Quick Takes
Quick Takes
Quick Takes
Quick Takes
Views on regulatory developments in the technology sector
Views on regulatory developments in the technology sector
Views on regulatory developments in the technology sector
Views on regulatory developments in the technology sector
India's recent Telegram episode raises an uncomfortable question: if access can be restored through VPN in minutes, how effective are platform blocks in practice?
Telegram’s founder argues that bans often push users toward VPNs rather than preventing access.
Platform blocks are rarely total technical shutdowns; they are usually implemented through DNS filtering, IP blocking, URL filtering, app-store action, or account and content restrictions. Because these measures operate largely at the network or domain level, users may still reach the service by routing traffic through another jurisdiction via a VPN.
Appfigures data reported by TechCrunch showed that VPN app downloads in India rose 49% in a single day (around Telegram block announcement), marking the biggest VPN-download day in the country at least since the start of 2025.
Under CERT-In directives, VPN providers with physical servers in India are required to collect and store user data, including names, email addresses, IP addresses, and usage duration, for five years. In the past, the government has also taken enforcement steps against non-compliant VPN apps, including app-store removals.
Because such level of logging requirements conflict with the privacy principles of most commercial VPNs, major providers removed their physical servers from India. Most global VPN services still allow Indian users to connect to servers in other countries, which bypasses the local data-logging requirement.
VPNs exist to limit profiling, surveillance, and location tracking, so when censorship pushes VPNs into registration, logging, or policing, they stop functioning as genuine privacy tools and begin to undermine the very security they are supposed to provide.
Any blanket restrictions on VPNs may have wider implications for legitimate uses such as remote work, secure communications, and privacy protection. The more aggressively a regime polices VPNs, the less private the internet becomes for everyone.
Globally, VPNs sit in a mixed regulatory space: some countries allow them broadly, some block specific services, and some penalise circumvention. In China, only government-approved VPNs are officially allowed, while unapproved VPN traffic is restricted through technical blocking and filtering.
If authorities or ISPs use more advanced methods such as deep packet inspection, block known VPN server IPs, or target the VPN protocol itself, access can become slow, unstable, or fail entirely. Some VPNs try to counter this by disguising VPN traffic as ordinary web browsing, creating an ongoing cat-and-mouse game between censorship systems and circumvention tools.
In India, where VPN-based access remains widely available, should regulatory efforts focus on blocking access, or on strengthening platform compliance, safer design features, and content moderation at the source?
India's recent Telegram episode raises an uncomfortable question: if access can be restored through VPN in minutes, how effective are platform blocks in practice?
Telegram’s founder argues that bans often push users toward VPNs rather than preventing access.
Platform blocks are rarely total technical shutdowns; they are usually implemented through DNS filtering, IP blocking, URL filtering, app-store action, or account and content restrictions. Because these measures operate largely at the network or domain level, users may still reach the service by routing traffic through another jurisdiction via a VPN.
Appfigures data reported by TechCrunch showed that VPN app downloads in India rose 49% in a single day (around Telegram block announcement), marking the biggest VPN-download day in the country at least since the start of 2025.
Under CERT-In directives, VPN providers with physical servers in India are required to collect and store user data, including names, email addresses, IP addresses, and usage duration, for five years. In the past, the government has also taken enforcement steps against non-compliant VPN apps, including app-store removals.
Because such level of logging requirements conflict with the privacy principles of most commercial VPNs, major providers removed their physical servers from India. Most global VPN services still allow Indian users to connect to servers in other countries, which bypasses the local data-logging requirement.
VPNs exist to limit profiling, surveillance, and location tracking, so when censorship pushes VPNs into registration, logging, or policing, they stop functioning as genuine privacy tools and begin to undermine the very security they are supposed to provide.
Any blanket restrictions on VPNs may have wider implications for legitimate uses such as remote work, secure communications, and privacy protection. The more aggressively a regime polices VPNs, the less private the internet becomes for everyone.
Globally, VPNs sit in a mixed regulatory space: some countries allow them broadly, some block specific services, and some penalise circumvention. In China, only government-approved VPNs are officially allowed, while unapproved VPN traffic is restricted through technical blocking and filtering.
If authorities or ISPs use more advanced methods such as deep packet inspection, block known VPN server IPs, or target the VPN protocol itself, access can become slow, unstable, or fail entirely. Some VPNs try to counter this by disguising VPN traffic as ordinary web browsing, creating an ongoing cat-and-mouse game between censorship systems and circumvention tools.
In India, where VPN-based access remains widely available, should regulatory efforts focus on blocking access, or on strengthening platform compliance, safer design features, and content moderation at the source?
India's recent Telegram episode raises an uncomfortable question: if access can be restored through VPN in minutes, how effective are platform blocks in practice?
