Consumer Rights in Cross-Device Tracking Restriction and Enforcement in India

1. Introduction

Cross-device tracking is the practice of identifying or linking the activities of the same consumer across multiple devices, such as smartphones, tablets, laptops, smart TVs and gaming consoles. Companies may use account information, cookies, advertising identifiers, device fingerprints, IP addresses and other technical signals to create a unified profile of a consumer.

For example, a consumer may search for a product on a mobile phone and later receive advertisements for the same product on a laptop or smart television. While personalised services can provide convenience, undisclosed cross-device tracking can interfere with consumer autonomy and privacy.

Indian law does not presently contain a single provision specifically titled “cross-device tracking restriction.” However, consumer protection principles, the constitutional right to privacy and the Digital Personal Data Protection Act, 2023 (DPDP Act) together provide an important legal framework.

2. Consumer's Right to Information

Section 2(9) of the Consumer Protection Act, 2019 recognises the consumer's right to be informed about the quality, quantity, potency, purity, standard and price of goods or services so that consumers can be protected against unfair trade practices. The Act also treats deliberate concealment of important information as relevant to the concept of a misleading advertisement.

In the digital environment, the nature of data collection can become material information. If a consumer is told that an application uses data only to provide a particular service, but the data is secretly combined with information collected from other devices for behavioural advertising, the representation may potentially raise consumer-protection concerns.

The stronger legal route for the actual processing of personal data, however, is the DPDP Act.

3. Consent and Purpose Limitation Under the DPDP Act

The DPDP Act, 2023 establishes a statutory framework for processing digital personal data. It applies to processing connected with offering goods or services to individuals in India, including circumstances involving entities operating outside India.

Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. Consent must be limited to personal data necessary for the specified purpose.

This is particularly important for cross-device tracking. A consumer's consent to operate a shopping application should not automatically be treated as unlimited consent to identify the consumer across unrelated devices and services for advertising purposes.

Where tracking is based on consent, the consumer can withdraw consent, and the Data Fiduciary must cease processing within a reasonable time unless continued processing is authorised under the Act, Rules or another applicable law.

4. Right to Know Where Personal Data Is Shared

Section 11 of the DPDP Act gives a Data Principal the right to obtain information concerning the personal data being processed and the processing activities undertaken. The individual can also obtain the identities of other Data Fiduciaries and Data Processors with whom personal data has been shared, together with a description of the data shared.

This right can be significant in cross-device tracking investigations.

For example, if an individual discovers that information collected through a mobile application is being combined with information obtained from a browser, connected television or advertising platform, the individual may seek information about the processing and relevant entities involved.

The DPDP Rules, 2025 further require mechanisms through which Data Principals can exercise their statutory rights and make grievances.

5. Right to Withdraw Consent

An effective tracking restriction must give consumers a practical ability to say no.

The DPDP Act expressly provides that withdrawal of consent must be as easy as giving consent. After withdrawal, the Data Fiduciary must cease, and must cause its Data Processors to cease, processing based on that consent within a reasonable time, subject to statutory exceptions.

Therefore, a company should not design a simple “accept tracking” mechanism while making withdrawal excessively complicated.

The DPDP Rules, 2025 require notices to provide a specific means through which individuals can withdraw consent, exercise their rights and make complaints.

6. Constitutional Right to Privacy

The foundation for stronger restrictions on cross-device tracking is the Supreme Court's landmark decision in Justice K.S. Puttaswamy (Retd.) v. Union of India (2017).

A nine-judge Bench unanimously recognised privacy as a fundamental right protected under Article 21 and other constitutional guarantees. The Court specifically recognised informational privacy as a facet of privacy and highlighted the dangers created by the aggregation of information in the digital age.

Cross-device tracking raises precisely this concern. Individual pieces of information collected from different devices may appear insignificant separately, but when combined they can create a detailed behavioural profile of an individual.

Thus, the Puttaswamy principles support the proposition that consumers should have meaningful control over the collection, combination and use of information capable of identifying them.

7. Important Case Law: Puttaswamy (Aadhaar)

In K.S. Puttaswamy (Retd.) v. Union of India (2018), the Supreme Court examined privacy concerns surrounding Aadhaar and data aggregation. The judgment discussed how linking information contained in separate databases can enable the creation of comprehensive profiles and thereby create significant privacy concerns.

Although the case concerned the Aadhaar framework rather than commercial advertising, its reasoning is highly relevant to cross-device tracking. Linking information from a smartphone, browser, smart television and other devices can similarly transform separate data points into a comprehensive behavioural profile.

8. Consumer Protection and Unfair Contract Terms

Cross-device tracking may also become a consumer-protection issue where privacy-related contractual terms are excessively one-sided or hidden in lengthy standard-form agreements.

In Pioneer Urban Land & Infrastructure Ltd. v. Govindan Raghavan, (2019) 5 SCC 725, the Supreme Court held that one-sided and unfair contractual terms imposed on consumers could constitute an unfair trade practice. The Court emphasised that consumers with little meaningful bargaining power should not automatically be bound by oppressive standard-form terms.

The principle may be relevant where a digital service attempts to obtain extremely broad tracking rights through a non-negotiable agreement that consumers cannot realistically understand or reject while continuing to use the service.

9. Enforcement Mechanisms

The Consumer Protection Act gives the Central Consumer Protection Authority (CCPA) powers to protect consumer rights, prevent unfair trade practices and investigate violations. Section 18 specifically empowers the CCPA to inquire into or investigate consumer-rights violations and unfair trade practices.

Section 21 permits the CCPA to direct discontinuation or modification of false or misleading advertisements and provides for monetary penalties in appropriate cases.

Under the DPDP framework, enforcement is principally connected with the Data Protection Board of India and the statutory mechanisms established under the DPDP Act and Rules. The Rules were notified in November 2025, with the Act's provisions brought into force according to a phased commencement schedule.

Consumers therefore have potentially two complementary avenues: consumer law where deceptive commercial practices are involved, and data-protection law where unlawful processing of personal data is involved.

10. Conclusion

Cross-device tracking represents a major challenge to consumer autonomy because it can connect apparently separate digital activities into a single behavioural profile. Indian law does not yet contain a dedicated prohibition on every form of cross-device tracking. Nevertheless, the Consumer Protection Act, 2019, DPDP Act, 2023, DPDP Rules, 2025 and Article 21 privacy jurisprudence provide significant protections.

The most important principles are transparency, specific and informed consent, purpose limitation, meaningful withdrawal of consent, access to information concerning processing, and protection against deceptive commercial practices.

The Supreme Court's decisions in Puttaswamy establish that informational privacy is constitutionally significant, while Pioneer Urban demonstrates that consumer law can scrutinise unfair standard-form contractual terms. Going forward, effective enforcement will depend upon ensuring that consumers are not merely presented with privacy policies, but are given genuine and understandable control over whether their activities can be linked across devices.