INTRODUCTION
A. Overview of the OTT Industry in India
OTT stands for “Over-The-Top.” It just means getting video content straight through the internet. You don’t need a cable TV box or a satellite dish anymore. You just need a phone or a smart TV and a Wi-Fi or data connection. India is one of the biggest OTT markets in the world right now.1 Here’s how that happened. Back in 2016, telecom companies started offering really cheap mobile data. Before that, internet on your phone was expensive, and people used it carefully. After the price drop, data became incredibly cheap. Suddenly, millions of Indians got online. They bought budget smartphones. And they started watching a lot of videos.
Big companies saw this happening and moved in quickly. Netflix, Amazon Prime Video, and Disney+ Hotstar spent a lot of money to get Indian subscribers. Local platforms like Zee5, SonyLIV, and JioCinema also jumped in. They started making shows in Hindi, Tamil, Telugu, and other regional languages. This was a smart move. It meant that people outside the big metro cities started watching too.
Today, the numbers are huge. India has hundreds of millions of active OTT users. The industry makes billions of dollars every year.2 People use these apps to watch live cricket, new movies, and original web series. It is a massive shift in how the country consumes media.
But this fast growth caused some problems. When an industry gets this big this fast, the law struggles to keep up. OTT platforms handle huge amounts of user data. They also host billions of dollars worth of copyrighted content. And these two things often crash into each other.
For a long time, OTT platforms in India did not have strict rules. Cable TV had specific acts. Movie theaters had the censor board. But OTT apps were just floating on the internet. They fell under the Information Technology Act, 2000. Under this law, they were treated mostly as “intermediaries.” That meant they were just providing a platform, kind of like a digital highway. They weren’t always held responsible if someone used their platform to do something wrong, as long as they followed certain basic rules.
But the government noticed how much influence these platforms had. In 2021, they brought in new IT Rules.3 This changed things. Now, OTT platforms have to follow specific codes of ethics. They have to classify their content by age. They have to set up systems to handle user complaints. Basically, the government told them they need to take more responsibility for what happens on their apps. This regulatory shift matters because it shows the government is paying close attention to how these platforms operate and handle data.
B. Evolution of Digital Content Consumption
Now, let’s look at how the way we watch things has changed over time. The way we watch movies today is completely different from just ten or fifteen years ago.
Think back to the 1990s and early 2000s. If you wanted to watch a movie at home, you turned on the television. You had to check the TV guide. If a movie started at 8:00 PM, you had to be on your couch at 8:00 PM. You also had to sit through long commercial breaks. The broadcaster had total control over your schedule.If you wanted more choices, you went to a video rental store. You paid for a VHS tape or a DVD, took it home, and had to return it a few days later. It was a physical process. Copyright protection in this era was also physical. It was hard to make a perfect copy of a VHS tape. If you did, the quality was usually bad. So, mass piracy was difficult for the average person.
Then the internet changed things. In the late 2000s, fast broadband became common. People figured out how to compress movie files into smaller sizes. This led to the era of illegal downloading. Websites like The Pirate Bay and various torrent sites became hugely popular. If you wanted a movie, you just downloaded it for free. This was a nightmare for copyright owners. They were losing millions of dollars because digital files could be copied perfectly, millions of times, with zero cost.
The law tried to fight back. Courts issued orders to block these torrent websites. But it was like a game of whack-a-mole. You block one site, and three new mirror sites pop up the next day. The traditional copyright laws, written for physical books and tapes, were struggling to work on the internet.
Then streaming arrived and offered a solution. Platforms realized something important. Most people don’t actually want to steal content. They just want convenience. If you make it easy and cheap to watch a movie legally, people will pay for it. Streaming gave users a massive library of content for a small monthly fee. You didn’t have to wait for downloads. You didn’t risk getting computer viruses from shady torrent sites.
This business model worked. It changed consumer habits. People stopped downloading and started streaming. The COVID-19 pandemic in 2020 pushed this even further. Theaters shut down completely. People were locked in their homes for months. OTT platforms became the main source of entertainment.4 Major Bollywood and regional movies started releasing straight to digital platforms, skipping the cinemas entirely.
But the problem is that while streaming reduced casual piracy, it didn’t kill it. In fact, it created new types of piracy. Hackers figure out how to rip high-quality video streams directly from the OTT platforms. They then upload these files to illegal streaming sites or share them on apps like Telegram.
To fight this, OTT platforms use heavy technology. They use Digital Rights Management, or DRM.5 This is code built into the video player that stops you from recording your screen. They also use forensic watermarking. This puts a hidden, invisible code on the video. If the video leaks online, the platform can read the watermark and see exactly which user account was used to steal it.
And that is exactly where the main problem of this dissertation begins. To make these anti-piracy tools work, the platform has to monitor you. They track what you watch, what device you use, your IP address, and your account details. They gather massive amounts of personal data to ensure you aren’t stealing their copyright.
So, the evolution of digital consumption brought us to a tough spot. We moved from physical tapes to online streams. This made watching movies better for everyone. But it also means that simply watching a movie at home now involves a complex web of data tracking. The creators want their copyright protected. The users want their privacy respected. Both rights are important, but right now, they are clashing.
C. Statement of the Problem
India has a massive legal clash happening right under our noses. On one side, we have copyright law. Creators and OTT platforms like Netflix, Amazon Prime, and Hotstar spend billions making movies and shows. Naturally, they want to stop people from stealing this content. To catch digital pirates, these platforms use tracking tools. They monitor IP addresses, track what you watch, and use background software to trace leaked videos back to a specific user.
But here’s the problem. Tracking users this closely creates a massive privacy issue. India recently passed the Digital Personal Data Protection (DPDP) Act in 2023. This law gives users the right to keep their data private. It says companies cannot just collect and process your personal data without a really good reason or your clear consent.
So, we have two legal rights fighting each other. OTT platforms say they have a “legitimate use” to track data because they are fighting a crime—copyright infringement. But privacy advocates argue that mass surveillance of innocent users just to catch a few pirates is illegal.
Let’s look at an example to show why this is complicated. Imagine you are watching a new movie on a streaming app. To stop you from recording the screen, the app runs background software. This software might track your device ID, your location, and your network details. Under the Copyright Act of 1957, the platform is just protecting its property.6 But under the DPDP Act, your device ID and location are personal data.7If the platform shares this data with third-party anti-piracy agencies without asking you, that is a privacy breach.
The situation gets worse when we look at how the government handles internet companies. The Information Technology Act, 2000 says platforms have to take down illegal content quickly to avoid getting sued.8To do this, they set up automated filters. These filters constantly scan data. This means the law is basically forcing OTT platforms to spy on their networks to stay out of trouble.
And that’s why it matters. Our current legal framework treats privacy and copyright as two separate things. They don’t talk to each other. When a judge issues a “John Doe” order or a dynamic injunction to block a piracy website, internet providers have to hand over user data. A judge dealing with a copyright lawsuit rarely stops to ask if the data used to find the pirate was collected illegally.
This leaves everyday users caught in the middle. We are moving toward a system where you have to give up your right to privacy just to watch a movie online. Therefore, the core problem is the lack of a unified legal standard in India that dictates exactly how much personal data can be processed to enforce a copyright claim on an OTT platform.
THE LEGAL INTERFACE OF PRIVACY AND IPR
A. Conceptualizing the Right to Privacy in the Digital Age
Long ago, privacy was simple. It basically meant keeping people out of your house. Two famous
lawyers, Warren and Brandeis, called it the right to be let alone.9 If you shut your door and closed your blinds, you had privacy. No one could see what you were doing.But here’s the problem. We do not just live in physical houses anymore. We live online. We live on our phones, our laptops, and our smart TVs.When you open an app to watch a movie, you are not alone. The app watches you back. This is where digital privacy starts. It is completely different from physical privacy. A locked door stops a physical person from entering your room. But it does not stop an application from tracking what you do inside your own home.
So here is what happened in India. For a long time, the law was not very clear about privacy. We had older Supreme Court cases like Kharak Singh.10 That case was mostly about the police knocking on people’s doors in the middle of the night. The judges back then looked at the Constitution and said privacy was not explicitly written down as a guaranteed right.But the world kept changing. The internet arrived. People started putting their entire lives online. We started doing our banking, talking to our friends, and watching our entertainment through digital networks. The old rules simply did not make sense anymore.Then came 2017. This was a massive year for Indian law. The Supreme Court decided the Puttaswamy case.11 Nine judges sat down to figure out if we actually have a right to privacy. And they said yes. They made it very clear. Privacy is a fundamental right. It is a natural part of the right to life and personal liberty under Article 21 of the Constitution.12
B. Understanding Copyright in the OTT Ecosystem
Here’s the thing about copyright in the digital world. It is completely different from how it used to work just ten or fifteen years ago. Back then, if you wanted to watch a movie at home, you went to a store and bought a DVD. You owned that physical plastic disc. The movie studio held the copyright, which meant they had the exclusive right to make and sell those physical copies. It was a very simple transaction.But then the internet changed everything. Platforms like Netflix, Amazon Prime, and Disney+ Hotstar came along and completely shifted how we consume media. You no longer buy a copy of a movie. Instead, you pay a monthly fee for a license to stream it directly to your screen. And that is where the legal mechanics of copyright get really interesting.
To understand how this works, we have to look at the basic law. In India, copyright is governed by the Copyright Act of 1957. Section 14 of this Act defines what a copyright actually is.13 It is not just one single right. It is a bundle of exclusive rights given to the creator or the owner of a work. For a movie, which the law formally calls a “cinematograph film,” this bundle includes the right to make a copy of the film, the right to sell or rent it, and most importantly for our topic, the right to communicate the film to the public.14This specific phrase—”communication to the public”—is the absolute core of the OTT ecosystem. Under Section 2(ff) of the Act, communicating to the public means making any work available so that people can see or hear it.15 In the context of OTT platforms, this means they are hosting the movie on their servers and allowing you to access it from your laptop or phone at a time and place that you choose. They aren’t selling you a reproduction of the film. They are just communicating it to you.
So here’s what happened when streaming became popular. The legal focus shifted away from the right of reproduction and moved heavily toward the right of communication.But here’s the problem. A movie or a web series is not just one single piece of property. It is actually a massive collection of different copyrighted works all layered on top of each other. Think about a typical Bollywood movie streaming on an OTT platform. The script that the actors are reading is protected as a literary work. The background score is protected as a musical work. The songs have their own sound recording copyrights. And the final edited video itself is protected as a cinematograph film.This means that before a platform like Netflix can legally stream a movie to your phone, they have to make sure they have the legal permission for every single one of those underlying rights. If they miss even one—say, they didn’t get the rights from the music composer—they are committing copyright infringement.
This can help you understand how OTT platforms actually acquire their content. They generally do it in two ways.
First, they license content. This is when an OTT platform goes to a traditional production house and pays them for a digital distribution license. The production house still owns the movie, but they give the OTT platform the right to stream it for a specific number of years. In this scenario, the platform is acting purely as a digital distributor.
Second, they make their own original content. Think of shows like Sacred Games on Netflix or Mirzapur on Amazon Prime. In these cases, the OTT platform acts as the actual production house. They hire the writers, the directors, and the actors. Under Section 17 of the Copyright Act, when a person or a company commissions a cinematograph film and takes the financial risk to make it, they are considered the first owner of the copyright.16 The platform is the legal “author” of the work.17 They own it entirely.And that’s why it matters so much to them. These platforms spend billions of dollars creating these original shows. Because they are the outright owners, they hold the entire financial risk. If someone steals their show, they lose a massive amount of money.
This brings us to the dark side of the OTT ecosystem: piracy.
Piracy used to involve a lot of effort. People had to burn blank CDs and sell them on the street. Today, digital piracy is incredibly easy. Because OTT platforms stream high-quality digital files directly to a user’s device, a pirate just needs basic screen-recording software to rip a perfect copy of a brand-new movie the minute it is released. They can then upload it to a Telegram group or a torrent website in a matter of minutes.
To fight back against this, OTT platforms rely heavily on technology. They use something called Digital Rights Management, or DRM. DRM is essentially a set of digital locks and encrypted codes built into the streaming video. It tries to stop you from downloading the video file or recording your screen while the video is playing.
The Indian government realized that traditional copyright law wasn’t enough to handle these digital locks. So, in 2012, they amended the Copyright Act to catch up with technology.18 They added two very important sections. Section 65A makes it a strict legal offense to bypass or break these digital locks.19 If a pirate uses software to crack the DRM on an Amazon Prime video, they are breaking the law under this section, even before we talk about the actual theft of the movie.
They also added Section 65B, which protects “Rights Management Information.”20This is basically the hidden digital watermarks that platforms embed into their video streams. These watermarks carry data about who owns the video and, in some cases, which specific user account is streaming it. If someone rips a movie and puts it online, the OTT platform can use that hidden watermark to track exactly where the leak came from.
This might work really well for the platforms. It helps them track down pirates and protect their massive investments. They have every legal right to secure their property.
But here is where the entire system crashes into the issue of user privacy.
To make DRM and forensic watermarking actually work, the OTT platform has to collect data. They cannot protect their copyright in a vacuum. To spot abnormal viewing patterns, to track down which user account leaked a video, and to enforce geographic viewing restrictions, the platform has to monitor you. They need to log your IP address, your device ID, your location, and your exact viewing habits.The law gives them the right to protect their films. But to enforce that right, they have to constantly surveil their users. The system requires them to act like digital private investigators. And that creates a massive legal friction point. The very tools that the Copyright Act allows platforms to use to stop piracy are the exact same tools that can easily violate a user’s right to privacy under the new digital data protection laws. You cannot have perfect copyright enforcement without compromising user anonymity.So here’s what we are left with. The OTT ecosystem relies entirely on the digital transmission of copyrighted works. Protecting those works is legally necessary. But doing so requires an invasive level of data collection that the law never truly anticipated back in 1957.
C. Impact of the Digital Personal Data Protection (DPDP) Act, 2023 on IP Enforcement
OTT platforms want to stop people from stealing their movies and shows. To do this, they have to watch what their users are doing online. But in 2023, India passed the Digital Personal Data Protection (DPDP) Act.21 This new law says companies cannot just collect user data however they want. And that creates a massive legal headache for copyright enforcement.For a long time, the internet was a bit of a free-for-all. If someone owned a copyright, they did whatever they needed to do to protect it. Now, privacy is a fundamental right.22 The DPDP Act forces platforms to change how they catch pirates. This section looks at exactly how this new privacy law clashes with the old ways of stopping copyright theft.
Tracking Tech vs. User Privacy
This can help you understand the conflict. Think about how a streaming site works. Let’s say a platform releases a highly anticipated new Hindi web series or an exclusive Bhojpuri movie. People will try to pirate it. To stop this, the platform uses tools like Digital Rights Management (DRM) and invisible digital watermarks. These tools do not just lock the video file. They track information. They log your IP address, your device ID, and your viewing habits. They check if you are trying to use screen-recording software. All of this is considered “personal data” under the DPDP Act. Before 2023, platforms collected this data without thinking twice. It was just part of doing business. Now, the rules have changed. An OTT platform is a “Data Fiduciary.” This means they are legally responsible for how they handle your personal information. They cannot just track your device in the background without following strict legal rules. And this makes catching copyright infringers much harder.
The Consent Trap
The main rule of the DPDP Act is consent. Section 6 of the Act says a platform needs clear, free, and specific consent to process your personal data.23So here’s what happens. When you sign up for a streaming app, you have to click “I agree” to their terms of service. Deep in those terms, it says they will track your device to prevent piracy. But is that consent really free? If you refuse to let them track your device, they will not let you use the app. You won’t be able to watch the movie you paid for. This is called bundled consent. The platform is tying the service to your agreement to be tracked. The DPDP Act tries to stop companies from forcing users to give up unnecessary data just to use a service. But platforms argue that tracking is necessary. They say they cannot provide the service at all if they cannot protect their copyrighted videos. The law is still a bit blurry here. It is not completely clear if platforms can legally deny you service just because you refuse to be tracked for anti-piracy reasons.
The “Legitimate Use” Argument
But platforms have a backup plan. Section 7 of the DPDP Act talks about “Certain Legitimate Uses.”24 This means sometimes a company does not need your direct consent to process your data. For example, a hospital doesn’t need your consent in a medical emergency. The government doesn’t need it to provide a state benefit. And crucially, there are exceptions for dealing with fraud and corporate disputes. Here is where the real legal fight happens. Does copyright infringement count as a legitimate use? OTT platforms will say yes. They will argue that piracy is a form of theft. Therefore, they have a legitimate right to process user data without asking for permission, simply to protect their property from being stolen.25Privacy advocates see this differently. They argue that watching a pirated show is illegal, but it does not give a private streaming company the right to act like the police. They argue that the “legitimate use” loophole should be kept small. If platforms can use this excuse to track everyone, then the consent rule becomes useless.
Data Minimization and Sharing Data
There is another big rule in the DPDP Act. It is the idea of data minimization. This basically means a company should only collect the data it actually needs, and keep it only for as long as it needs it. This is a major problem for anti-piracy efforts. To find the 1% of users who are pirating content, an OTT platform basically has to monitor the other 99% of normal users. They log everyone’s IP addresses and device data just in case someone steals a movie. Is that data minimization? Probably not. Collecting everyone’s viewing data on the off chance someone breaks a copyright law goes against the whole spirit of the privacy act. And then there is the issue of sharing data. To actually catch a pirate, the OTT platform often has to share the suspicious IP address with an Internet Service Provider (ISP) or a third-party anti-piracy agency. They need to do this to find out the real name of the person behind the screen. Under the DPDP Act, sharing data with third parties requires strict legal agreements. If an OTT platform hands over your viewing data to an outside agency, they need your consent for that specific transfer. They cannot just pass your personal information around to different companies just to enforce their copyright.
JUDICIAL TRENDS
A. The Evolution of “John Doe” (Ashok Kumar) Orders in India
Let’s talk about how the law deals with people it can’t identify. Imagine you make a movie. You spend millions on it. Then someone starts selling copies on the street. You want to stop them. You want to sue them. But here’s the problem: you have no idea who they are. They don’t wear name tags. This is a big issue for copyright law. Normally, you need a name to file a lawsuit. You can’t just sue “that guy over there.” But the courts realized this was unfair to creators. So they came up with a fix. It’s called a “John Doe” order. In the US and UK, they use the name John Doe for someone they don’t know. In India, we call it an “Ashok Kumar” order. It means the court gives you an order to stop the copyright theft, even if you don’t know the thief’s actual name yet. You can fill in the name later when you catch them.
Here’s how it started in India. We have to go back to 2002. There was a case called Taj Television.26 Taj TV had the rights to show the FIFA World Cup. But local cable operators were just taking the feed and showing it without paying. Taj TV didn’t know the names of all these small cable guys. There were hundreds of them. So, the Delhi High Court stepped in. They issued the first Ashok Kumar order in India. They said Taj TV could search the premises of these unknown cable operators and stop them. And that’s why it matters. It gave broadcasters a weapon to fight back when the enemy was faceless. But then things changed. We moved from cable TV to the internet. And things got messy. Instead of a guy climbing a pole to steal a cable signal, you had people sitting in their bedrooms uploading movies. The internet is built for anonymity. People hide behind fake names, VPNs, and proxy servers.
So, movie studios and OTT platforms started asking for Ashok Kumar orders against websites. If a big movie was coming out, the producers would go to court before it even released. They would say, “We know people are going to pirate this movie. We don’t know who they are. Please order the ISPs to block these websites right now.” This is called a quia timet action—acting because you fear something bad will happen. And the courts did it. They started handing out these orders left and right. But here’s the problem with that. It led to massive over-blocking. Let’s say a court issues an Ashok Kumar order against a specific pirate. The Internet Service Provider (ISP) like Jio or Airtel gets the order. They are supposed to block the infringing content. But ISPs usually don’t have the time or technical skill to block one specific webpage. So, they block the entire website. Imagine if someone posted a pirated movie on a blog. The ISP wouldn’t just block the movie post. They would block the whole blog platform. Millions of innocent people would lose access to their own legal content just because one person did something wrong. This happened a lot. In 2011, Reliance Big Pictures got an order to protect the movie Singham.27 The order was so broad that ISPs ended up blocking file-sharing sites that millions of businesses used for normal, legal work. This brings us to the privacy issue. This is the core of the conflict. To enforce an Ashok Kumar order on the internet, you eventually have to figure out who the person is. How do you do that? You have to track their IP address. You have to ask the ISP to hand over the user’s data. And this is where copyright bumps into privacy. The OTT platforms want the user data to sue the pirates. But the users have a right to privacy. Even bad guys have privacy rights until proven guilty. When a court orders an ISP to hand over user logs, it exposes a lot of personal information. It shows what websites they visit, when they log on, and where they live. If an OTT platform suspects you of pirating, should they be allowed to see your entire internet history? That’s a scary thought. The courts started to realize this was getting out of hand. They saw that Ashok Kumar orders were being misused. Plaintiffs were just bringing lists of hundreds of websites and asking judges to block them all without any real proof.
So, the courts put in some rules. In the Star India case, the court said plaintiffs have to provide specific URLs, not just whole websites.28 If the pirated video is on page five, block page five. Don’t block the whole site. This was a good step. But it was too slow. By the time a studio found the specific URL, went to court, and got it blocked, the movie had already been downloaded a million times. The pirates were moving too fast. And this leads us to the next big thing.
B. Dynamic Injunctions: Balancing Creator Rights with Net Neutrality
Let’s look at what happened next. Pirates are smart. If a court blocks their website, they don’t just give up. Here’s what they do. They create a “mirror” website. A mirror website is an exact copy of the blocked site. It has all the same pirated movies. It looks exactly the same. The only difference is the web address. If the court blocks “piratemovies.com”, the pirate just buys “piratemovies.net”. They can set this up in ten minutes. This is called the hydra effect. You cut off one head, and two more grow back. For OTT platforms, this was a nightmare. They would spend months getting a court order to block a site. The ISP would block it. And the next day, the pirates were back at a new address. The OTT platform would have to go back to court and start all over again. The law couldn’t keep up with the speed of the internet. So, the courts had to invent something new. This is where “Dynamic Injunctions” come in. The biggest case for this in India was in 2019. It was UTV Software Communication against a site called 1337X.TO.29 UTV Software was tired of playing whack-a-mole with pirates. They went to the Delhi High Court. They pointed out that places like Singapore and the EU were using dynamic injunctions. The Delhi High Court agreed to try it. Here’s how it works. A dynamic injunction is an order that updates itself. The court looks at a main pirate website. Let’s call it the “rogue website.” The judge says, “Yes, this site exists just to break the law. ISPs, block it.” But the order goes a step further. The judge says, “If this rogue website creates any new mirror websites in the future, the plaintiff doesn’t have to come back to me for a new order.” Instead, the OTT platform just files an affidavit with a court clerk (the Joint Registrar). They say, “Hey, that site you blocked just moved to this new address.” The clerk checks it, and if it matches, they tell the ISP to block the new address immediately. It skips the long court hearings. It makes blocking fast. This was a huge win for copyright owners. But here’s the catch. And it’s a big one. When you give private companies the power to order website blocks without a judge checking every single one, things go wrong.
