INTRODUCTION
India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) marks a significant step in protecting citizens’ privacy in an increasingly digital world. Yet, a quiet violation of this law plays out daily in retail stores across the country. It has become routine for businesses to collect personal data like mobile numbers, email IDs from customers at the point of purchase. While consent is sometimes given willingly, it is more often uninformed or subtly coerced. A common tactic is offering a digital bill “to save paper”, which sounds environmentally responsible but conveniently sidesteps the customer’s right to privacy.
The average Indian shopper is not always equipped to recognize this. India has one of the world’s largest smartphone user bases, yet a significant portion of the population remains digitally illiterate, unaware of their legal rights or the implications of sharing personal data. Factors such as age, limited education, and language barriers make many consumers especially vulnerable to such manipulation. What makes this particularly concerning is that the law already exists to prevent it. The DPDP Act 2023 under Chapter II explicitly provides ‘consent’ as an obligation for data fiduciary for making the collection of personal information a precondition for purchase. Despite this, retail stores routinely bypass this provision, and do so openly, with little accountability.
This paper examines this growing gap between legal intent and ground reality. It explores how personal data is collected, often without meaningful consent, across retail environments and smart grid ecosystems in India, and what this means for consumer privacy, digital rights, and the enforcement of data protection law in a country still navigating its digital transformation.
Keeping pace with rapid technological change, India’s Ministry of Power is actively deploying smart meters across the country under its Revamped Distribution Sector Scheme (“RDSS”), making government-led digital infrastructure an equally important area of privacy scrutiny.
This study examines how retail stores in India collect personal data from consumers, often disguised as convenience or environmental responsibility, without meaningful consent. It further explores how smart grid ecosystems, through detailed energy consumption data, enable deep profiling of household behaviour, raising serious concerns about privacy in both spaces. And further concludes by advocating for stronger enforcement mechanisms, heightened consumer awareness, and a reimagining of consent frameworks that place genuine autonomy at the centre of India’s evolving data protection jurisprudence.
This study employs a mixed-method approach combining quantitative and qualitative research methodologies to comprehensively examine the legal and operational dimensions of consumer data collection models across retail stores in India. The doctrinal component encompasses systematic analysis of India’s first comprehensive legislation to regulate digital personal data, the DPDP Act, 2023, RDSS, launched by the Ministry of Power, the landmark judgment of the Supreme Court of India in Justice K.S. Puttaswamy v. Union of India (2017)1, in establishing privacy as a fundamental right, and the level of digital literacy in Indian consumers in order to assess their adequacy in addressing the ground level issue of privacy infringement of consumers.
The empirical dimension relied upon secondary sources including reputable news reports, media coverage, academic journals, and scholarly articles documenting real-world issues related to data collection by retail stores from consumers with varying digital literacy levels. This analysis provided contextual understanding of implementation challenges and ground-level realities. The convergence of legal analysis with empirical observation enables comprehensive assessment of effectiveness of compliance and identification of necessary policy interventions which are needed to address and resolve this issue of convergence of consumer data from retail stores and smart grid data, creating a kind of surveillance infrastructure upon the consumers, which is far more invasive in an environment regulated by DPDP Act 2023 that still is at a nascent stage.
ANALYSIS
Digital Infrastructure
The growth of digital payments ranged from 2,071 crore transactions in FY 2017-18 to over 18,737 crore in FY 2023-24, indicating massive adoption. UPI accounts for roughly 85% of all digital transactions.2 But digital literacy among Indian consumers is relatively low, with only about 38% of households being considered digitally literate. While urban areas show higher proficiency at 61%, rural digital literacy remains low at 25%. Significant gaps exist in basic ICT skills, with only 12% of individuals over 15 possessing them, despite rising smartphone access.3
When customers are repeatedly asked for their phone number or email ID at every retail transaction, it gradually makes surveillance feel normal. Over time, people stop questioning it, they simply comply. This is particularly true for low-income consumers, elderly individuals, first-generation smartphone users, and those with limited digital or legal awareness, who are far more vulnerable to such data collection practices and least equipped to push back. What appears to be a minor inconvenience at a shop counter is, in reality, a serious and layered privacy problem. Each small surrender of personal data contributes to a larger system of commercial surveillance that chips away at individual dignity and consumer rights. If left unaddressed, this quiet normalization poses a deeper threat, undermining the very foundation of a fair and rights-respecting data economy that India is striving to build.4
The Hon’ble Supreme Court of India in one of its landmark judgment Justice K.S. Puttaswamy v. Union of India(2017)5 declared the right to privacy as a fundamental right under Article 21 of the Indian Constitution. By recognising that individuals have the right to control their personal information and that informational privacy is central to human dignity, this judgment directly shapes how consumer data must be collected and handled in both retail stores and smart grid systems.6
What is Smart Grid, how does it work and how it infringes privacy?