Telegram’s founder argues that bans often push users toward VPNs rather than preventing access.
Platform blocks are rarely total technical shutdowns; they are usually implemented through DNS filtering, IP blocking, URL filtering, app-store action, or account and content restrictions. Because these measures operate largely at the network or domain level, users may still reach the service by routing traffic through another jurisdiction via a VPN.
Appfigures data reported by TechCrunch showed that VPN app downloads in India rose 49% in a single day (around Telegram block announcement), marking the biggest VPN-download day in the country at least since the start of 2025.
Under CERT-In directives, VPN providers with physical servers in India are required to collect and store user data, including names, email addresses, IP addresses, and usage duration, for five years. In the past, the government has also taken enforcement steps against non-compliant VPN apps, including app-store removals.
Because such level of logging requirements conflict with the privacy principles of most commercial VPNs, major providers removed their physical servers from India. Most global VPN services still allow Indian users to connect to servers in other countries, which bypasses the local data-logging requirement.
VPNs exist to limit profiling, surveillance, and location tracking, so when censorship pushes VPNs into registration, logging, or policing, they stop functioning as genuine privacy tools and begin to undermine the very security they are supposed to provide.
Any blanket restrictions on VPNs may have wider implications for legitimate uses such as remote work, secure communications, and privacy protection. The more aggressively a regime polices VPNs, the less private the internet becomes for everyone.
Globally, VPNs sit in a mixed regulatory space: some countries allow them broadly, some block specific services, and some penalise circumvention. In China, only government-approved VPNs are officially allowed, while unapproved VPN traffic is restricted through technical blocking and filtering.
If authorities or ISPs use more advanced methods such as deep packet inspection, block known VPN server IPs, or target the VPN protocol itself, access can become slow, unstable, or fail entirely. Some VPNs try to counter this by disguising VPN traffic as ordinary web browsing, creating an ongoing cat-and-mouse game between censorship systems and circumvention tools.
In India, where VPN-based access remains widely available, should regulatory efforts focus on blocking access, or on strengthening platform compliance, safer design features, and content moderation at the source?
The recent DRS Logistics v. Google ruling highlights that keyword and ad-text use may involve the same trademark, but they are not necessarily the same issue before the Court.
DRS Logistics alleged that Google, in violation of earlier court directions, continued to allow third parties to benefit from its registered trademarks.
The Delhi High Court found that the earlier directions required Google to investigate complaints regarding keyword use, but did not impose a general duty to proactively monitor all ads for trademark references. While Google remained bound by its AdWords Trademark Policy, no wilful contempt of the earlier directions was established, and the application was dismissed.
In simple terms, a trademark may be used to make an advertisement appear when a user searches for it (for example, through hidden keyword bidding, where the mark is not visible in the ad), while ad-text use involves the trademark appearing directly in the advertisement itself.
The Court did not rule on the difference between trademark use as a keyword vis-à-vis its use in ad text, as it was exercising contempt jurisdiction. It simply held that the use of a trademark in ad text, ad titles, or URLs fell outside the scope of the earlier directions.
The judgment is a reminder that courts can only decide the questions specifically placed before them, and that the same registered trademark can appear in different contexts, each of which must be examined and decided on its own terms.
This is narrower than the recent Hindware ruling. In Hindware, the Court treated Google's role as more than that of a passive intermediary and held that the use of a competitor's trademark as a keyword could amount to infringement.
Brands and platforms should ensure that judicial relief addresses keyword bidding and visible ad content categorically and expressly, even when both concern the same trademark.
Source: M/s DRS Logistics (P) Ltd. & Anr. v. Google India Pvt. Ltd. & Ors., CS(COMM) 1/2017 (Del HC, 15 June 2026).
The recent DRS Logistics v. Google ruling highlights that keyword and ad-text use may involve the same trademark, but they are not necessarily the same issue before the Court.
DRS Logistics alleged that Google, in violation of earlier court directions, continued to allow third parties to benefit from its registered trademarks.
The Delhi High Court found that the earlier directions required Google to investigate complaints regarding keyword use, but did not impose a general duty to proactively monitor all ads for trademark references. While Google remained bound by its AdWords Trademark Policy, no wilful contempt of the earlier directions was established, and the application was dismissed.
In simple terms, a trademark may be used to make an advertisement appear when a user searches for it (for example, through hidden keyword bidding, where the mark is not visible in the ad), while ad-text use involves the trademark appearing directly in the advertisement itself.
The Court did not rule on the difference between trademark use as a keyword vis-à-vis its use in ad text, as it was exercising contempt jurisdiction. It simply held that the use of a trademark in ad text, ad titles, or URLs fell outside the scope of the earlier directions.