This brings us to Net Neutrality. Net Neutrality is a simple idea. It means all internet traffic should be treated equally. Your ISP shouldn’t slow down a website just because they don’t like it. The internet is supposed to be an open road. When you have dynamic injunctions, you put roadblocks on that open road. And the people deciding where to put the roadblocks aren’t always judges anymore. They are the lawyers for the OTT platforms and the tech guys at the ISPs. This is a dangerous shift. When an OTT platform tells an ISP to block a new mirror site, who is making sure it’s actually a mirror site? What if the OTT platform’s automated software makes a mistake? What if they tell the ISP to block a website that is completely legal, just because it has a similar name? This happens all the time. An automated system flags a website by mistake. And suddenly, a legitimate business is wiped off the internet in India. Nobody went to a judge to argue about it. This clashes hard with Net Neutrality. Net Neutrality says ISPs shouldn’t interfere with traffic. But dynamic injunctions force ISPs to become internet police. ISPs don’t want to get sued by big movie studios. So if an OTT platform says “block this,” the ISP usually just blocks it. They don’t investigate. They just want to protect themselves. Let’s talk about the technical side of blocking for a second, because it shows how bad the collateral damage can be. When an ISP blocks a site, they often block the IP address. But because of how the internet works, hundreds of completely different websites can share the exact same IP address on a shared server. So, if a pirate sets up a mirror site on a shared server, and the ISP blocks that IP address, they don’t just block the pirate. They block every single website on that server. You could have a local bakery’s website blocked because it happens to share server space with a pirate movie site. Now, let’s tie this back to privacy, which is the main theme of your dissertation. Dynamic injunctions require constant monitoring. OTT platforms have to constantly scan the internet to find these new mirror sites. They use automated software and AI bots to do this. These bots are constantly crawling the web. They are looking at what files are being shared and where they are being hosted. In doing so, they are collecting massive amounts of data. In some cases, they join BitTorrent networks and record the IP addresses of everyone downloading the movie. This creates a massive surveillance machine. And remember the Digital Personal Data Protection (DPDP) Act of 2023. That law is supposed to protect user data. It says companies should only collect the data they absolutely need. But how can an OTT platform enforce a dynamic injunction without monitoring massive amounts of internet traffic? They can’t. So we have a conflict. The copyright law says, “Track down the pirates and block their new sites.” The privacy law says, “Don’t monitor people’s internet use without their consent.” The UTV Software case tried to put some safeguards in place. The judge said we shouldn’t block websites just because they have a little bit of pirated stuff. The site has to be a “rogue website.” The judge also said that if a legitimate website gets blocked by mistake, the owner can come to court and ask to be unblocked. But think about how unfair that is. A small blog gets blocked by mistake because of a massive OTT platform’s automated system. Now the small blog owner has to hire a lawyer, go to the High Court, and fight to get their site back online. Most people can’t afford that. So they just stay blocked. You are punished first, and you have to prove your innocence later. This is the balance we are struggling with. We want to protect creators. If OTT platforms can’t make money because everything is pirated, they will stop making good shows. That’s a fact.But we also want to protect the open internet. We want our privacy. Dynamic injunctions are currently the best weapon we have against digital piracy. But they are a blunt instrument. Right now, the law favors the copyright owners. The courts are trying to help them fight a war against anonymous enemies. But in doing so, they are letting the internet become a much more monitored and restricted place for everyone else. As you move into the next chapters of your research, the big question is how to fix this clash between tracking pirates and respecting the DPDP Act.
C. Case Study: UTV Software Communication Ltd. v. 1337X.TO and others
Here’s the problem with online piracy. It moves too fast for traditional courts. For a long time, content creators and OTT platforms in India played a losing game. You make a movie. You put it on a platform. Someone steals it and puts it on a website. You go to court, spend money, and get an order to block that specific website URL. But by the time the internet service providers block that site, the pirate has already created a new one. They just change the domain name slightly. If the blocked site was “piratemovie.com,” they just move everything to “piratemovie.net.” This is called a mirror site. And the legal process had to start all over again.
This was the situation before a major legal case changed everything. This section looks closely at the case of UTV Software Communication Ltd. v. 1337X.TO30 and a few others that followed it. These cases changed how copyright is protected in India. But they also created huge questions about your privacy on the internet.31
The Whack-a-Mole Problem
Before we look at the UTV case, you need to understand how injunctions used to work. An injunction is just a court order telling someone to stop doing something. Under the Indian Copyright Act of 1957,32 if someone stole your movie, you could ask the court for an injunction to block them. Most of the time, creators did not know the real names of the people running these pirate sites. They are anonymous. So, Indian courts started issuing “John Doe” orders. In India, these are called “Ashok Kumar” orders.33 You sue the unknown person, and the court tells internet service providers like Jio or Airtel to block the website. But this was not enough. The internet is fluid. Pirates use alphanumeric variations to create mirror sites instantly. It was like playing whack-a-mole. You hit one, and another pops up. OTT platforms were losing millions of rupees because the legal system was too slow to catch a simple URL change.
Enter the UTV Software Case
So here’s what happened in 2019. UTV Software, a major media company, was fed up. They filed a lawsuit in the Delhi High Court. They sued several massive pirate websites. One of the main ones was 1337X.TO. This site was famous for sharing movies, shows, and software using BitTorrent. UTV told the court that normal blocking orders were useless. They needed a new weapon. They asked the court to look at what other countries were doing. Places like Singapore and the European Union were already using a new legal tool. It was called a “dynamic injunction.” The Delhi High Court had a big job to do. They had to figure out how to protect copyright without breaking the internet or blocking legal content by mistake. Justice Manmohan wrote the judgment. It is one of the most important decisions for digital copyright in India.
Defining a Rogue Website
The first thing the court did was create a test. They needed a way to separate a mostly legal website from a website built just for piracy. The court called these bad sites “rogue websites.” How do you know if a site is rogue? The court gave a checklist. First, they look at the main purpose of the site. Does it mostly host illegal files? Second, does the site ignore takedown notices? Third, does the site hide who owns it? Fourth, does the site provide instructions on how to bypass network blocks? If a website ticks these boxes, it is a rogue website. The court found that 1337X and the other sites in the case were definitely rogue websites. They existed purely to share stolen copyright material. They hid their ownership details. They made money from ads placed next to stolen movies.
The Birth of the Dynamic Injunction
Once the court decided these were rogue websites, they did something completely new for India. They issued a dynamic injunction. Here’s how it works. Normally, if a court issues a block order for a URL, that order is final. If a new URL pops up, the plaintiff has to file a brand new legal application. They have to get a new hearing. The judge has to look at it again. This takes days or weeks. The dynamic injunction changed the rules. The court said that UTV could come back to the court if the pirates created mirror sites. But they did not have to file a new case. They did not even have to go in front of the judge. They could just file an application with the Joint Registrar of the court. The Joint Registrar is an administrative officer.
UTV could show the Joint Registrar that a new URL was just a mirror of the old, blocked URL. If the Registrar agreed, they would simply add the new URL to the existing court order. The internet service providers would then have to block the new URL immediately. This was a massive win for content creators. The legal process finally caught up with the speed of the internet. If a pirate made a new site on Tuesday, UTV could get it blocked by Wednesday using the same original court order.
The OTT Ecosystem and “And Others”
This ruling was exactly what OTT platforms needed. Netflix, Amazon Prime, Disney+ Hotstar, and others rely on exclusive content. If a show leaks, they lose subscribers. The UTV case set a precedent that these platforms started using heavily. This brings us to the “and others” part of this case study. After UTV, courts started handing out dynamic injunctions regularly. A major example is the case of Star India Pvt. Ltd. v. 7Movierulz.tc.34 Star India owns the rights to broadcast many live sports events, including cricket. Live sports are different from movies. A movie has value for years. A live cricket match loses all its value the second the match ends. If a pirate site streams a live match, Star India cannot wait weeks for a court order. They need the site blocked right now. In cases involving Star India and other broadcasters, the courts took the dynamic injunction a step further. They started issuing these injunctions even before the pirate sites actually did anything. If an OTT platform could show a list of websites that usually pirate live matches, the court would issue a preemptive block. And if new websites popped up during the actual live broadcast, the OTT platform could notify the internet service providers directly to block them, and tell the court about it later. This is incredibly powerful. The OTT platforms basically got the power to dictate internet blocks in real-time during a broadcast.
But Here’s the Problem: The Privacy Cost
This sounds great for copyright. But we have to talk about privacy. This is where the core conflict of your research lies. When courts issue these sweeping dynamic injunctions, someone has to enforce them. That job falls to the internet service providers (ISPs). ISPs are companies like Jio, Airtel, and BSNL. To block a specific URL, especially a dynamic one, the ISP has to look at the internet traffic of its users. Think of the internet like a post office. In the old days, ISPs only looked at the outside of the envelope to see where your data was going. But pirates started using encryption. They started hiding the URLs. So, to enforce a dynamic injunction, ISPs sometimes have to use a technology called Deep Packet Inspection (DPI).35
Deep Packet Inspection is exactly what it sounds like. The ISP opens the envelope. They look at the actual data packets you are sending and receiving to see if you are trying to access a blocked mirror site. This is a massive privacy issue. To catch a few people downloading a pirated movie, the ISP has to scan the traffic of millions of normal users. They have to monitor where you go and what you request. The UTV judgment was great for stopping pirates, but it completely ignored the collateral damage to user privacy.
The Anonymity Conflict
There is another massive problem. These pirate sites are anonymous. The people using them are also anonymous. When a court orders an ISP to block a site, the copyright owner sometimes wants more. They want to know who is running the site. They want to know who is uploading the files. So, the courts often order ISPs to hand over the IP addresses and personal details of the people connected to these rogue websites.
This forces the ISP to keep detailed logs of user activity. The new Digital Personal Data Protection (DPDP) Act of 202336 says companies should only collect data they absolutely need. This is the principle of data minimization. But dynamic injunctions demand the opposite. They demand maximum data collection. ISPs have to log everything just in case a court asks for it later to track down a pirate.
The Chilling Effect
There is also something called a chilling effect. When users know their internet provider is actively monitoring their traffic to block dynamic URLs, they change their behavior. They feel watched. Sometimes, courts block entire platforms just because a small part of it hosts pirated content. If a legitimate user is using a cloud storage site for their personal work, and that site gets dynamically blocked because someone else used it for piracy, the innocent user suffers. Their data is locked away. Their privacy is breached because they were caught in the crossfire of a copyright war. The UTV case did not address this balance. Justice Manmohan’s judgment was focused heavily on the economic harm caused by piracy. It did a brilliant job of explaining how pirates operate. It gave a very clear test for what a rogue website is. But it treated the internet as just a distribution network. It forgot that the internet is also a private space for billions of people.
OTT Platforms as Private Police
Because of the UTV case, OTT platforms have become a sort of private internet police. They have teams of people scanning the web 24/7. They use automated software to find new mirror sites. They compile lists and send them to the Joint Registrar or directly to the ISPs. This means private companies are essentially deciding what parts of the internet Indian citizens can and cannot see. Yes, the court signs the initial order. But the day-to-day updating of the block list—the “dynamic” part—is driven by the OTT platforms.
This lacks transparency. If an OTT platform makes a mistake and adds a legitimate website to their block list, who holds them accountable? The burden falls on the innocent website owner to go to court and prove they are not a pirate. This is backwards. And from a privacy standpoint, these OTT anti-piracy teams are scraping massive amounts of data from the web. They are tracking IP addresses. They are monitoring social media groups where people share links. They are building profiles of how piracy networks operate. All of this involves processing personal data. Under the DPDP Act, processing personal data usually requires consent. OTT platforms argue they do not need consent because stopping a crime is a “legitimate use.” But where is the line? Can an OTT platform track your personal WhatsApp group if they think you are sharing a Netflix password or a movie link? The UTV judgment leaves this door wide open.
The Future of Dynamic Injunctions
The UTV case was decided in 2019. The internet has changed since then. Pirates are getting smarter. They use virtual private networks (VPNs) and decentralized networks to hide their tracks. To keep up, copyright owners are asking for even broader injunctions. They want to block VPN servers. They want to block secure DNS resolvers. If courts agree to this, the privacy impact will be catastrophic. Blocking a VPN server does not just stop a pirate. It stops journalists, activists, and everyday people who use VPNs to protect their privacy on public Wi-Fi. This is the real legacy of the UTV Software case. It solved a massive headache for the entertainment industry. It gave them a tool that actually works. But it did so by sacrificing the privacy of the network. It normalized the idea that ISPs should actively monitor internet traffic and maintain block lists that change every day based on the demands of private corporations. As you research this topic, you have to look at the tension between these two legal realities. On one side, you have the Copyright Act and the UTV judgment saying we must track and block pirates at all costs. On the other side, you have the fundamental right to privacy and the DPDP Act saying we must minimize tracking and protect user data. Right now, in India, copyright is winning that fight. The challenge for the future is finding a way to protect a movie on Hotstar without having to read the digital mail of everyone in the country. We need a system that targets the pirate without putting the entire internet under surveillance. Until we find that balance, dynamic injunctions will remain a very effective, but very dangerous, legal too
CONCLUSION AND RECOMMENDATIONS
A. Summary of Research Findings
We have looked at a lot of laws, court cases, and technologies over the course of this research. The goal was to figure out what happens when the right to protect a movie collides with the right to keep your personal data safe. Here is what the author found.
First, the internet completely changed the business of entertainment. In the past, you bought a ticket to a theater or bought a DVD. Your relationship with the movie ended there. Nobody knew what parts you skipped or how many times you watched it. Today, OTT platforms like Netflix, Amazon Prime, and Disney+ Hotstar operate differently. They stream content directly to your phone or TV. And because it is digital, it is very easy to steal. Pirates can record the screen and put the movie on a free website in minutes. To stop this, OTT platforms had to become tech companies, not just movie studios. They use heavy surveillance to protect their content.37 This is the first major finding. The technology used to stop piracy is inherently invasive. Platforms use Digital Rights Management (DRM). DRM is software built into the app. When you open a streaming app, the DRM software immediately scans your device. It checks if your phone has been modified or “rooted.” It checks what other apps you have open. It blocks you from taking screenshots. It constantly talks to the platform’s servers to report what you are doing. Another tool they use is forensic watermarking. This is an invisible code placed over the video. You cannot see it. But if you record the movie and upload it to a pirate site, the OTT platform can download that pirated copy, scan the invisible code, and trace it back to your specific user account. This means the platform is tying your real identity, your credit card, and your IP address to every single frame of video you watch. This is a massive amount of personal data collection, all justified in the name of stopping copyright theft.
