New Delhi: Last week, the Walt Disney Co. was accused of illegally tracking children online and violating their privacy through 42 of its apps in the United States. Currently facing a lawsuit for breaching the Children’s Online Privacy Protection Act, the company has allegedly been collecting children’s information without their parents’ consent and passing it on for targeted advertising.

To be sure, music and movie streaming platforms in India also obtain personal information from their users. By logging into any of these applications through existing Facebook or Gmail accounts, the user gives the platform access to not just their email address and user name but also any information the user may have shared on social media. Creating accounts from scratch on the streaming platforms too require several details, including name, age, gender, mobile details, geographical location and in some cases, bank account and credit/debit card details. However, the legal repercussions here are unlikely to be similar.

“In India, as far as the legal framework is concerned, the Information Technology Act is the only piece of legislation which governs the use, collection and disclosure of sensitive or personal data or information," said Ankit Sahni, a lawyer practising at the Delhi high court, who specializes in intellectual property rights. “And that is not all that exhaustive in terms of giving very specific directions on what to do (with the information)."

To be sure, the law talks about basics like how the information may be collected and the fact that a privacy policy on the kind of data being collected and what it may be used for has to be displayed and consented to by the user.

“It’s fair because the consumer technically shares the information by his own volition. But those clauses are buried deep under the agreements which you click on as terms of use. In that sense, the consumer is in complete trouble," said Manav Sethi, chief marketing officer at ALTBalaji, a video-on-demand platform owned by Balaji Telefilms Ltd.

Secondly, there are no restrictions on what the collected data may be used for, The rules the user agrees to make it mandatory for him to disclose information but don’t define the boundaries of what the platforms can do with it.

“There is no regulatory framework, no breach notification or accountability system, no expert body which investigates and asks for regular compliance reports or a referee that decides what the probabilities with respect to the regulation are," said Apar Gupta, a Delhi-based lawyer and cyber media law expert. “So there is an imbalance between the user and the application, the user does not know what data is being gathered transparently, and even if it is being gathered, what is the accountability system in place. Incidents like the one in the US happen all the time but there is no mechanism to report it. If you don’t have a law, there won’t be an illegality."

For the platforms, it all boils down to segmented marketing and the need to study consumer behaviour and patterns accurately in order to sharpen the content they offer them.

“Of course the information helps," said Rajiv Vaidya, chief executive officer at movie streaming service Spuul, which only works with a username and password. “We get to know which genres of movies, which stars or directors are being watched more, these are parameters that help us decide which kind of movies to buy, what movies work in which geography. The entire content buying strategy comes from studying user behaviour and demand."

The success of ad-based services is linked to how deep they can go into collecting and reusing consumer data for their advertisers.

“If a Mercedes goes to Hotstar, they won’t ask them to show their ads to everyone on the app, they will ask for deeper cuts, who has the propensity to pay for a show, what is the surrounding behaviour like, in terms of interest in premium shows and brands. That kind of persona-based marketing is gaining ground in India, otherwise how would the P&A (publicity and advertising) of all ad-funded platforms run?" Sethi pointed out.

A lot, Sahni said, now depends on the Supreme Court judgment on whether the right to privacy should be deemed a fundamental right.

“The (current) laws are inadequate. We are all keenly looking forward to the Supreme Court judgment to set the guiding path for the legislators to follow, and it will overlap with areas on what kind of data is handled online and how," he said.