The judgment is a reminder that courts can only decide the questions specifically placed before them, and that the same registered trademark can appear in different contexts, each of which must be examined and decided on its own terms.
This is narrower than the recent Hindware ruling. In Hindware, the Court treated Google's role as more than that of a passive intermediary and held that the use of a competitor's trademark as a keyword could amount to infringement.
Brands and platforms should ensure that judicial relief addresses keyword bidding and visible ad content categorically and expressly, even when both concern the same trademark.
Source: M/s DRS Logistics (P) Ltd. & Anr. v. Google India Pvt. Ltd. & Ors., CS(COMM) 1/2017 (Del HC, 15 June 2026).
The recent DRS Logistics v. Google ruling highlights that keyword and ad-text use may involve the same trademark, but they are not necessarily the same issue before the Court.
DRS Logistics alleged that Google, in violation of earlier court directions, continued to allow third parties to benefit from its registered trademarks.
The Delhi High Court found that the earlier directions required Google to investigate complaints regarding keyword use, but did not impose a general duty to proactively monitor all ads for trademark references. While Google remained bound by its AdWords Trademark Policy, no wilful contempt of the earlier directions was established, and the application was dismissed.
In simple terms, a trademark may be used to make an advertisement appear when a user searches for it (for example, through hidden keyword bidding, where the mark is not visible in the ad), while ad-text use involves the trademark appearing directly in the advertisement itself.
The Court did not rule on the difference between trademark use as a keyword vis-à-vis its use in ad text, as it was exercising contempt jurisdiction. It simply held that the use of a trademark in ad text, ad titles, or URLs fell outside the scope of the earlier directions.
The judgment is a reminder that courts can only decide the questions specifically placed before them, and that the same registered trademark can appear in different contexts, each of which must be examined and decided on its own terms.
This is narrower than the recent Hindware ruling. In Hindware, the Court treated Google's role as more than that of a passive intermediary and held that the use of a competitor's trademark as a keyword could amount to infringement.
Brands and platforms should ensure that judicial relief addresses keyword bidding and visible ad content categorically and expressly, even when both concern the same trademark.
Source: M/s DRS Logistics (P) Ltd. & Anr. v. Google India Pvt. Ltd. & Ors., CS(COMM) 1/2017 (Del HC, 15 June 2026).
AI Contract Basics That Matter
As AI vendors increasingly embed critical commitments within technical schedules, service descriptions, and SLAs, legal teams and buyers need to understand what is actually being promised. Otherwise, assessing risk, negotiating effective protections, and establishing breach in the event of a service failure becomes considerably more difficult.
Before you get to IP, privacy, indemnity, or liability, start with the fundamentals. What exactly has the vendor promised to deliver?
The answer often lies in metrics such as:
- Uptime / Availability
- Latency
- Throughput / Capacity
- Error Rates
Why do these matter?
Because legal remedies often depend on proving that a contractual performance standard was not met. Understanding which operational aspects have been converted into enforceable contractual obligations, and which remain marketing claims, is therefore critical.
These concepts are not unique to AI and have existed in technology contracts for years. What is changing is the growing importance of response times and processing capacity in assessing whether an AI tool or service is fit for purpose.
Below we've broken down four common AI performance metrics and some of the key considerations they can raise when reviewing vendor agreements.
Metric | What it means | Example | Common Parameter | Why this matters more in AI services than traditional SaaS | Practical Checkpoints |
|---|---|---|---|---|---|
1) Uptime / Availability | The percentage of time the service is live and usable. If it falls below the promised level, service credits may apply. | Send AI commits to maintaining a minimum service availability of 99.5% uptime per calendar month for the Platform, excluding scheduled maintenance windows. Source: Send.ai SLA | % per month. For example, 99.5% means the service can be down for a small portion of the month. | Uptime is still a core metric, but on its own it provides only a partial picture of performance in AI systems. | Check how uptime is calculated, what exclusions apply, and what remedy is available if the promised level is not met. |
2) Latency | How long the AI takes to respond after a request is sent. A service can be “up” but still slow enough to disrupt work. | Send AI's latency clause is a soft marketing target ("targets <5 seconds") not an enforceable guarantee, with vague caveats ("may vary based on complexity/load") and zero service credits for missed performance Source: Send.ai SLA | Response time per request (for ex., in milliseconds/ seconds). | In SaaS, a page loading in 5 vs 1 seconds is inconvenient. Whereas in AI tools, this becomes a core commercial issue. (for ex., delayed responses from a voice bot leads customers to hang up before receiving an answer). | Check whether response time is actually guaranteed as a performance obligation, or only described without any contractual consequences for slow performance. |
3) Throughput / Capacity | How much work the system can handle in a set time. If capacity is too low, requests get throttled or delayed. | “For Tier 1, Maximum requests per minute (RPM) are 50.” Source: Claude API Rate Limits | Tokens per minute or requests per minute. This is the service’s processing limit. | AI tools often limit how much work can be processed at a time. For example, during a peak business period, requests may be delayed or blocked once usage limits are reached. | Identify any contractual limits that could restrict adoption, scaling, or business-critical use cases. |
4) Error Rate | The share of requests that fail. A high error rate can make the service effectively unusable even if uptime looks fine. | "Downtime" means more than a 5% Error Rate Error Rate means the number of Valid Requests that result in a response with HTTP Status 500 and Code 'Internal Error' divided by the total number of Valid Requests during that period. Source: Haptik.ai SLA | Percentage of failed requests. | A failed AI request usually means no output at all. For example, if a document extraction tool fails repeatedly, key workflows may come to a halt despite the platform remaining online. | Check which failed requests count toward the error rate calculation and whether any categories of errors are excluded. |
AI Contract Basics That Matter
As AI vendors increasingly embed critical commitments within technical schedules, service descriptions, and SLAs, legal teams and buyers need to understand what is actually being promised. Otherwise, assessing risk, negotiating effective protections, and establishing breach in the event of a service failure becomes considerably more difficult.
