CONSENT IN DIGITAL PAYMENT TRANSACTIONS: A LEGAL ANALYSIS OF USER AUTONOMY IN INDIA’S UPI FRAMEWORK

ABSTRACT

Digital Payments in India have witnessed substantial development, particularly through the real-time, speedy digital payment system like UPI. This development has reformed the way individuals undertake financial transactions. At the same time, it addresses legal concerns about the validity of consent, user understanding, and privacy.

This paper explores whether digital consent genuinely meets the criteria of unrestricted and knowledgeable consent. The role of RBI as the Apex bank of India is also examined, especially in connection with accountability and transparency. The influence of click-to-accept and standard contracts on user consent is detailed, showing how digital designs can cooperate with user autonomy. It also raises privacy concerns about data usage. Further, a total of 138 responses were collected and analysed for this study, representing empirical research.

The paper concludes that, even though legal frameworks presume informed consent, the reality often compels it because user may give their consent without a complete understanding, suggesting a need for a better consent process and protocols to improve user understanding and meaningful engagement in digital transactions.

KEYWORDS:

Digital Consent, User Autonomy, UPI Framework, Contractual Validity, Data Privacy, Clickwrap Agreements, RBI Regulation, Consumer Protection

1. INTRODUCTION:

In India, the foundation for the rapid growth of digitisation of financial transactions is the extensive use of the Unified Payment Interface (UPI), helping people manage their finances and encouraging a system where funds are transferred digitally due to rapid, easy access, avoiding physical cash, promoting clarity, and reducing money forgery. Yet, shifting towards Digital Payment Systems raises several legal issues, especially regarding their nature and the validity of consent in these transactions.

“A person’s agreement is legally binding when it is made voluntarily, without coercion, undue influence, fraud, misrepresentation, or mistake, and when they clearly understand the conditions they are agreeing to, as in the Indian Contract Act of 1872”.¹ “Digital platforms obtain user consent through Click wrap agreements, where users indicate acceptance by clicking an “I agree” button”.² Further, Empirical Research is conducted to examine the extent to which the user consent can be said to be legally valid when terms and conditions are accepted without proper reading and interpretation.

When the problem is addressed from the viewpoint of user autonomy, meaning to make an independent and well-informed decision, it will require a deeper understanding. Although “Digital payments are regulated by authorities like the Reserve Bank of India”.³ The ability to make a decision may be restricted for a user because of fast payments, technical and use of complicated language in the agreement and design of apps that would make the user act quickly. “There are privacy concerns because the apps collect and use a lot of personal information. This is to be looked into because the right to privacy has been highlighted as a fundamental right”.⁴ The paper seeks to examine whether consent in digital payment transactions within the UPI framework meets the legal requirements of validity, and studies how challenging it can be for users to make an informed decision. The paper examines whether the present laws and regulations are strong enough to protect users’ rights and interests.

2. LEGAL FRAMEWORKS:

2.2 CONSENT UNDER CONTRACT LAW:

The concept of Consent is an indispensable part of the Indian Contract Act of 1872. Section 13 defines consent as a situation where two or more persons agree on same thing in the same sense (consensus ad idem).⁵

For a contract to be legally enforceable, the consent of the parties must be ‘free’. In Section 14, consent is said to be free when it is not affected by coercion, undue influence, fraud, misrepresentation or mistake.⁶

Consent is not valid under these situations:

• Section 15-Coercion: Consent acquired through force, threats, or wrongful property detention is not valid, as seen in Chikkam Ammiraju v. Chikkam Seshamma, where the plaintiff was compelled to transfer property under threat of harm, rendering the consent invalid.⁷
• Section 16-Undue Influence: One party dominate another’s will; they may do so in an unfair manner as illustrated in Ranganayakamma v. Alwar Setti, where a creditor exploited the debtor’s dependency to secure an unfair contract.⁸
• Section 17-Fraud: Intentional cheating to convince another party to sign a contract as established in Derry v. Peek, where the company misrepresented its rights to issue shares, misleading investors.⁹
• Section 18-Misrepresentation: Making false claims to persuade someone to sign a contract without intending to mislead.¹⁰
• Section 20-22: Parties believe anything that is crucial to the agreement is false.¹¹

Therefore, Free consent is mandatory for a valid contract. Any contract lacking free consent is void or voidable under the law.¹²

