Do you actually read the complete “terms & conditions” before signing up for a social media platform? Have you clicked “I agree” to WhatsApp or Instagram’s privacy policy without reading but often wonder what it means for your data? We did the reading for you.
We examined these terms and conditions along with the privacy policies of major social media and messaging platforms to understand how our data is collected and used.
The most shocking finding? These platforms often conceal how much of our data they retain or for how long. Even after we delete our accounts and photos, the tech giants may still choose to retain and use our data under the “terms & conditions” we agreed to.
So, what exactly are we handing over? To understand the concerns around data farming and how our information is collected, stored and potentially used, we first need to look at what data these platforms collect.
Here’s what we agree to every time we click “I agree” or allow a website to use cookies:
What data can big tech collect?
The first category is the obvious data. This includes your name, age, email, contact number, birthday, payment details, profile photo, and photos or videos you post. This is voluntary data you manually give away to the platform.
The second category of data is based on user activity. We already know how algorithms are shaped based on our activity on a social media platform. That’s why when you like one cat video, you have videos of cats all over your “for you page”.
Content on your feed is suggested based on your online activity, meaning platforms inevitably collect data on what you view, like, share and search for, how long you engage with content, and whom you interact with.
The third category includes your technical data like IP address, device model, battery level, signal strength, and GPS location. Your location can be inferred through GPS, Bluetooth, nearby Wi-Fi, and cell towers, and it can be recorded even when location services are turned off on your device or in your settings.
If you provide access to your camera roll or microphone, even photos you don’t post can be accessed. Companies that own these platforms can also track your activity on websites you visit.
It is also safe to assume that our data is shared across social media platforms as well. Public photos, posts, and comments are also used to train Artificial Intelligence models. Platforms which do not have end-to-end encryption may use your direct messages.
So, logging out and deleting the accounts should safeguard us from this endless cycle of data collection, right? Well, not exactly. These platforms already have access to your data, including your fingerprints and biometric data (facial recognition).
These platforms even create a profile of you, the “John Doe” document of a user, which includes every action, every picture, and every word tracked.
What is the Digital Personal Data Protection Act?
The government has described DPDP Act as a comprehensive framework for protecting digital personal data, setting out the obligations of entities handling such data and the rights and duties of individuals.
The law is yet to come in its full force as the government plans to roll it out in three phases. The Data Protection Board of India has been established already. In November 2026, a consent registration framework goes live, which will be put in place for third parties to manage your consent across apps. The final phase will roll out in May 2027, which comprises all the actual compliance obligations, including consent rules, children’s data, and reporting data breaches.
Cybersecurity expert and lawyer Mimanta Ambastha while speaking to LawMic said, “companies should have greater accountability; better safeguards are needed. DPDP Act was passed keeping in mind that privacy is now recognised as a fundamental right by the apex court”.
Ambastha however pointed out that none of the core obligations are legally binding yet. The laws will apply to any company that processes personal data even if they are not based in India. The Act relies almost entirely on consent as the legal basis for processing; things like ad-profiling would need clearer and more specific consent than these platforms currently obtain through blanket “I agree” click-throughs.
What rights does DPDP protect?
You have a right to know what data is held, the right to know which companies or processors have access to the obtained data, the right to correction or deletion of data, and most importantly a grievance mechanism. Guardian’s consent will be required to process children’s data.
The Cybersecurity expert also added that, “Anything that can identify you can be personal data; we, as consumers, must be more aware of the content we post on social media. If our personal data is misused or if we are recorded without our knowledge, we can press charges against the company.”
What next for big tech?
Some of these companies already have India-specific policies but there are no set rules to “follow” yet, as the main compliance rules will kick in after a year. Currently, it is less about compliance and more about preparation for data protection rules that India will enforce. However based on our researched, major big tech company privacy policies would not satisfy DPDP’s Phase 3 requirements yet which means there is a lot of work left to be done to protect user data and ensure clear consent.
Cyberlaw Advocate, Kartikeyan N says, “earlier our data was not managed well. It was shared with various companies for marketing and sales.” He also says, “If companies fail to report data breaches there could be a penalty of up to 200 crores.”
The government has framed the 18-month phased compliance window to give all organisations “time for smooth transition”. The Indian government has also made it clear that there will be “no extensions” in the timeline.
The bottom line is that these big tech companies, which are aggressively working on data farming, will have to comply with the DPDP Act from 2027. Indian citizens, government and judiciary have already started conversations around how data is misused by the big tech companies for commercial gains.
Advocate Kartikeyan says, “Social media conglomerates are not governed by their own community guidelines, they must be governed by the law of the land.”
The Supreme Court had earlier pulled up Meta and WhatsApp over privacy policy violations and said they “could not play with the right to privacy of citizens.” A bench led by CJI Surya Kant had warned Meta saying that either the company should comply with norms or leave the country.
Advocate Kartikeyan adds, “Stringent action must be taken if these big tech companies attempt to circumvent the data protection rules. The public should also be made more aware, more than 80% of Indians own a smartphone. The question is are we smart enough to own a smartphone?”