Before you get to IP, privacy, indemnity, or liability, start with the fundamentals. What exactly has the vendor promised to deliver?
The answer often lies in metrics such as:
- Uptime / Availability
- Latency
- Throughput / Capacity
- Error Rates
Why do these matter?
Because legal remedies often depend on proving that a contractual performance standard was not met. Understanding which operational aspects have been converted into enforceable contractual obligations, and which remain marketing claims, is therefore critical.
These concepts are not unique to AI and have existed in technology contracts for years. What is changing is the growing importance of response times and processing capacity in assessing whether an AI tool or service is fit for purpose.
Below we've broken down four common AI performance metrics and some of the key considerations they can raise when reviewing vendor agreements.
Metric | What it means | Example | Common Parameter | Why this matters more in AI services than traditional SaaS | Practical Checkpoints |
|---|---|---|---|---|---|
1) Uptime / Availability | The percentage of time the service is live and usable. If it falls below the promised level, service credits may apply. | Send AI commits to maintaining a minimum service availability of 99.5% uptime per calendar month for the Platform, excluding scheduled maintenance windows. Source: Send.ai SLA | % per month. For example, 99.5% means the service can be down for a small portion of the month. | Uptime is still a core metric, but on its own it provides only a partial picture of performance in AI systems. | Check how uptime is calculated, what exclusions apply, and what remedy is available if the promised level is not met. |
2) Latency | How long the AI takes to respond after a request is sent. A service can be “up” but still slow enough to disrupt work. | Send AI's latency clause is a soft marketing target ("targets <5 seconds") not an enforceable guarantee, with vague caveats ("may vary based on complexity/load") and zero service credits for missed performance Source: Send.ai SLA | Response time per request (for ex., in milliseconds/ seconds). | In SaaS, a page loading in 5 vs 1 seconds is inconvenient. Whereas in AI tools, this becomes a core commercial issue. (for ex., delayed responses from a voice bot leads customers to hang up before receiving an answer). | Check whether response time is actually guaranteed as a performance obligation, or only described without any contractual consequences for slow performance. |
3) Throughput / Capacity | How much work the system can handle in a set time. If capacity is too low, requests get throttled or delayed. | “For Tier 1, Maximum requests per minute (RPM) are 50.” Source: Claude API Rate Limits | Tokens per minute or requests per minute. This is the service’s processing limit. | AI tools often limit how much work can be processed at a time. For example, during a peak business period, requests may be delayed or blocked once usage limits are reached. | Identify any contractual limits that could restrict adoption, scaling, or business-critical use cases. |
4) Error Rate | The share of requests that fail. A high error rate can make the service effectively unusable even if uptime looks fine. | "Downtime" means more than a 5% Error Rate Error Rate means the number of Valid Requests that result in a response with HTTP Status 500 and Code 'Internal Error' divided by the total number of Valid Requests during that period. Source: Haptik.ai SLA | Percentage of failed requests. | A failed AI request usually means no output at all. For example, if a document extraction tool fails repeatedly, key workflows may come to a halt despite the platform remaining online. | Check which failed requests count toward the error rate calculation and whether any categories of errors are excluded. |
AI Contract Basics That Matter
As AI vendors increasingly embed critical commitments within technical schedules, service descriptions, and SLAs, legal teams and buyers need to understand what is actually being promised. Otherwise, assessing risk, negotiating effective protections, and establishing breach in the event of a service failure becomes considerably more difficult.