2.2 Regulation of Digital Payments:

The Reserve Bank of India regulates Digital Payment System in India, ensuring smooth functioning of the financial system.¹³

Objective of RBI:

• Security and safety of transactions
• Consumer Protection Mechanism
• Regulating payment system operators
• Promote efficiency and accessibility.¹⁴

Unified Payment Interface (UPI) is a noteworthy innovation by the National Payments Corporation of India under RBI administration, facilitating quick money transfers and a PIN-based system to enable user authentication, mirroring the purpose of consent in digital authorisation.¹⁵

Furthermore, RBI issues guidelines:

• Two-factor authentication
• Transaction alerts
• Grievance redressal mechanisms

Ensuring Digital Payments are safe, transparent and user-centric.¹⁶

2.3 Right to Privacy:

Consent in digital payments is closely linked with the right to privacy, as the Supreme Court recognised privacy as a fundamental right under Article 21, in the landmark judgement of Justice K.S. Puttaswamy (Retd.) v. Union of India.¹⁷

The Court Highlighted that:

• Individuals have control over their personal data
• Consent must be informed and meaningful
• Data Collection must satisfy legality, necessity and proportionality¹⁸

Relevance to Digital Payments: Users share sensitive financial data, consent is required for data storage and processing, and unauthorised data may violate privacy rights. In this judgement, consent is not just contractual but also a constitutional safeguard in digital economy.

2.4 Digital Personal Data Protection:

The Digital Personal Data Protection Act, 2023, governs handling of personal data in digital payments, directing lawful collection and informed consent, it requires that consent be free, specific and informed and confirms that they are made aware of the nature and purpose of data collection and usage.¹⁹

2.5 Consumer Protection:

In digital payment services, there are situations involving lack of transparency, unclear terms and misleading interfaces affecting consumer choices. The Consumer Protection Act, 2019, protects against unfair trade practices and misleading representations.²⁰

3. Issues in Digital Consent:

Practical and structural limitations often challenge digital consent in online transactions. One major issue is use of ‘click-wrap agreements’, where users accept terms and conditions by simply clicking “I agree” without actively reading them, leading to a lack of informed understanding, as legal language is often complex and lengthy.²¹

Further, in real-time payment systems, users get very little time to review or reconsider their consent due to speedy digital transactions.²² Also, apps and interface design play an important role; many platforms are designed to get users to accept quickly through pre-ticked boxes or unclear options, referred to as “Dark patterns”, that manipulate user behaviour and weaken genuine consent.²³ Collectively, these factors call into question whether digital consent in online transactions genuinely satisfies the legal standards of free and informed consent.

4. Research Methodology:

The empirical analysis is built on responses collected from 138 participants through a structured questionnaire via Google Form. The findings reveal major patterns in user behaviour, awareness and consent practices in UPI-based digital payment systems.

Figure 1: Demographic Overview

Majority of the population belong to the age group 30+(62.3%), followed by individuals aged 22-30(20.3%) and then 18-21(17.4%).

In terms of occupation, most respondents are working professionals (68.1%), followed by students (15.9%) and a small portion categorized as others (15.9%).

Figure 2: Use of UPI

Almost all (97.1%) respondents use UPI for transactions.

Majority portion of the respondents use UPI on a daily basis (68.1%), followed by occasional (20.3%) and weekly usage (11.6%), reflecting widespread dependence on digital payment systems in everyday

Figure 3: Commitment to Terms & Conditions

The majority of respondents stated that they sometimes read terms and conditions (34.1%), while fewer reported always reading them (31.2%). A small portion indicated that they never/ rarely (8.7%, 26.1%) engage with such terms.

In terms of understanding, most participants reported they only partially understand (60.1%) the terms and conditions they accept, while a smaller group claimed full understanding (26.8%), and some indicated no understanding at all (13%).

Figure 4: Reasons for not reading terms

The primary reason for not reading terms and conditions is that they are too lengthy (55.1%), followed by their complexity (15.9%) and lack of time (21%). A smaller number of respondents considered them unimportant (8%), highlighting structural barriers to informed consent.

figure 5: User autonomy and time pressure

A majority of respondents that they are only sometimes (50.7%) given sufficient time to review terms before completing transactions, while fewer answered definitely yes (29.7%) or no (19.6%).