A Smart Grid is a modernised electricity network that uses digital technology and two-way communication between power suppliers and consumers to better manage and balance electricity supply and demand in real time.7 Unlike a traditional electricity grid, where power flows only one way, from supplier to consumer, a smart grid works both ways. It allows electricity and information to flow in both directions, enabling real-time communication between the supplier and the consumer.8
At the heart of a smart grid is the smart meter, which is installed in homes and buildings to replace the traditional electricity meter. Unlike a conventional meter that only records total units consumed, a smart meter: 9
a. Records electricity usage in real time, every 15-30 minutes,
b. Automatically sends this data to the supplier,
c. Reveals when, how much, and how electricity is used,
d. Can be remotely controlled by the supplier to adjust or disconnect supply, etc.
This is precisely where privacy concerns arise. The data collected by smart meters goes far beyond electricity usage, it quietly reveals intimate details about how people live, including10:
a. What time residents wake up and sleep,
b. Whether the home is occupied or empty,
c. Which appliances are used and when,
d. Daily routines and lifestyle patterns,
e. How many people live in the household, etc.
This detailed data quietly builds a profile of a household’s private life, often without residents even realising it. This is why smart grid data collection sits at the crossroads of three critical areas, namely, data privacy, cybersecurity, and energy law.11
The Revamped Distribution Sector Scheme (RDSS) is a ₹3.03 lakh crore central government scheme launched by the Ministry of Power, running from 2021 to 2026. Its primary goal is to improve the financial health and operational efficiency of power distribution companies across India. It aims to significantly reduce electricity transmission and commercial losses, and bridge the gap between the cost of supplying power and revenue collected, largely through the nationwide rollout of prepaid smart meters, feeder separation, and infrastructure upgrades.12
Key components of RDSS include:13
a. Prepaid Smart Metering: Installing smart meters for all consumers to improve billing accuracy and reduce electricity theft.
b. Feeder Segregation: Separating agricultural power lines to enable solar energy integration under the KUSUM scheme, ensuring reliable daytime electricity supply to farmers.
c. Infrastructure Upgradation: Replacing ageing cables and transformers to strengthen distribution networks and improve power reliability.
d. IT/OT Integration: Deploying real-time monitoring systems such as SCADA in cities to oversee and manage power distribution efficiently.
e. Capacity Building: Training distribution company staff to improve day-to-day operational management and service delivery.
To summarise, how exactly does covert data collection in Indian retail stores translate into a serious privacy violation? The following key points capture the core of the problem:
1. Clear violation of informed choice in cases of vulnerable customers: A customer standing at a billing counter is rarely in a position to freely refuse a request for personal data. The environment itself is subtly coercive, and consent obtained under such conditions cannot genuinely be called voluntary. While these practices are often presented as eco-friendly or customer-convenient initiatives, they are, in reality, thinly disguised methods of extracting personal data. The benefits promised to the customer are largely superficial and do not justify the privacy cost involved. This directly violates the three essential conditions of valid consent under the DPDP Act, 2023, consent must be free, specific, and informed. In most retail scenarios, none of these conditions are meaningfully met.14
2. In digital era, Data is the new gold: A phone number or email address may seem harmless on its own. But the real danger lies in aggregation. Over time, this data builds a surprisingly detailed picture of a person, their spending habits, food preferences, lifestyle choices, shopping frequency, and economic status. For large retail chains operating hundreds of outlets, this aggregation happens at a massive scale, quietly creating detailed profiles of millions of Indian consumers who have no idea this profiling is even taking place. This is precisely what surveillance capitalism looks like in practice, where ordinary human behaviour is silently captured and converted into commercial data, without the knowledge or meaningful consent of the people it belongs to.15
3. Purpose of data collection misused: Phone numbers and email IDs collected under the pretext of paperless billing are routinely used for purposes far beyond what the customer intended. They are used to send unsolicited marketing messages, shared with third-party advertisers, sold to data brokers, or fed into targeted advertising systems. This directly violates the principle of purpose limitation, a foundational rule in data protection law, and one explicitly recognised under India’s DPDP Act, 2023.
This principle requires that data collected for one purpose must not be used for another. A consumer who shared their number simply to receive a bill soon finds themselves receiving promotional calls, spam messages, and targeted advertisements, uses they never anticipated, agreed to, or authorised.16
4. Convergence of data collected by retail stores and smart grid meters in household: The privacy concern grows significantly when retail data collection is seen alongside the rapid expansion of smart grid systems across India. Smart meters generate detailed, time-stamped records of household electricity use, quietly revealing intimate aspects of daily life, such as sleep timings, cooking habits, whether someone works from home, what appliances they own, and even their approximate income level. When this energy data is cross-referenced with retail purchase data linked to the same phone number or identity, the combined picture becomes deeply intrusive. Together, these two data streams create a surveillance architecture of remarkable depth, one that allows corporations, and potentially state actors, to piece together a near-complete profile of an individual’s private life. This convergence is not merely a commercial inconvenience. It represents a fundamental threat to personal autonomy, dignity, and the right to live without being constantly watched and profiled.17
5. Vulnerable population is the most at risk: Privacy violations in this context do not affect all Indians equally. Low-income consumers, elderly individuals, first-generation smartphone users, and those with limited digital or legal awareness bear a disproportionately higher burden. These groups are least likely to understand what sharing their personal data actually means. They are also least equipped to use opt-out options, even where such options technically exist. And they are most easily swayed by offers of discount points, cashback, and loyalty rewards, benefits that are often deliberately explained in confusing detail, with data collection as the real underlying purpose.
The result is deeply troubling. Privacy harm ends up compounding existing social and economic inequalities. The most vulnerable sections of Indian society, those who can least afford it, end up paying the highest price for surveillance systems they never knowingly consented to be part of.18
While the DPDP Act, 2023 is an important step forward, its enforcement against retail data collection remains largely ineffective. The Act relies heavily on consent, but in real retail transactions, meaningful consent is rarely possible, making the law’s foundational premise difficult to apply in practice.
CONCLUSION
Over the past two decades, India’s retail landscape has transformed dramatically. Traditional kirana stores and neighbourhood shops have gradually given way to supermarkets, shopping malls, and organised retail chains. Like every technological shift, this change brings both benefits and risks. Handwritten bills have been replaced by computer-generated receipts. Payment habits have changed fundamentally, accelerated by the COVID-19 pandemic, which pushed millions of Indians towards digital and online payments, moving away from the cash transactions that once defined everyday commerce.
But this transformation has quietly introduced a serious problem. As retail becomes increasingly digital, the personal data of customers is being collected, stored, and used, often without their genuine understanding or consent. This poses a significant threat, particularly for the large section of India’s population that uses smartphones but lacks the digital literacy to fully grasp what sharing their personal data truly means.
In today’s world, data is frequently described as the new gold, and it is easy to see why. Retail stores across India are aggressively collecting phone numbers and email IDs from customers, often targeting those who are unaware of their legal rights. In doing so, they are essentially mining this gold at the direct cost of customer privacy, a practice that is, at the very least, morally indefensible, and in many cases, plainly illegal. When an informed customer resists or questions the request, stores rarely back down. Instead, they resort to indirect pressure, subtly coercing the customer into compliance through persistence or by withholding service.
Some outlets have gone a step further, outright refusing to provide paper bills under the banner of environmental responsibility. This leaves customers with little practical choice, share your contact details, or walk away without proof of purchase. What is presented as a green initiative is, in reality, a convenient mechanism to extract personal data from unsuspecting consumers.
What is happening across India’s retail stores amounts to consumer data collection either without consent or through consent that is effectively forced. This, combined with the rapid expansion of smart grid ecosystems, makes the privacy challenge both urgent and complex. While it is encouraging that digital transactions are rising and that the DPDP Act, 2023 is now in place, legislation alone is not enough. The government must move beyond policy and engage in meaningful ground-level enforcement. This means actively checking whether retail stores are genuinely complying with the Act’s requirements, whether consent is truly free and informed, whether data collection is actually voluntary, and what real remedies are available to consumers whose data is misused or breached. Stricter regulations and their consistent enforcement are the need of the hour.
Equally important is awareness, not just among consumers, but among retailers themselves. Many store owners may be unaware of, or choose to ignore, their obligations under the DPDP Act. Targeted outreach and accountability measures directed at retailers are essential to ensure the law translates from paper into practice.
