Click the Play button to listen to article

Meta announced on 1st October, 2025 to use data from its AI products to personalize advertisements for consumers. This targeted advertising began from 16th December, 2025 and has expanded to changing feeds on meta platforms like Facebook and Instagram. Earlier too, Meta has relied on data from user profiles to offer advertisements to groups of people. However, now this is taken a step ahead by making advertisements person specific. This targeted advertisement was implemented by a privacy policy update applicable globally. It may appear beneficial as a user would be shown ads of their preference and relevance, however, when analyzed, this raises serious privacy concerns. A proof is the exclusion of UK, European Union and South Korea from this policy update due to the stringent data protection and privacy laws there. India, on the other hand, has witnessed this policy update which raises serious concerns, especially after the enactment of Digital Personal Data Protection Act, 2023 ('DPDP'). This blog analyses the impact of the policy update in a threefold manner. Firstly, the impact of such targeted advertising on the privacy and autonomy of individuals, as conversations once meant for assistance will now be used for commercial purposes. Secondly, the consistency of Meta's new advertisement model with purpose limitation under DPDP, and lastly, recommendations. This article analyses these concerns in light of applicable laws and precedent, to argue that the policy update is violative of digital privacy.

Consent and user autonomy under DPDP

Under sub-section 1 of Section 6 of the DPDP, characteristics of a valid consent are provided. The section is reproduced as follows:

“The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.”

On analyzing Meta's policy update under the lens of these DPDP thresholds, it does not sustain because there is a lack of 'free consent'. From the Supreme Court's judgement in Pawan Alloys & Casting (P) Ltd. v. U.P. SEB (1997 (7) SCC 251), it is deducible that consent cannot be considered 'free' when an individual has no real alternative but to accept an onerous condition. On testing Meta's new policy update on this threshold, it is evident that consent obtained from users is not free because no true opt out mechanism exists. Furthermore, the case of D.C.M. Ltd. And Anr. vs Assistant Engineer (1987 (2)WLN 538) elaborates that agreeing to the conditions in a “take all or leave all agreement”, is not a valid expression of free will. More precisely, the cases where one party cannot have access to goods or services, if they don't agree to the conditions of the party at a stronger bargaining power, then the contract is in the form of “adhesion”, and hence invalid as no free choice exists.

Meta's policy update when analyzed for this standard, appears to operate in the nature of “take it or leave it” framework. Users are presented with a revised policy with no practical opt out alternatives. The absence for selective opt-out mechanism exposes all users to the personalized advertising based on their AI interaction. Therefore, the consent is structurally coercive. Furthermore, the bargaining asymmetry is even more pronounced in a digitalized world, where social and professional interactions are also dependent on meta products. A user who declines the updated terms risks losing access to essential digital spaces. Therefore, the consent extracted under such circumstances is not “free” within the meaning of Section 6(1) of DPDP. Instead, it resembles a compelled acquiescence, marked as consent.

Beyond the concern of “free consent”, the policy update raises serious concerns of decisional autonomy. The Supreme Court in the case of Justice K.S.Puttaswamy(Retd) vs Union Of India, dissected two essential characteristics of autonomy. First being self-determination, while the latter being self-expression. In other words, autonomy includes how a person chooses to perceive and portray self. Under Article 21 of the Constitution, right to privacy is a recognized right with autonomy as its central attribute. This implies that individuals must have a meaningful control over the use of their personal information as such data constructs their identity in digital spaces. Therefore, privacy is not only the protection of data but is also the preservation of an individual's agency over their information. When conversational data is subsequently used for advertisement purposes, the user's control over information identity dilutes, consequently, undermining the decisional autonomy that the right to privacy seeks to protect. Meta's policy update is therefore not only technological advancement for targeted advertisement, but a step potentially compromising the autonomy of individuals. It also raises serious concerns regarding the permissible scope of data processing under the DPDP Act.

Purpose Limitation under DPDP Act

Meta qualifies as a data fiduciary under section 2(i) of the DPDP Act, as it decides the means and purpose of processing of personal data. Under Chapter II of the Act, obligations for a data fiduciary are elucidated. Specifically, under section 6(1), consent can be given for processing of personal data for a specified purpose, and processing of personal data must be restricted to such “specified purpose”. Also, under sub-section 4 of section 6, when consent is given for processing of personal data, a right of easy withdrawal must exist simultaneously. Furthermore, under section 7(a), a data fiduciary is allowed to process personal data only when data principal provides a voluntarily consent for the “specified purpose”. The section specifically mentions that in absence of consent, personal data of data fiduciary cannot be processed.

Similarly, the National Company Law Appellate Tribunal in the case of WhatsApp LLC v. Competition Commission of India, that dealt with the WhatsApp 2021 policy update, held that “take it all or leave it all” policy update is coercive and not a reflection of free will. Furthermore, a special emphasis was put on purpose limitation being the governing principle for data use. All data sharing must be strictly tied to specific, disclosed purposes and conditioned on user's express, informed, and revocable consent. Therefore, any platform cannot repurpose the data or use it for unspecified purpose, without user's express consent. Hence, platforms cannot claim unilateral rights over data. Meta's new policy update fails to fulfill this parameter of purpose limitation as well.

Furthermore, in the case of Meta Platforms v. Competition Commission of India, which currently stays pending for final disposal before the Hon'ble Apex Court, Justice Bagchi highlighted the aspect of behavioral tendencies in the order. The app uses conversations to outline the behavior of individuals and then advertises very specifically to cater to those preferences. This monetizes their behavior. Given the market dominance of Meta Platforms, this situation becomes more serious, as such targeted advertising gives meta an unfair advantage, via the personal data of individuals. The court reiterated that, data collected for some specific purpose cannot be redirected for targeted advertising, thereby highlighting the aspect of “purpose limitation”. The new meta policy update, though claims to adhere to DPDP act does not fulfil this essential criterion.

Recommendations

There are three strong recommendations that can be adopted to reduce the threat to privacy of individuals. Firstly, Meta can adopt a privacy by design. Privacy by design means integration of data protection and privacy into the foundational framework of products or services, so that entire lifecycle is respects privacy. This can be done by limiting retention period of data, using anonymization and aggression wherever feasible. Along with ensuring that advertising systems rely on the least intrusive forms of data processing. Secondly, Meta should provide a meaningful and easy opt out mechanism. DPDP act requires that withdrawal should be as easy as giving consent. Meta should therefore allow users to disable AI-based ad personalization through a single-click mechanism along with ensuring that opting out does not restrict access to Facebook, Instagram, WhatsApp, or Meta AI services. Additionally, Meta can periodically remind users of their right to withdraw consent. Lastly, by strengthening purpose limitation through data segregation. Meta should separate data collected for AI assistance and conversational purposes, and data used for advertising and commercial profiling. Conversations entered into AI systems are generated in a context where users seek information, assistance, or communication. Repurposing such information for targeted advertising undermines the principle of purpose limitation embedded within the DPDP framework. Consequently, conversational data should not be reused for advertising unless fresh and express consent is obtained.

Author is a fourth-year Law student at Dharmashastra National Law University, Jabalpur. Views are personal. 

Tags: