Authored By: Drishti Puri
Bharati Vidyapeeth’s Institute of Management and Research, New Delhi
Introduction
Privacy has never disappeared overnight. It has faded quietly—one facial scan to unlock a smartphone, one voice command to a virtual assistant, one click on “Accept All Cookies,” and one algorithmic recommendation at a time. Every digital interaction leaves behind fragments of personal information that artificial intelligence (AI) can collect, combine, and analyse with remarkable precision. What was once viewed merely as personal data has become the foundation of predictive technologies capable of influencing consumer behaviour, assessing creditworthiness, screening job applicants, personalising advertisements, and even assisting in public decision-making. The question, therefore, is no longer whether personal data is being collected; it is whether individuals continue to exercise meaningful control over how that data is interpreted and used.
India’s recognition of privacy as a fundamental right in Justice K.S. Puttaswamy (Retd.) v. Union of India[1] marked a constitutional milestone, and the enactment of the Digital Personal Data Protection Act, 2023[2] represents a significant step towards safeguarding informational privacy. Yet, these legal developments emerged in a rapidly evolving technological landscape where AI systems increasingly learn from data rather than merely store it. Traditional privacy frameworks, largely built around user consent, now face unprecedented challenges when algorithms generate behavioural profiles, infer sensitive information, and make decisions with minimal human intervention.
This article argues that while consent remains an essential pillar of data protection law, it is no longer sufficient to address the complexities introduced by artificial intelligence. A meaningful privacy framework must evolve beyond procedural consent to embrace transparency, algorithmic accountability, and effective human oversight. To support this argument, the article first examines the limitations of consent in the AI economy, then analyses the adequacy of India’s existing legal framework, and finally proposes a more robust approach to protecting privacy in an era increasingly shaped by intelligent systems.
The Illusion of Consent in the Age of Artificial Intelligence
Consent[3] has long been regarded as the cornerstone of modern data protection law. The underlying assumption is straightforward: individuals who are informed about how their personal information will be collected and used are capable of making autonomous choices regarding their privacy. This principle finds recognition in legal frameworks across jurisdictions, including India’s Digital Personal Data Protection Act, 2023 (DPDP Act), which places consent at the centre of lawful data processing. In theory, consent empowers individuals by allowing them to exercise control over their personal information. In practice, however, the rapid integration of artificial intelligence has exposed the limitations of this assumption.
Today’s digital economy is built upon continuous data collection. Whether an individual orders food online, books a cab, shops through an e-commerce platform, or simply browses social media, each interaction generates valuable data capable of revealing behavioural patterns, preferences, habits, and even future intentions. Artificial intelligence significantly amplifies the value of this information by analysing vast datasets to produce insights that often extend beyond the information consciously shared by users. Unlike traditional digital systems that merely stored personal data, AI systems generate inferences, identify behavioural trends, and predict future conduct with increasing accuracy. Consequently, individuals are no longer consenting merely to the collection of information; they are indirectly enabling the creation of detailed digital profiles that can influence decisions affecting their daily lives.
The difficulty lies not only in the extent of data collection but also in the quality of consent itself. Although privacy policies formally seek user approval, they are frequently drafted in technical language, embedded within lengthy terms and conditions, and accepted through a single click without meaningful engagement. Most individuals lack the time, expertise, or practical ability to understand how their information will be processed, shared, or analysed using sophisticated AI technologies. Consent, therefore, increasingly functions as a procedural formality rather than an informed and autonomous decision.
Artificial intelligence further complicates this model because its capabilities extend beyond the purposes originally communicated to users. Data collected for one legitimate objective may subsequently be analysed to infer political preferences, purchasing behaviour, health conditions, emotional responses, or financial reliability through algorithmic processing. These inferences are often generated without the individual’s knowledge, despite having significant implications for employment opportunities, targeted advertising, insurance assessments, credit decisions, or access to essential services. As AI systems[4] become more sophisticated, the distinction between information voluntarily provided by users and information derived through algorithmic analysis continues to blur.
This evolving reality exposes a fundamental weakness in a purely consent-based approach to privacy regulation. While consent remains an important expression of individual autonomy, it cannot meaningfully protect privacy when individuals neither understand nor reasonably anticipate the full extent of AI-driven data processing. The legal fiction that a single click represents informed consent becomes increasingly difficult to sustain in an ecosystem where algorithms continuously learn, adapt, and generate new knowledge from existing information.
It is therefore submitted that the challenge posed by artificial intelligence is not simply one of excessive data collection, but of informational asymmetry. Technology companies possess unparalleled knowledge regarding how algorithms operate, while individuals remain largely unaware of how their personal information is transformed into commercially valuable insights. In such circumstances, privacy can no longer depend exclusively upon consent. Instead, effective data protection requires legal frameworks that place equal emphasis on transparency, accountability, and responsible AI governance.