Before you get to IP, privacy, indemnity, or liability, start with the fundamentals. What exactly has the vendor promised to deliver?
The answer often lies in metrics such as:
- Uptime / Availability
- Latency
- Throughput / Capacity
- Error Rates
Why do these matter?
Because legal remedies often depend on proving that a contractual performance standard was not met. Understanding which operational aspects have been converted into enforceable contractual obligations, and which remain marketing claims, is therefore critical.
These concepts are not unique to AI and have existed in technology contracts for years. What is changing is the growing importance of response times and processing capacity in assessing whether an AI tool or service is fit for purpose.
Below we've broken down four common AI performance metrics and some of the key considerations they can raise when reviewing vendor agreements.
Metric | What it means | Example | Common Parameter | Why this matters more in AI services than traditional SaaS | Practical Checkpoints |
|---|---|---|---|---|---|
1) Uptime / Availability | The percentage of time the service is live and usable. If it falls below the promised level, service credits may apply. | Send AI commits to maintaining a minimum service availability of 99.5% uptime per calendar month for the Platform, excluding scheduled maintenance windows. Source: Send.ai SLA | % per month. For example, 99.5% means the service can be down for a small portion of the month. | Uptime is still a core metric, but on its own it provides only a partial picture of performance in AI systems. | Check how uptime is calculated, what exclusions apply, and what remedy is available if the promised level is not met. |
2) Latency | How long the AI takes to respond after a request is sent. A service can be “up” but still slow enough to disrupt work. | Send AI's latency clause is a soft marketing target ("targets <5 seconds") not an enforceable guarantee, with vague caveats ("may vary based on complexity/load") and zero service credits for missed performance Source: Send.ai SLA | Response time per request (for ex., in milliseconds/ seconds). | In SaaS, a page loading in 5 vs 1 seconds is inconvenient. Whereas in AI tools, this becomes a core commercial issue. (for ex., delayed responses from a voice bot leads customers to hang up before receiving an answer). | Check whether response time is actually guaranteed as a performance obligation, or only described without any contractual consequences for slow performance. |
3) Throughput / Capacity | How much work the system can handle in a set time. If capacity is too low, requests get throttled or delayed. | “For Tier 1, Maximum requests per minute (RPM) are 50.” Source: Claude API Rate Limits | Tokens per minute or requests per minute. This is the service’s processing limit. | AI tools often limit how much work can be processed at a time. For example, during a peak business period, requests may be delayed or blocked once usage limits are reached. | Identify any contractual limits that could restrict adoption, scaling, or business-critical use cases. |
4) Error Rate | The share of requests that fail. A high error rate can make the service effectively unusable even if uptime looks fine. | "Downtime" means more than a 5% Error Rate Error Rate means the number of Valid Requests that result in a response with HTTP Status 500 and Code 'Internal Error' divided by the total number of Valid Requests during that period. Source: Haptik.ai SLA | Percentage of failed requests. | A failed AI request usually means no output at all. For example, if a document extraction tool fails repeatedly, key workflows may come to a halt despite the platform remaining online. | Check which failed requests count toward the error rate calculation and whether any categories of errors are excluded. |
Recent ruling before the Calcutta High Court raised an interesting question for the AI era: Do businesses have a right to claim visibility on AI platforms?
IndiaMART argued that Open AI was excluding its links from responses to user prompts while showing other sources and seller websites on ChatGPT search. The Court declined interim relief to IndiaMART.
Reasoning: Businesses do not automatically have a legal right to visibility on a private AI platform. Not being mentioned by AI does not, by itself, prove trademark infringement, disparagement, or any other legal wrong.
The Court noted that the loss complained of was pure economic loss (due to loss of user traffic), and that common law does not impose liability for pure omissions without a statutory or contractual duty.
The Court also took note of a bigger issue: Generative AI does not fit neatly in any definition under India’s current Information Technology Act framework. Prima facie, ChatGPT may look more like an “originator” [under section 2(1)(za); due to its generative qualities] than a passive “intermediary”, but this question requires legislative intervention.
Ironically, at an earlier point of time, IndiaMART itself had blocked ChatGPT from accessing its website.
What this really signals is a shift from what AI shows to what AI leaves out.
As AI increasingly becomes a discovery layer for products, businesses, and information, questions around ranking, citation, visibility, and platform accountability will become major regulatory issues.
Source: IA No. GA‑COM/1/2025 in IP‑COM/57/2025 (Cal HC)
Recent ruling before the Calcutta High Court raised an interesting question for the AI era: Do businesses have a right to claim visibility on AI platforms?