Significant majority reported that they have felt pressured to complete transactions completely (52.9%), suggesting that time constraints may limit meaningful engagement with contractual terms.

Figure 6: Privacy Awareness

Most respondents reported partial understanding (39.1%) of how their personal data is used, while fewer respondents indicate complete awareness (33.3%) or no awareness at all (27.5%), suggesting limited transparency and user comprehension in data practices.

Figure 7: Perception of terms and Consent

Majority of respondents believe that terms and conditions should be simplified (89.1%), indicating a clear demand for more accessible and user-friendly legal information.

Further, most respondents admitted that they have accepted terms without fully understanding them (66.7%), reinforcing concerns regarding the absence of genuine informed consent in digital payment systems.

5. Findings and Analysis:

In the survey, many respondents highlighted the need for simplified, concise language, with key points presented as bullet points or summaries, because they find it difficult to understand terms and conditions due to lengthy legal language and complex clauses.

Visual assistance:

• Icons
• Graphics
• Short videos

were suggested to improve understanding, along with interactive guides or step-by-step prompts. Multilingual support was highlighted as important for satisfying diverse users, including older and less-literate individuals.

Suggestion to enhance trust and safety:

• Limiting the amount of information shown at one time
• Keeping instructions brief
• Using plain, direct wording to ensure quick understanding
• Stricter cybersecurity measures
• Daily transaction limits for susceptible users R
• Regular reminders about risks.

Overall, Digital payment platforms can significantly improve user understanding and engagement by making terms shorter, simpler, visual and interactive while respecting user time and ensuring secure transactions.

6. Discussion:

As mentioned earlier, in India, the legal framework emphasises that consent must be meaningful and informed. Under the Indian Contract Act of 1872, parties must agree on the same thing in the same sense, and such consent is valid only if it is made without coercion, undue influence, fraud, misrepresentation or mistake.²⁴ Similarly, the Digital Personal Data Protection Act, 2023 asserts that consent must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action signifying agreement.²⁵ These provisions collectively assume that users meaningfully understand the terms to which they are consenting.²⁶

However, the empirical findings indicate that most users accept terms and conditions without reading or fully understanding them. Respondents stated lengthy legal language and complex clauses as key barriers, leading them to prioritise speed and convenience. Many preferred simplified formats such as bullet-point summaries, visual aids and interactive guidance, along with multilingual and clearly structured content, showing that existing consent frameworks do not match user comprehension levels.²⁷

This shows a clear gap between what the law expects and what actually happens in practice. The law assumes that people give informed and thoughtful consent, but in reality, most users just accept terms quickly due to time pressure and fatigue. Because of this, consent becomes more of a formality than a real choice, which weakens user control and raises doubts about whether such consent is truly valid.

7. Privacy & Data Concerns:

Digital payment platforms collect a large amount of personal and financial information of users. However, most users are not fully aware of what data is being collected, how it’s used or who it is shared with, because these details are often hidden in long and complex terms and conditions. This lack of understanding limits users’ control over their own information and raises serious privacy concerns. Justice K.S. Puttaswamy (Retd.) v. Union of India, making informed consent essential.²⁸ Without clear explanations, users cannot make meaningful choices about their data, and platforms may rely on consent that is formal rather than real.

8. Regulatory Challenges:

The Reserve Bank of India plays an important role in regulating digital payments in India by setting rules to make transactions safe, secure and reliable for users, with guidelines mainly focusing on preventing fraud, protecting user data and ensuring that payment systems work smoothly, thereby helping people develop trust in digital payment methods like UPI and mobile wallets.²⁹

However, there are still some important gaps in the system. “The rules focus more on technical safety than on whether users actually understand what they are agreeing to. Most users accept terms and conditions without reading them, and there are no strict rules to make these terms simple and easy to understand. Also, different laws like contractual law, data protection law are not well connected, which creates confusion about responsibility. So, even though users are protected from fraud, they are not fully aware or legally empowered when giving consent”.³⁰

9. Suggestions:

To improve digital payments, the terms and conditions should be made simpler. At present, they are lengthy and makes use of complex terms. If they are written in clear and short language, users can understand better and give proper consent.

Also, the design of payment apps should be improved. Many apps make users act quickly without thinking. Important information should be clearly shown, and users should get enough time to read before accepting anything. This will help them make better decisions.