The second major finding is about how the courts in India have reacted to piracy. The courts are tired of pirates getting away with it. Because pirates use fake names and hide their servers in other countries, normal lawsuits do not work. So, Indian courts created some very aggressive legal weapons. The biggest one is the dynamic injunction38 The author found that dynamic injunctions are great for copyright owners but terrible for internet privacy. A dynamic injunction allows a movie studio to get a court order to block a pirate website. But if the pirate simply changes the website address slightly—creating a mirror site—the movie studio does not have to go back to the judge. They just give the new address to an administrative officer, and the internet service providers (ISPs) have to block it immediately.
This leads to the third finding. To enforce these fast blocking orders, ISPs like Jio and Airtel have to watch what their users are doing. They cannot just block a website name. They have to inspect the data packets moving through their networks. This is called Deep Packet Inspection (DPI) 39 Imagine the post office opening every single envelope to make sure you aren’t mailing a stolen book. That is what ISPs do to your internet traffic to find out if you are trying to visit a blocked pirate site. They are looking at the digital traffic of millions of innocent people just to stop a few people from downloading a movie. This is a clear breach of privacy, but the courts currently allow it because stopping piracy is seen as more important.
The fourth finding relates to the new privacy law in India. India recently passed the Digital Personal Data Protection (DPDP) Act of 2023.40 This law is supposed to protect your data. It says companies cannot take your personal information without your clear consent. You have to say yes. And you have the right to ask them to delete your data later. But here’s the thing. The DPDP Act has exceptions. It allows companies to process your data without your consent for certain “legitimate uses.” The author found that the OTT platforms and copyright owners can easily use this exception. They can argue that they must track your IP address and device data to prevent the crime of copyright infringement. Because of this, the new privacy law might not actually stop OTT platforms from spying on you. The law gives them a massive loophole. If they say they are doing it to protect their property, the privacy rules suddenly become very weak.
The final finding comes from comparing India to the rest of the world. The research showed that India is currently unbalanced. If you look at the United States, they use a system called the Digital Millennium Copyright Act (DMCA).41 It relies on “notice and takedown.” A copyright owner finds a stolen video, sends a notice, and the website takes it down. The US system focuses on deleting the file, not permanently monitoring the user.
India is not doing this. The author found that Indian courts are moving toward a “notice and stay-down” system. They want ISPs and platforms to actively filter and block content forever. They want proactive policing. But India does not have the strong privacy safeguards of the GDPR to balance this out. So, right now, Indian law heavily favors the copyright owner. The privacy of the normal internet user is treated as collateral damage. The legal system has basically decided that catching a pirate is worth reading everyone’s digital mail.
B. Identification of Legal Gaps in the Indian Regime
Finding out what the law says is only half the job. The real work of a legal researcher is finding out where the law is broken. A legal gap is a blind spot. It is a place where two laws contradict each other, or where the technology has moved so fast that the lawmakers simply forgot to write a rule for it. When you put the Indian Copyright Act of 1957 next to the Information Technology Act of 2000 and the new DPDP Act of 2023, you see a lot of holes. The laws do not work together. They fight each other. Here is a detailed look at the specific legal gaps in the Indian system regarding OTT platforms.
The “Legitimate Use” Loophole in the DPDP Act
This is the biggest gap right now. The DPDP Act was written to give citizens control over their data. Section 6 of the Act says companies need your explicit consent to use your data. But Section 7 creates exceptions for “certain legitimate uses”42 One of those uses is for complying with any judgment or order issued under any law. Another is for fulfilling a legal obligation. Here’s the problem. Copyright infringement is a violation of the Copyright Act. OTT platforms argue they have a legal right to track and monitor users to protect their copyright. So, does anti-piracy surveillance count as a “legitimate use” under Section 7? The law simply does not say. It is completely silent on where the line is drawn. Can Netflix track your physical location to make sure you aren’t sharing your password with a friend in another city? Can they read your device’s clipboard to see if you copied a URL for a pirate site? Under a strict reading of the Copyright Act, yes, they are just protecting their assets. But under the spirit of the DPDP Act, this is a massive privacy violation. Because the DPDP Act does not specifically define the limits of tracking for intellectual property protection, it creates a massive legal gap. OTT companies will push this boundary as far as they can until a court stops them.
The Lack of Rules for Deep Packet Inspection
As mentioned in the findings, ISPs use Deep Packet Inspection (DPI) to enforce court orders and block dynamic pirate websites. DPI means looking inside the actual data you send over the internet. The legal gap here is terrifying. There is no specific law in India that regulates how ISPs use DPI for copyright enforcement. The Telegraph Act and the IT Act have rules for when the government can intercept your messages for national security. If the police want to read your emails to catch a terrorist, there is a strict legal process. They need warrants from high-ranking officials.
But when an ISP uses DPI to check if you are downloading a stolen Bollywood movie, there is no strict process. The courts just order the ISP to “block the site.” They do not tell the ISP how to do it. So ISPs use DPI because it is the easiest way. But when they use DPI, they don’t just see the pirate movie. They can see your banking traffic, your private messages, and your browsing history. The law is completely silent on what ISPs must do with this extra data. Do they delete it immediately? Do they store it? Can they sell it to advertisers? We don’t know, because the law never bothered to regulate DPI for civil copyright cases.
Privatized Censorship and the “Safe Harbor” Trap
Another major gap is found in Section 79 of the Information Technology Act.43 This section gives “safe harbor” to intermediaries. An intermediary is a platform that hosts content, like YouTube or a social media site where people can share links. Section 79 says these platforms cannot be sued for what their users post, as long as the platform takes down illegal content quickly when they are notified. But the IT Rules of 2021 made this much stricter. Platforms now have to act extremely fast. If someone complains about a copyright violation, the platform has to remove it almost immediately to avoid getting sued. This creates a gap where private companies become judges. To avoid liability, platforms use automated AI bots to scan all user uploads. These bots look for anything that matches copyrighted music or video. If it finds a match, it blocks the upload. But AI does not understand the law. Indian copyright law has a concept called “fair dealing.” You are legally allowed to use small clips of a movie for a review, for education, or for a parody. But an AI bot cannot tell the difference between a pirate uploading a full movie and a student uploading a 10-second clip for a film study project. The bot just deletes both.
The law forces platforms to over-block content to stay safe. It outsources censorship to private companies. There is no legal penalty for a platform if they wrongly delete your legal content. But there is a massive penalty if they leave up pirated content. So, naturally, they just delete everything that looks suspicious. The law failed to create a balance here.
The Missing Test for Unmasking Anonymous Users
Pirates are anonymous. The people who download pirated movies are also anonymous. They use fake IP addresses, VPNs, and usernames like “MovieFan99.” When an OTT platform sues a pirate site, they often ask the court to force the ISP to reveal the real names and home addresses of the people running the site. Sometimes, they even ask for the details of the users who downloaded the files. The Supreme Court of India ruled in the Puttaswamy case that privacy is a fundamental human right.44 This includes the right to be anonymous online. You have the right to read and watch things without the government or private companies knowing exactly who you are. But the Copyright Act allows owners to seek damages from infringers. You cannot seek damages from a fake username. You need a real person. So, the right to privacy says “keep them hidden,” and the Copyright Act says “unmask them.”
