Recently, the Minister of State for Electronics and Information Technology responded to a query from Rajya Sabha lawmaker S. Niranjan Reddy regarding the web scraping of publicly available user data by social media companies for training Artificial Intelligence (AI) models.
The Andhra Pradesh MP asked the Ministry of Electronics and Information Technology (MeitY) about the measures taken by the government to regulate and prevent the misuse of web scraping by social media companies for AI training purposes.
The query focused on ensuring that social media companies provide full transparency, obtain informed user consent before scraping data, and implement accountability mechanisms to prevent the unethical use of scraped user data.
In response, Jitin Prasada, Minister of State for Electronics and Information Technology, stated, “Web scraping of any publicly available user data by any intermediary, including social media companies, for training AI models or any other purpose is regulated under the Information Technology Act, 2000 (IT Act) and its rules.”
He further explained, “Section 43 of the IT Act imposes penalties for unauthorized access to computer systems and provides compensation for damages to affected parties. Additionally, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, require intermediaries, including social media platforms, to prevent users from hosting, displaying, uploading, or sharing content that violates any law. These companies must also implement measures to ensure data protection and prevent unauthorized data access.”
Expanding on the issue, Prasada added, “The Digital Personal Data Protection Act, 2023 (DPDP Act), mandates that organizations involved in digital personal data processing, including web scraping of publicly available user data, implement robust compliance measures. This includes obtaining consent for specified purposes before processing digital personal data and respecting individual rights.”
Furthermore, the DPDP Act establishes a strong accountability framework to ensure the lawful processing of digital personal data. The Data Protection Board of India serves as an independent adjudicatory body empowered to investigate complaints, conduct inquiries, and impose penalties of up to ₹250 crore for non-compliance with the Act’s provisions, Prasada stated.