IndiaMART argued that Open AI was excluding its links from responses to user prompts while showing other sources and seller websites on ChatGPT search. The Court declined interim relief to IndiaMART.
Reasoning: Businesses do not automatically have a legal right to visibility on a private AI platform. Not being mentioned by AI does not, by itself, prove trademark infringement, disparagement, or any other legal wrong.
The Court noted that the loss complained of was pure economic loss (due to loss of user traffic), and that common law does not impose liability for pure omissions without a statutory or contractual duty.
The Court also took note of a bigger issue: Generative AI does not fit neatly in any definition under India’s current Information Technology Act framework. Prima facie, ChatGPT may look more like an “originator” [under section 2(1)(za); due to its generative qualities] than a passive “intermediary”, but this question requires legislative intervention.
Ironically, at an earlier point of time, IndiaMART itself had blocked ChatGPT from accessing its website.
What this really signals is a shift from what AI shows to what AI leaves out.
As AI increasingly becomes a discovery layer for products, businesses, and information, questions around ranking, citation, visibility, and platform accountability will become major regulatory issues.
Source: IA No. GA‑COM/1/2025 in IP‑COM/57/2025 (Cal HC)
Recent ruling before the Calcutta High Court raised an interesting question for the AI era: Do businesses have a right to claim visibility on AI platforms?
IndiaMART argued that Open AI was excluding its links from responses to user prompts while showing other sources and seller websites on ChatGPT search. The Court declined interim relief to IndiaMART.
Reasoning: Businesses do not automatically have a legal right to visibility on a private AI platform. Not being mentioned by AI does not, by itself, prove trademark infringement, disparagement, or any other legal wrong.
The Court noted that the loss complained of was pure economic loss (due to loss of user traffic), and that common law does not impose liability for pure omissions without a statutory or contractual duty.
The Court also took note of a bigger issue: Generative AI does not fit neatly in any definition under India’s current Information Technology Act framework. Prima facie, ChatGPT may look more like an “originator” [under section 2(1)(za); due to its generative qualities] than a passive “intermediary”, but this question requires legislative intervention.
Ironically, at an earlier point of time, IndiaMART itself had blocked ChatGPT from accessing its website.
What this really signals is a shift from what AI shows to what AI leaves out.
As AI increasingly becomes a discovery layer for products, businesses, and information, questions around ranking, citation, visibility, and platform accountability will become major regulatory issues.
Source: IA No. GA‑COM/1/2025 in IP‑COM/57/2025 (Cal HC)
PW (PhysicsWallah) was recently penalized for using "dark patterns" that influenced consumer decisions through design elements rather than genuine choice.
According to the regulator, a ₹10 donation to the PW Foundation was already selected at the checkout window through a pre-ticked box.
This meant users would automatically pay ₹10 unless they noticed and un-checked it (and most users simply didn't notice).
When users clicked “Know More,” they were shown emotionally persuasive messages about financial assistance for children’s education, marriages, and healthcare for underserved communities, inducing guilt for declining the donation contribution.
Additionally, personal information was required to access certain "free" educational content.
The Central Consumer Protection Authority classified these practices as basket sneaking, confirm shaming, and forced action, and treated them as violations under the Consumer Protection Act and the 2023 Dark Patterns Guidelines.
Through this mechanism, PW Foundation reportedly received about ₹2.47 crore from more than 21.36 lakh users. The penalty was decided based on factors such as the number of users impacted, the frequency of the conduct, and the vulnerability of the people affected.
What makes this order significant is that it was initiated suo motu, which signals a shift toward more proactive scrutiny of product and UX design.
Globally, regulators have adopted an even stricter approach in such cases. Amazon paid $2.5 billion over Prime dark patterns in 2025; Epic Games (Fortnite) paid $520 million for dark patterns targeting children; and Meta was fined €390 million for manipulative consent flows.
As regulators examine how choices are presented rather than simply what is disclosed, UI/UX decisions are increasingly becoming regulatory considerations.
#TechLaw #DarkPatterns
PW (PhysicsWallah) was recently penalized for using "dark patterns" that influenced consumer decisions through design elements rather than genuine choice.
According to the regulator, a ₹10 donation to the PW Foundation was already selected at the checkout window through a pre-ticked box.
This meant users would automatically pay ₹10 unless they noticed and un-checked it (and most users simply didn't notice).
When users clicked “Know More,” they were shown emotionally persuasive messages about financial assistance for children’s education, marriages, and healthcare for underserved communities, inducing guilt for declining the donation contribution.
Additionally, personal information was required to access certain "free" educational content.
The Central Consumer Protection Authority classified these practices as basket sneaking, confirm shaming, and forced action, and treated them as violations under the Consumer Protection Act and the 2023 Dark Patterns Guidelines.