The gap is that India has no standard legal test for when to unmask a user in a civil copyright case. In other countries, courts use a strict proportionality test. They only unmask a user if the copyright theft is massive and commercial. They will not unmask a college student who downloaded one movie. But in India, lower courts sometimes hand out the identities of internet users very easily just because a movie studio asked for them. We are missing a clear, statutory rule that protects internet anonymity against aggressive copyright lawyers.
Lack of Transparency in Dynamic Block Lists
The final legal gap deals with dynamic injunctions. When the Delhi High Court created the dynamic injunction in the UTV Software case, it solved a big problem for movie studios. But it created an administrative nightmare. Here’s how it works in practice. A court declares a website is a “rogue website” and blocks it. The pirate makes a new mirror site. The movie studio finds the new site, adds it to a list, and hands that list to the court’s Joint Registrar. The Registrar approves it, and the ISPs block it.
The gap here is a complete lack of public transparency. These block lists are not always public. The movie studios use automated software to find these mirror sites. What happens if the software makes a mistake? What happens if the software accidentally flags a legitimate educational website, or a small business website, and adds it to the block list? Because the process happens entirely between the movie studio, a court clerk, and the ISP, the owner of the innocent website has no idea what happened. Their website just suddenly stops working in India. There is no legal mechanism in the rules for a wrongly blocked website to quickly appeal the decision. The burden of proof is flipped. You are blocked first, and you have to spend your own money to go to court and prove you are not a pirate to get unblocked.
The law gives massive power to private OTT platforms to update the internet censorship lists of the entire country, without any independent oversight or public audits. This is a very dangerous legal gap that allows copyright protection to easily turn into corporate censorship. Until the legislature steps in and updates the Copyright Act and the IT Act to specifically respect the boundaries set by the new DPDP Act, these gaps will remain. Right now, the laws are fighting a tug-of-war, and the privacy of the everyday internet user is caught in the middle.
C. Policy Recommendations for Legislative Reform
We cannot just sit around and hope that massive corporations like Netflix or JioCinema will fix this out of the goodness of their hearts. They are businesses. Their main goal is to protect their revenue, not your privacy. And right now, Indian law gives them every excuse to prioritize copyright over data protection. To fix this mess, the government has to step in. We need the Ministry of Electronics and Information Technology (MeitY) and the lawmakers to update the rules. The current laws are fighting with each other. The Copyright Act of 1957 wants to catch thieves, and the Digital Personal Data Protection (DPDP) Act of 2023 wants to protect data. But nobody has explicitly stated what happens when these two laws collide on a streaming platform.
Here is what needs to change.
First, Parliament needs to amend Section 7 of the DPDP Act. This is the section about “Certain Legitimate Uses.” Right now, the law says a company can process your personal data without your explicit consent if they are doing it to prevent fraud or fulfill a legal obligation. OTT platforms and copyright owners are using this as a massive loophole. They argue that hunting for copyright infringement is a “legitimate use,” so they don’t need to worry about privacy rules when they deploy tracking software. This is a dangerous interpretation. The law needs a specific amendment clarifying that enforcing private intellectual property rights does not automatically bypass user consent. The government must define exactly what data an OTT platform is legally allowed to collect purely for anti-piracy purposes. It should be strictly limited to the absolute minimum network data required to deliver the stream. If they want to collect anything else, they must get explicit, clear consent from the user.
Second, we need to overhaul the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.45 These rules define how internet service providers and social media platforms handle illegal content. But they treat OTT platforms in a very confusing way. OTT platforms are both creators of content and intermediaries. The IT Rules need a brand new section specifically dedicated to anti-piracy mechanisms on subscription-based streaming services. This new section must ban the use of mandatory Deep Packet Inspection (DPI) by internet service providers just to enforce copyright injunctions. DPI is when the internet provider opens up your digital data packets to see exactly what you are doing. It is a massive invasion of privacy. The rules should explicitly state that general surveillance of a user’s internet traffic is an illegal method of enforcing a copyright claim.
Third, and this might be the most important fix, we have to change how courts issue Dynamic Injunctions. As we saw in the UTV Software case, courts are handing over huge power to private companies. OTT platforms can essentially update internet block lists themselves and force ISPs to block mirror websites without a judge looking at the new links. This system is ripe for abuse. It causes innocent websites to get blocked, and it forces ISPs to monitor network traffic too closely. We need a new statutory oversight board for dynamic injunctions. When an OTT platform wants to add a new URL to an existing block order, they shouldn’t just send it to a court clerk. They should have to submit it to an independent technical committee. This committee would verify two things. One, is the new site actually a pirate mirror site? And two, can this site be blocked without compromising the privacy or access of normal internet users? If the technical committee says yes, then the block goes ahead. This adds a layer of due process that is currently missing from the Indian internet ecosystem.
Fourth, the government needs to mandate mandatory transparency reports for copyright enforcement. Right now, everything happens in the dark. We don’t know how many user accounts Disney+ Hotstar bans for suspected piracy. We don’t know how much user data they hand over to the police or to other copyright holders. The law should require every OTT platform operating in India to publish a public report twice a year. This report must show exactly how many copyright strikes they issued, how many accounts they terminated, and most importantly, how many times they shared user data (like IP addresses and names) with third parties for copyright enforcement. Sunlight is the best disinfectant. If companies have to publicly admit how much surveillance they are doing, they will be forced to scale it back.
Finally, we need statutory damages for false takedowns and privacy breaches caused by overzealous anti-piracy bots. Right now, if an OTT platform’s automated system makes a mistake, blocks your account, and flags your data as belonging to a pirate, you have almost no real way to fight back. You can send an email to customer service, but that’s about it. The law should be changed so that if a platform illegally processes your data under the false excuse of copyright protection, or if they wrongly block your access, they have to pay a strict financial penalty directly to you. If companies know they will lose money every time their anti-piracy systems violate a user’s privacy, they will suddenly become very careful about how those systems are designed. These policy changes wouldn’t destroy the entertainment industry. They would simply force the industry to respect the people paying for their content. The goal of the law shouldn’t be to make life perfectly easy for copyright holders. The goal should be to find a fair balance between protecting property and protecting people.
D. Concluding Remarks
When you step back and look at this entire eleven-week research journey, a very clear picture emerges. We are watching two massive, fundamental rights crash into each other in real-time. On one side, we have the right to property, represented by the Copyright Act. On the other side, we have the fundamental right to privacy, protected by the Constitution and the new DPDP Act. And right now, in the Indian digital space, copyright is winning. The rise of OTT platforms changed how we consume media. We don’t buy DVDs anymore. We rent access to a massive digital library. But this shift completely changed the power dynamic. When you bought a DVD, you took it home, and you watched it in private. The movie studio had no idea when you watched it, who you watched it with, or how many times you paused it.