In conclusion, while the DPDP Act, 2023 marks a significant step forward in protecting digital privacy, its real-world impact on retail data collection remains far too limited. A law built on consent means little when the very environment in which that consent is sought makes genuine, free consent nearly impossible.
*****
Footnotes
1. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 S.C.C. 1 (India).
2. Press Info. Bureau, Gov’t of India, India’s UPI Revolution: Over 18 Billion Transactions Every Month, A Global Leader in Fast Payments (July 20, 2025), https://www.pib.gov.in/PressNoteDetails.aspx?NoteId=154912&Modu leId=3®=3&lang=2.
3. Digital Literacy and the Future of Work: Reflecting and Preparing India’s Youth for the Digital Economy, Times of India(2025), https://timesofindia.indiatimes.com/technology/tech-news/digital-literacy-and-the-future-of-work-reflecting-and-preparing-indias-youth-for-the-digital-economy/articleshow/125830356.cms.
4. Elec. Privacy Info. Ctr., Disrupting Data Abuse: Protecting Consumers from Commercial Surveillance in the Online Ecosystem, Comments on FTC Proposed Trade Regulation Rule on Commercial Surveillance & Data Security, R111004 (Nov. 2022), https://epic.org/wp-content/uploads/2022/12/EPIC-FTC-commercial-surveillance-ANPRM-comments-Nov2022.pdf.
5. Press Info. Bureau, India’s UPI Revolution, supra note 2.
6. Press Info. Bureau, India’s UPI Revolution, supra note 2.
7. Jadyn Powell et al., Smart Grids: A Comprehensive Survey of Challenges, Industry Applications, and Future Trends, 11 Energy Rep. 5760 (2024), https://doi.org/10.1016/j.egyr.2024.05.051.
8. Lukas M.N. Gabriel et al., Investigation of Smart Grid Technologies Deployment for Energy Reliability Enhancement in Electricity Distribution Networks, 10 Franklin Open 100227 (2025), https://doi.org/10.1016/j.fraope.2025.100227.
9. What Are Smart Meters?, IBM, https://www.ibm.com/think/topics/smart-meter (last visited Mar. 1, 2026).
10. Wajahat Ali et al., A Novel Privacy Preserving Scheme for Smart Grid-Based Home Area Networks, 22 Sensors 2269 (2022), https://doi.org/10.3390/s22062269.
11. Why Is Data Privacy Vital for Smart Grids?, Energy Sustainability Directory (Nov. 28, 2025), https://energy.sustainability-directory.com/question/why-is-data-privacy-vital-for-smart-grids/.
12. Press Info. Bureau, Gov’t of India, Cabinet Approves Revamped Distribution Sector Scheme: A Reforms Based and Results Linked Scheme (June 30, 2021), https://www.pib.gov.in/PressReleasePage.aspx?PRID=1731473 ®=3&lang=2.
13. Ministry of Power, Gov’t of India, Guidelines: Revamped Distribution Sector Scheme — Reforms-Based and Results-Linked (July 20, 2021), https://powermin.gov.in/sites/default/files/uploads/Final_Revamped_Scheme_Gu idelines.pdf.
14. Giorgia Guerra, Redesigning Protection for Consumer Autonomy: A Case-Study of Dark Patterns in European Private Law 118 (FrancoAngeli 2023).
15. Sandro Shubladze, How To Make Use Of The New Gold: Data, Forbes (Mar. 27, 2023), https://www.forbes.com/councils/forbestechcouncil/2023/03/27/how-to-make-use-of-the-new-gold-data/.
16. Understand Digital Personal Data Protection Act Principles in India, Wattlecorp (Dec. 22, 2025), https://www.wattlecorp.com/digital-personal-data-protection-act-india/.
17. Handling Smart Meter Data: Privacy Concerns, Preparedness and Safeguards, Prayas (Energy Grp.) (2021), https://energy.prayaspune.org/power-perspectives/handling-smart-meter-data-privacy-concerns-preparedness-and-safeguards.
18. Ishan Yadav & Pranshur Sharma, Consent, Privacy, and Digital Exclusion: A Legal and Statistical Review of India’s Data Governance Regime, Kautilya Soc’y NUSRL (Oct. 4, 2025), https://kautilyasocietynusrl.in/2025/10/ 04/consent-privacy-and-digital-exclusion-a-legal-and-statistical-review-of-indias-data-governance-regime/.