Through this mechanism, PW Foundation reportedly received about ₹2.47 crore from more than 21.36 lakh users. The penalty was decided based on factors such as the number of users impacted, the frequency of the conduct, and the vulnerability of the people affected.
What makes this order significant is that it was initiated suo motu, which signals a shift toward more proactive scrutiny of product and UX design.
Globally, regulators have adopted an even stricter approach in such cases. Amazon paid $2.5 billion over Prime dark patterns in 2025; Epic Games (Fortnite) paid $520 million for dark patterns targeting children; and Meta was fined €390 million for manipulative consent flows.
As regulators examine how choices are presented rather than simply what is disclosed, UI/UX decisions are increasingly becoming regulatory considerations.
#TechLaw #DarkPatterns
PW (PhysicsWallah) was recently penalized for using "dark patterns" that influenced consumer decisions through design elements rather than genuine choice.
According to the regulator, a ₹10 donation to the PW Foundation was already selected at the checkout window through a pre-ticked box.
This meant users would automatically pay ₹10 unless they noticed and un-checked it (and most users simply didn't notice).
When users clicked “Know More,” they were shown emotionally persuasive messages about financial assistance for children’s education, marriages, and healthcare for underserved communities, inducing guilt for declining the donation contribution.
Additionally, personal information was required to access certain "free" educational content.
The Central Consumer Protection Authority classified these practices as basket sneaking, confirm shaming, and forced action, and treated them as violations under the Consumer Protection Act and the 2023 Dark Patterns Guidelines.
Through this mechanism, PW Foundation reportedly received about ₹2.47 crore from more than 21.36 lakh users. The penalty was decided based on factors such as the number of users impacted, the frequency of the conduct, and the vulnerability of the people affected.
What makes this order significant is that it was initiated suo motu, which signals a shift toward more proactive scrutiny of product and UX design.
Globally, regulators have adopted an even stricter approach in such cases. Amazon paid $2.5 billion over Prime dark patterns in 2025; Epic Games (Fortnite) paid $520 million for dark patterns targeting children; and Meta was fined €390 million for manipulative consent flows.
As regulators examine how choices are presented rather than simply what is disclosed, UI/UX decisions are increasingly becoming regulatory considerations.
#TechLaw #DarkPatterns
While companies are reviewing the new SGI labelling rules for content-level compliance, it is important to assess whether agency contracts clearly allocate regulatory risk.
The recent amendment to the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 mandates due-diligence obligations for Synthetically Generated Information (SGI).
Platforms are required to implement labelling, traceability/provenance mechanisms, and rapid takedown processes.
While the SGI rules primarily regulate intermediaries, not users directly; intermediaries are required to implement robust due diligence systems. In practice, this results in multiple moderation approaches depending on platform policy and risk.
Thus, agencies that create, edit or post content for a brand now carry operational duties to provide SGI declaration and comply with amended rules/ platform policies.
If an agency is creating and posting content on behalf of a brand, failures often arise at the execution stage despite prior brand approval, and the most significant risk allocation gap in view of the amended rules is an uncapped or poorly drafted indemnity.
This can leave the agency nominally liable but the brand may bear immediate costs: emergency takedown, recreation of creative assets, ad spend, PR remediation, platform penalties (suspension or limited reach), and legal review.
Agency contracts should be revisited to require warranties and indemnities for failures to label or comply with platform labelling workflows, with such liabilities carved out of any general liability cap.
#AIRegulation #TechPolicy #DigitalMarketing
I recently read a research paper on privacy concerns in financial mobile applications across jurisdictions with mature privacy regimes. Across the study, users were concerned not only about data collection practices, but also about how difficult it was to understand what they were actually consenting to.
🔷 The study found recurring concerns around excessive permissions, forced consent structures, vague explanations for data access, and weak transparency at the exact moment permissions are requested.
🔷 Interestingly, even apps operating under stronger regulatory systems like the GDPR faced nearly identical trust issues.
🔷 What makes this more concerning is the readability gap. The average privacy policy scored just 29.09 on the Flesch Reading Ease scale, placing many of these documents within the “very difficult” readability category, effectively at a college graduate reading level.
🔷 Many of these policies satisfy disclosure requirements without being genuinely understandable to users.
🔷 Under India’s DPDP framework, consent must be “informed” and notices are required to be communicated in “clear and plain” language.
🔷 If consent validity depends on “informed” understanding, regulators may eventually need to evaluate interface comprehension as a compliance issue, because a user clicking “Allow” without contextual understanding is technically consenting, but not meaningfully informed.
Source: Haggag, O., Pedace, A., Pan, S., & Grundy, J. (2025). An analysis of privacy regulations and user concerns of finance mobile applications. Information and Software Technology, 184, 107756.
