From Click to Contract: The Legal Validity of Consent in India’s Social Media Data Ecosystem

In today’s digital age, social media platforms function not only as communication tools but also as avenues for extensive data collection and behavioural profiling. While consent remains a fundamental principle in contract law and data protection frameworks, it often manifests as a routine checkbox, frequently agreed to without full comprehension or deliberate choice. Many users accept complex terms of service on platforms such as Facebook, Instagram, and Twitter without a clear understanding of how their personal data will be utilised, shared, or monetised. This scenario invites legal and ethical reflection, especially concerning the validity of such consent under Indian law. This paper undertakes a doctrinal analysis of India’s data protection and contractual legislation to evaluate whether user consent to social media terms of service meets the criteria of being “free, informed, and specific.” It examines three key legislations: the Indian Contract Act, 1872, the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023. The paper also compares Indian legal provisions with international standards, notably the European Union’s General Data Protection Regulation (GDPR), which prioritises affirmative, detailed, and revocable consent. While the GDPR imposes stringent obligations on data controllers, Indian law tends to adopt a more formal approach, often permitting reliance on nominal user consent without verifying genuine understanding or voluntariness. To address these challenges, the paper advocates for legislative amendments, proactive judicial interpretation, and comprehensive user education initiatives. Such measures could help evolve digital consent from a procedural requirement into a substantive, rights-based framework.