Consumer-protection law is emerging as a potent tool to discipline Big Tech on data privacy. Examine with reference to recent global cases, and assess its relevance for India.

In October 2026, New Mexico ordered Meta to pay a $25 billion civil penalty under its Unfair Practices Act. The penalty was for deceiving users about privacy, not for a data breach [1]. Because consumer law punishes the gap between what a firm promises and what it does, it is becoming a strong check on Big Tech.

Recent global cases

• Meta–New Mexico (2026): Meta made deceptive claims on privacy and hate-speech moderation, did not keep its data-deletion promises and failed to oversee third-party developers. The jury's figure was more than $219 billion at $5,000 per violation [1].
• FTC–Facebook (2019): Facebook paid a $5 billion penalty for misleading users about how much control they had over their data. The FTC called it the largest privacy penalty ever [2].

Why consumer law is potent

• Deception is enough: a regulator needs neither a dedicated data law nor a breach [1].
• Leadership accountability: the court linked the "willful violations" to the CEO. It found that users were pushed into sharing more data through confusing settings, which is a dark pattern [1].
• Liability grows with scale: the more users deceived, the higher the penalty. The judge cut the figure by nearly nine-tenths, which shows courts can still keep penalties proportionate [1].

Relevance for India

• The legal basis exists: the CCPA's Dark Patterns Guidelines, 2023 were issued under Section 18 of the Consumer Protection Act, 2019. They treat 13 dark patterns as unfair trade practices [3].
• Deterrence is weak: the CCPA has fined PhysicsWallah ₹5 lakh and McAfee ₹1 lakh [4].
• Self-regulation: platforms were asked to audit themselves [5]. A self-declaration cannot uncover deliberate deception. New Mexico proved it from internal messages [1].
• It fills DPDP gaps: the DPDP Act, 2023 has no right to be forgotten and does not regulate harm to users [6]. Its penalties are capped for each type of default, up to ₹250 crore, whatever the platform's size [7].

Way forward

• Link CCPA penalties to turnover, and let courts review them for proportionality.
• Give the CCPA power to investigate a company's internal records.
• Make the CCPA and the Data Protection Board work together.
• Restore the right to erasure, as the JPC recommended [6].

These global cases show that consumer law can discipline Big Tech where data laws fall short, by punishing broken promises. India should use the Consumer Protection Act and the DPDP Act together, backed by fines that deter and by independent investigation. That would turn the right to privacy upheld in Puttaswamy (2017) into real protection for users.