#dataprivacy #DPDPAct #GDPR
Issue before the Court: Can using a rival's trademark as a hidden Google Ads keyword amount to trademark infringement?
🔷 Operational Mechanics
- Advertisers bid on keywords within Google Ads
- These keywords are typically invisible to users
- When a user searches for a matching term, Google compares competing advertisers and decides which ads to show, and in what order, based on factors such as bids and ad quality
- The user sees the ad, but never sees the underlying keyword that triggered it
For ex.: A customer searching for Cadbury may be shown a competitor's ad (say ChocoCloud), because ChocoCloud secretly targeted "Cadbury" as a keyword, even though that keyword does not appear in the advertisement of ChocoCloud directly.
🔷 Plaintiff's Arguments
- Competitors were bidding on HINDWARE to divert search traffic
- Google was monetising HINDWARE's goodwill and creating confusion among consumers
🔷 Google's Arguments
- A keyword is merely a backend trigger and not visible ad text
- There is no trademark "use" or confusion where the ad clearly identifies its source
- Google claimed intermediary safe harbour under Section 79(1) of the Information Technology Act, 2000 (IT Act)
🔷 Court's Conclusion
- Using a registered trademark as a Google Ads keyword constitutes "use" for trademark law purposes [Section 29(6) and 29(8) of the Trade Marks Act, 1999]
- Google's conduct amounted to infringement because the trademark was used in the advertising process to obtain an unfair commercial advantage
- Google could not claim IT Act protection because it was playing an active commercial role in selling and monetising trademark keywords
🔷 Key Takeaway
Traditionally, adtech distinguishes between:
- What users see (ads, creatives, landing pages); and
- What happens in the backend (keywords, targeting signals, audience selection and auctions)
This judgment suggests that courts may focus on the commercial function of a tool, not merely its visibility to users. If a backend mechanism exploits another party's legal rights, "users never saw it" may no longer be a sufficient defence.
#IntellectualProperty #TechLaw #DigitalMarketing
Here’s What It Means for Global M&A.
From July 1, 2026, China can require authorization before restricted technologies, data, technical services, and even certain talent transfers move out of China.
It can also review, block, or unwind overseas deals involving sensitive Chinese assets (triggered after Beijing ordered Meta to unwind its ~$2B acquisition of AI startup Manus).
The rules cover indirect transfers as well: deploying technical staff overseas, providing training, or offering technical guidance to foreign affiliates can be treated as a technology transfer and may require approval.
Chinese firms may invest capital but may not legally transfer the know-how.
Sectors most affected: electronics, EVs, rare earths, semiconductors, advanced manufacturing, solar, AI.
India has recently eased parts of its Chinese investment regime under Press Note 3, hoping to benefit from capital, expertise, technology, and supply-chain integration. However, under this new framework, India may approve an investment but China can still restrict the transfer of the underlying technology, know-how, data, or talent.
Cross-border deals involving Chinese technology now carry an additional layer of regulatory risk, even after a transaction has been completed.
Source: Reuters
Delhi HC recently ruled that individuals can stop their names from being permanently searchable in online judicial records, even though the judgments themselves remain public.
The Court directed search engines (like Google) and legal databases (specifically Indian Kanoon) to de-index judgments from name-based searches, while court registries redact personal identifiers in the publicly accessible version of judgments.
The Court evaluated: Does continued accessibility of personal information cause disproportionate harm to informational privacy, dignity, and reputation, without any legitimate public interest justifying it?
The Court laid out 7 factors to consider (the nature of the information, time elapsed, whether the person is a public figure, the accuracy of the information, harm to reputation, digital accessibility, and impact on free speech) and 3 clear situations where Right to Be Forgotten (‘RTBF’) applies:
• You were acquitted or discharged (the case ended in your favour)
• Proceedings were quashed or settled
• It is a private civil or matrimonial dispute
The Court explicitly stated that these factors are not a checklist and must be weighed on a case-by-case basis.
For ex., the Court rejected a public figure’s request to remove decade-old posts about his drunken behaviour, holding that the RTBF protects private individuals and is not a tool for public figures to selectively erase inconvenient past conduct.
Who can't use it? Offences against women or children, breaches of public trust (including corruption), and cases involving public servants or elected officials are generally excluded.
While the ruling establishes a framework for RTBF claims, future outcomes may depend heavily on how courts weigh the harm and the public interest in each case.
Built by Parmi Mehta
© 2026 Zenya Legal LLP
Built by Parmi Mehta
© 2026 Zenya Legal LLP
Built by Parmi Mehta
© 2026 Zenya Legal LLP
Built by Parmi Mehta
© 2026 Zenya Legal LLP