Lastly, stricter rules are needed. The Reserve Bank of India should focus not only on safety but also on making sure users understand what they are agreeing to. This will make consent more real and meaningful, not just a formality.

10. Conclusion:

Digital payment systems in India, especially UPI, have made transactions quick and convenient for everyday use. However, this ease of use also raises important legal concerns about whether users truly give valid consent while using these platforms. Although the law requires consent to be free and informed, in reality, many users accept terms and conditions without reading or understanding them.

This study shows a clear gap between what the law expects and what actually happens in practice. Factors such as complex terms, fast transactions and app design often limit a user’s ability to make informed decisions. As a result, consent in digital payments may become more of a formality than a real choice.

There is a need to make consent more meaningful by simplifying terms, improving user awareness, and strengthening regulations. As digital payments continue to grow, protecting user   understanding   and   autonomy   should   be   a   key   priority.

FOOTNOTES

1. Indian Contract Act, 1872, §§ 13–22 ↩︎
2. Information Technology Act, 2000, § 10A ↩︎
3. Reserve Bank of India Act, 1934; Payment and Settlement Systems Act, 2007 ↩︎
4. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1; Ministry of Electronics & Information Technology, Report of the Committee of Experts on Data Protection Framework for India (2018) ↩︎
5. Indian Contract Act, 1872, § 13 ↩︎
6. Indian Contract Act, 1872, § 14 ↩︎
7. Indian Contract Act, 1872, § 15; Chikkam Ammiraju v. Chikkam Seshamma, (1917) 41 Mad 33 ↩︎
8. Indian Contract Act, 1872, § 16; Ranganayakamma v. Alwar Setti, (1889) ILR 13 Mad 214 ↩︎
9. Indian Contract Act, 1872, § 17; Derry v. Peek, (1889) 14 App Cas 337 (HL) ↩︎
10. Indian Contract Act, 1872, § 18 ↩︎
11. Indian Contract Act, 1872, §§ 20–22 ↩︎
12. Avtar Singh, Law of Contract 120 (Eastern Book Co., 11th ed. 2017) ↩︎
13. Reserve Bank of India Act, 1934; Payment and Settlement Systems Act, 2007 ↩︎
14. Reserve Bank of India, Payment and Settlement Systems in India: Vision 2019–2021 (2019) ↩︎
15. National Payments Corporation of India, Unified Payments Interface (UPI) – Product Overview, https://www.npci.org.in/what-we-do/upi/product-overview/ (last visited Apr. 10, 2026) ↩︎
16. Reserve Bank of India, Master Directions on Digital Payment Security Controls (2021) ↩︎
17. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 ↩︎
18. Ministry of Electronics & Information Technology, Report of the Committee of Experts on Data Protection Framework for India (2018) ↩︎
19. Digital Personal Data Protection Act, 2023, No. 22 of 2023, §§ 4, 6(1), 6(4), 7 (India) ↩︎
20. Consumer Protection Act, 2019, No. 35 of 2019, § 2(47) (India) ↩︎
21. Bhavisha Manish Ramrakhyani, Enforceability of Clickwrap Agreements in India: All You Need to Know, iPleaders, https://blog.ipleaders.in/enforceability-of-clickwrap-agreements-in-india-all-you-need-to-know/ (last visited Apr. 8, 2026) ↩︎
22. Reserve Bank of India, Payment and Settlement Systems in India: Vision 2019–2021 (2019) ↩︎
23. Guidelines for Prevention and Regulation of Dark Patterns, Ministry of Consumer Affairs (2023) ↩︎
24. Indian Contract Act, 1872, §§ 13–14 ↩︎
25. Digital Personal Data Protection Act, 2023, No. 22 of 2023, § 6 (India) ↩︎
26. Id. § 5 ↩︎
27. Digital Personal Data Protection Act, 2023, No. 22 of 2023, § 5 (India) ↩︎
28. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC ↩︎
29. Reserve Bank of India, Payment and Settlement Systems in India: Vision 2019–2021 (2019) ↩︎
30. Shubha Ghosh & Pranav Gupta, Informed Consent in Digital Transactions: Myth or Reality?, 12 Indian J. L. & Tech. 45 (2020) ↩︎