Today, the movie studio knows everything. The OTT platform tracks every single interaction you have with their app. And they justify this massive surveillance network by pointing at digital piracy. They argue that because it is so easy to steal digital content, they must have total visibility over the network to stop it. This dissertation has shown why that argument is flawed. Yes, piracy is a massive economic problem. It costs the Indian film and television industry thousands of crores every year. People who create art deserve to be paid for it. The law absolutely must provide tools to shut down rogue websites and hold organized pirate networks accountable. But here is the problem we have uncovered. The tools we are currently using—like unchecked dynamic injunctions, invasive Digital Rights Management software, and automated deep packet inspection—are equivalent to burning down a house to catch a mouse. The legal framework in India has been too eager to help big media companies protect their assets. In cases like UTV Software, the courts modernized copyright law brilliantly. They created fast, effective ways to block pirate websites. But they did this while wearing blinders. They looked purely at the economic harm of piracy and completely ignored the collateral damage to user anonymity and data protection. We are treating every internet user as a potential criminal first, and a paying customer second. When an internet service provider is forced to scan the private web traffic of millions of citizens just to make sure nobody is downloading a leaked cricket match, we have lost the balance. The comparative analysis with the European Union and the United States showed us that it doesn’t have to be this way. Other jurisdictions are struggling with this too, but places like the EU have made it clear that data privacy (through the GDPR) acts as a hard ceiling on what copyright holders can do. In India, we are still trying to figure out where that ceiling is. The DPDP Act of 2023 is a good start, but as we discussed in the legal gaps section, it leaves too many loopholes open for “legitimate uses” and corporate surveillance. So, where do we go from here? The answer lies in the middle ground. It lies in forcing technology to solve the problems that technology created. We don’t need to choose between a wild west internet where creators go bankrupt, and a surveillance state internet where every click is monitored by Netflix. We can have both. As proposed in the Privacy-by-Design model, we have the technical ability to protect streams using decentralized security and blind watermarking. We can track the leak without tracking the innocent user. But technology will not change on its own. It requires the law to force the issue. Until the Indian legislature steps up and clearly defines the boundaries of digital copyright enforcement, OTT platforms will continue to collect whatever they want.
Ultimately, privacy is not the enemy of copyright. They are two sides of the same coin in a digital democracy. A creator has the right to control how their art is distributed, but a citizen has an equal right to read, watch, and learn without someone looking over their shoulder. If India wants to be a global leader in the digital economy, our courts and our parliament must ensure that the protection of intellectual property never comes at the cost of our fundamental right to be let alone.
*****
Footnotes
1. See Telecom Regulatory Authority of India, The Indian Telecom Services Performance Indicators, TRAI.GOV.IN (2017), https://www.trai.gov.in/ (discussing the exponential growth of wireless data usage in India post-2016).
2. EY & FICCI, Reinvent: India’s Media & Entertainment Sector is Innovating for the Future, EY.COM 45-48 (2024), https://www.ey.com/en_in/media-entertainment/media-and-entertainment-report (detailing the revenue and subscriber base expansion of the Indian OTT sector).
3. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Gazette of India, pt. II sec. 3(i) (Feb. 25, 2021).
4. Arpan Banerjee, Copyright Infringement and the OTT Boom in India During COVID-19, 16 J. Intell. Prop. L. & Prac. 112, 112-114 (2021).
5. Nicola Lucchi, Digital Rights Management, in The Oxford Handbook of Law and Technology 545, 546-548 (Roger Brownsword et al. eds., 2017) (explaining the technical mechanisms of DRM and forensic watermarking in digital media).
6. The Digital Personal Data Protection Act, 2023, No. 22, Acts of Parliament, 2023 (India).
7. The Copyright Act, 1957, § 51, No. 14, Acts of Parliament, 1957 (India).
8. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 S.C.C. 1 (India) (discussing the fundamental right to privacy).
9. Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 HARV. L. REV. 193, 195 (1890).
10. Kharak Singh v. State of U.P., AIR 1963 SC 1295 (India).
11. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (India).
12. INDIA CONST. art. 21.
13. Copyright Act, 1957, § 14, No. 14, Acts of Parliament, 1957 (India).
14. Id. § 14(1)(d).
15. Id. § 2(ff).
16. Id. § 17(b).
17. Id. § 2(d)(v) (defining the author of a cinematograph film as the producer).
18. Copyright (Amendment) Act, 2012, No. 27, Acts of Parliament, 2012 (India).
19. Copyright Act, 1957, § 65A.
20. Id. § 65B.
21. Digital Personal Data Protection Act, 2023, No. 22, Acts of Parliament, 2023 (India).
22. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 S.C.C. 1 (India) (establishing the right to privacy as a fundamental right under Article 21 of the Indian Constitution).
23. Digital Personal Data Protection Act, 2023, § 6, No. 22, Acts of Parliament, 2023 (India).
24. Digital Personal Data Protection Act, 2023, § 7, No. 22, Acts of Parliament, 2023 (India).
25. See generally Internet and Mobile Association of India (IAMAI), Report on Digital Piracy and Data Protection (2024) (discussing industry arguments for processing user data to prevent copyright infringement without explicit consent).
26. Taj Television Ltd. v. Rajan Mandal, [2003] F.S.R. 22 (Del. H.C.) (India).
27. Reliance Big Entertainment Pvt. Ltd. v. Jyoti Cable Network & Ors., CS(OS) No. 1724 of 2011 (Del. H.C.) (India).
28. Star India Pvt. Ltd. v. Piyush Agarwal, 2013 SCC OnLine Del 858 (India).
29. UTV Software Communication Ltd. v. 1337X.TO, (2019) 78 PTC 375 (Del. H.C.) (India).
30. UTV Software Communication Ltd. v. 1337X.TO, 2019 SCC OnLine Del 8002.
31. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1. (Establishing the fundamental right to privacy in India, which serves as the counter-balance to aggressive IP enforcement measures).
32. Copyright Act, 1957, No. 14, Acts of Parliament, 1957 (India).
33. Taj Television Ltd. v. Rajan Mandal, 2003 FSR 22. (The concept of “John Doe” orders in India is traditionally referred to as “Ashok Kumar” orders, originating from cases where the identity of the infringing party is unknown at the time of filing the suit).
34. Star India Pvt. Ltd. v. 7Movierulz.tc, 2021 SCC OnLine Del 3647.
35. Centre for Internet and Society, Net Neutrality and Deep Packet Inspection (2018).
36. The Digital Personal Data Protection Act, 2023, No. 22, Acts of Parliament, 2023 (India).
37. See generally Lawrence Lessig, Code: And Other Laws of Cyberspace (1999) (discussing how software architecture and code act as regulatory mechanisms equivalent to legal statutes, particularly in the context of Digital Rights Management).
38. UTV Software Communication Ltd. v. 1337X.TO, 2019 SCC OnLine Del 8002 (The landmark judgment by the Delhi High Court establishing the framework for dynamic injunctions and the classification of ‘rogue websites’ in India).
39. Centre for Internet and Society, Net Neutrality and Deep Packet Inspection (2018) (Detailing the technical mechanics of DPI and its implications for user privacy and network neutrality).
40. The Digital Personal Data Protection Act, 2023, No. 22, Acts of Parliament, 2023 (India).
41. The Digital Millennium Copyright Act of 1998, Pub. L. No. 105-304, 112 Stat. 2860 (codified as amended in scattered sections of 17 U.S.C.) (The United States’ primary legislative framework for digital copyright, establishing the safe harbor and notice-and-takedown system).
42. The Digital Personal Data Protection Act, 2023, § 7, No. 22, Acts of Parliament, 2023 (India) (Defining the grounds for processing personal data without explicit user consent for certain legitimate uses).
43. The Information Technology Act, 2000, § 79, No. 21, Acts of Parliament, 2000 (India) (Providing conditional immunity to network service providers and platforms from liability for third-party data or information).
44. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (The landmark Supreme Court ruling recognizing the right to privacy as a fundamental right under Article 21 of the Constitution of India).
45. Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Ministry of Electronics and Information Technology, Noti. No. G.S.R. 139(E) (India).