Artificial Intelligence and the Limits of India’s Data Protection Framework
The recognition of privacy as a fundamental right by the Supreme Court in Justice K.S. Puttaswamy (Retd.) v. Union of India[5] fundamentally reshaped India’s constitutional understanding of personal liberty. The Court acknowledged that informational privacy is indispensable to individual dignity and autonomy, recognising that individuals must retain control over the collection and use of their personal information. This constitutional vision was subsequently reinforced through the enactment of the Digital Personal Data Protection Act, 2023[6] (DPDP Act), which seeks to establish a comprehensive framework governing the processing of digital personal data. By recognising rights such as access to personal information, correction of inaccurate data, withdrawal of consent, and grievance redressal, the Act represents an important milestone in India’s evolving privacy jurisprudence.
However, while the DPDP Act significantly strengthens data protection, its regulatory architecture remains primarily designed for conventional forms of data processing. Artificial intelligence operates in a fundamentally different manner. Unlike traditional databases that merely collect and store information, AI systems continuously analyse existing datasets, identify hidden correlations, generate predictive models, and create new inferences that may never have been directly disclosed by the individual concerned. These algorithmically generated insights often possess greater commercial and social value than the original data itself, yet they remain comparatively underexplored within existing legal frameworks.
This distinction has important legal consequences. An individual may knowingly consent to the collection of location data for navigation services or purchase history for personalised recommendations. However, the same information can subsequently be combined with countless other data points to infer political affiliations, financial behaviour, health conditions, emotional vulnerabilities, or future consumer choices. These inferences are frequently produced without explicit human intervention and may influence decisions relating to employment, insurance, creditworthiness, education, or access to digital services. Consequently, the legal issue is no longer confined to whether personal data is collected, but extends to how artificial intelligence transforms seemingly ordinary information into powerful tools of prediction and decision-making.
Another significant challenge arises from the limited transparency of many AI systems. Individuals are often informed that their data will be processed, yet they rarely understand how algorithmic models evaluate that information or the extent to which automated decision-making affects outcomes that directly impact their lives. This “black-box” nature of AI complicates the exercise of meaningful legal rights. A person cannot effectively challenge an algorithmic decision if the reasoning behind that decision remains inaccessible or unintelligible. Without adequate transparency, rights guaranteed under data protection legislation risk becoming difficult to exercise in practice.
Comparative legal developments further illustrate this evolving challenge. The European Union’s General Data Protection Regulation (GDPR)[7] introduced important safeguards relating to automated decision-making and profiling, while the recently adopted EU Artificial Intelligence Act[8] adopts a risk-based regulatory approach that imposes stricter obligations on AI systems capable of producing significant legal or societal consequences. Although India’s constitutional and regulatory landscape differs from that of the European Union, these developments demonstrate an emerging international consensus that privacy regulation must extend beyond data collection to address the broader implications of algorithmic governance and AI accountability.
It is therefore submitted that India’s existing legal framework provides a necessary foundation but cannot be regarded as the final answer to AI-driven privacy concerns. The constitutional principles articulated in Puttaswamy remain sufficiently broad to accommodate future technological developments, yet effective implementation requires legislation capable of addressing algorithmic transparency, explainability, automated decision-making, and accountability. Protecting privacy in the age of artificial intelligence is no longer solely a question of regulating personal data; it increasingly requires regulating the intelligence that learns from it.
Beyond Consent: Building an AI-Ready Privacy Framework
The rapid evolution of artificial intelligence demonstrates that privacy regulation can no longer remain confined to obtaining user consent at the point of data collection. While consent will continue to play an important role in protecting informational autonomy, it cannot serve as the sole safeguard in an environment where AI systems continuously learn, adapt, and generate new insights from previously collected data. If privacy is to remain a meaningful constitutional guarantee rather than a procedural formality, India’s legal framework must evolve from a consent-centric model towards one grounded in accountability, transparency, and responsible innovation.
A meaningful first step is to strengthen algorithmic transparency. Individuals should possess the right not only to know that their personal information is being processed but also to receive a clear and accessible explanation of how significant AI-driven decisions affecting them are reached. Whether an algorithm influences employment opportunities, financial services, healthcare recommendations, or educational admissions, those impacted should be able to understand the basis of such decisions and, where appropriate, challenge outcomes that appear inaccurate, discriminatory, or arbitrary. Transparency strengthens public trust while ensuring that technological innovation remains consistent with constitutional values.
Equally important is the principle of human oversight. Artificial intelligence should support decision-making rather than replace human judgment in matters involving fundamental rights or significant legal consequences. Decisions relating to employment, healthcare, financial inclusion, criminal justice, or public administration often involve ethical, social, and contextual considerations that cannot always be reduced to mathematical predictions. Maintaining meaningful human review helps minimise the risk of algorithmic bias, prevents over-reliance on automated systems, and reinforces accountability when errors occur.
India should also adopt a stronger emphasis on Privacy by Design[9], requiring organisations to integrate privacy safeguards into AI systems from the earliest stages of development rather than treating compliance as an afterthought. Data minimisation, purpose limitation, secure storage, and regular algorithmic risk assessments should become integral components of responsible AI governance. Such an approach not only protects individuals but also encourages businesses to develop trustworthy technologies capable of sustaining long-term consumer confidence.
Another area requiring legislative attention is the regulation of AI-generated inferences[10]. Existing privacy discussions often focus on personal information directly collected from individuals, yet AI derives enormous value from analysing that information to predict future behaviour, preferences, and vulnerabilities. These algorithmically generated profiles can influence opportunities and life choices without individuals ever realising that such inferences exist. Future legal reforms should therefore recognise that meaningful privacy extends beyond protecting raw data; it must also regulate how AI interprets, combines, and deploys information to shape decisions affecting individuals.
Finally, effective privacy protection requires robust institutional oversight. Independent regulatory authorities should possess adequate technical expertise and enforcement powers to audit high-risk AI systems, investigate non-compliance, and ensure that organisations deploying AI remain accountable for the consequences of algorithmic decision-making. Innovation and regulation should not be viewed as competing objectives. On the contrary, clear legal standards promote responsible technological development by providing businesses with certainty while protecting individuals against disproportionate risks.
Ultimately, the future of privacy law will depend upon its ability to regulate intelligence rather than merely information. Artificial intelligence has fundamentally altered the relationship between individuals and their personal data, making traditional consent-based models increasingly inadequate. The law must therefore evolve alongside technology, ensuring that innovation remains guided by the constitutional values of dignity, autonomy, equality, and fairness rather than by technological capability alone.
Conclusion
Artificial intelligence has fundamentally transformed the relationship between individuals and their personal information. Privacy is no longer threatened solely by the collection or storage of data; it is increasingly challenged by intelligent systems capable of analysing, predicting, and influencing human behaviour on an unprecedented scale. While India’s recognition of privacy as a fundamental right and the enactment of the Digital Personal Data Protection Act, 2023 represent significant milestones in safeguarding informational autonomy, they also reveal the limitations of legal frameworks built primarily around informed consent. In an ecosystem where algorithms continuously generate new inferences from existing data, consent alone cannot adequately protect individuals against opaque decision-making and evolving technological risks.
This article has argued that the future of privacy law lies not in abandoning consent but in strengthening it through greater algorithmic transparency, meaningful human oversight, robust regulatory accountability, and privacy-conscious technological design. Such an approach preserves innovation while ensuring that technological advancement remains consistent with constitutional values of dignity, autonomy, and equality. As artificial intelligence becomes increasingly embedded within public administration, healthcare, finance, education, and everyday digital interactions, privacy must be understood as an ongoing right to retain meaningful control over how personal information is interpreted and used—not merely the right to approve its initial collection.
Ultimately, the most significant challenge posed by artificial intelligence is not that machines know more about individuals than ever before. It is that they are beginning to shape opportunities, influence decisions, and define outcomes in ways that often remain invisible to the people most affected by them. If the law continues to focus exclusively on obtaining consent while overlooking the growing power of algorithmic decision-making, the constitutional promise of privacy risks becoming increasingly symbolic rather than substantive. The true measure of a modern legal system will therefore not be whether it succeeds in regulating artificial intelligence, but whether it remains capable of protecting human autonomy in an age where intelligence itself is no longer exclusively human.
Reference(S):
Justice K S Puttaswamy (Retd) v Union of India (2017) 10 SCC 1.
Digital Personal Data Protection Act 2023.
Information Technology Act 2000.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation).
Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act)
OECD, Recommendation of the Council on Artificial Intelligence (OECD Legal Instruments 2019) https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449 accessed 10 July 2026.
UNESCO, Recommendation on the Ethics of Artificial Intelligence (2021) https://unesdoc.unesco.org/ark:/48223/pf0000381137 accessed 10 July 2026.
Ministry of Electronics and Information Technology, Digital Personal Data Protection Act, 2023 https://www.meity.gov.in accessed 10 July 2026.
[1] Justice K S Puttaswamy (Retd) v Union of India (2017) 10 SCC 1
[2] Digital Personal Data Protection Act 2023
[3] Digital Personal Data Protection Act 2023, ss 4–7
[4] OECD, OECD Recommendation on Artificial Intelligence (OECD Legal Instruments 2019) https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449 accessed 10 July 2026
[5] Justice K S Puttaswamy (Retd) v Union of India (2017) 10 SCC 1
[6] Digital Personal Data Protection Act 2023
[7] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation)
[8] Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on Artificial Intelligence (Artificial Intelligence Act)
[9] Ann Cavoukian, Privacy by Design: The 7 Foundational Principles (Information and Privacy Commissioner of Ontario 2011)
[10] UNESCO, Recommendation on the Ethics of Artificial Intelligence (2021)
