Consumer Protection Authority (CCPA); International Journal of Human Rights Law Review; Volume 4 issue 3, 2025.” Retrieved from https://humanrightlawreview.in/wp-content/uploads/2026/02/Misleading-Advertisements-and-the-Role-of-the-Central- Consumer-Protection-Authority.pdf last accessed on 17^th April 2026. ↩︎
“Unfair Trade Practices, Section 2(47) of the Consumer Protection Act,2019.” Retrieved from https://ncdrc.nic.in/bare_acts/CPA2019.pdf last accessed on 17^th April 2026. ↩︎
Supra Note 36 ↩︎
“Power of CCPA, Section 21 of the Consumer Protection Act,2019.” Retrieved from https://ncdrc.nic.in/bare_acts/CPA2019.pdf last accessed on 17^th April 2026. ↩︎
“Liability of Endorsers, Section 21(3) & (5) of the Consumer Protection Act,2019.” Retrieved from https://ncdrc.nic.in/bare_acts/CPA2019.pdf last accessed on 17^th April 2026. ↩︎
“Punishment for False & Misleading Advertisement: Section 89 of the Consumer Protection Act,2019.” Retrieved from https://ncdrc.nic.in/bare_acts/CPA2019.pdf last accessed on 17^th April 2026. ↩︎
“Bans regulated entities from associating fin-influencers.” Retrieved from https://www.angelone.in/news/market- updates/sebi-bans-regulated-entities-from-associating-with-unregistered-finfluencers last accessed on 17^th April 2026. ↩︎
Refer to the famous “She wolf of the stock market case”. Link https://www.ndtvprofit.com/markets/sebi-cracks-down- on-asmita-patel-global-school-of-trading-illegal-investment-advisoryshe-wolf-stock-market-10804919 last accessed on 17^th April 2026. ↩︎
Information Technology Act,2000. Retrieved from https://www.meity.gov.in/static/uploads/2024/03/IT-Act- Rules_2000_0.pdf . Last accessed on 18^th April 2026. ↩︎
Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Amendment Rules, 2026 https://www.meity.gov.in/static/uploads/2025/10/065b6deb585441b5ccdf8be42502a49c.pdf#:~:text=120(E)%2C%20da ted%2010th%20February%2C%202026.%20As%20per,come%20into%20force%20on%2020th%20February%2C%20 2026 last accessed on 19^th April 2026. ↩︎
Ibid ↩︎
Section 79 of IT Act,2000. Retrieved from https://www.meity.gov.in/static/uploads/2024/03/IT-Act- Rules_2000_0.pdf last accessed on 19^th April 2026. ↩︎
J. K.S. Puttaswamy (Retd.) v. UOI (2017) 10 SCC 1. ↩︎