From “I Agree” to “I Understand”: Why Digital Privacy Literacy Matters in the Age of Data Farming

The article explores the need for digital privacy literacy in an age of data farming, examining meaningful consent, protecting children’s privacy from artificial intelligence, India’s emerging data-protection framework, and how individuals can use the law to challenge even the biggest companies in the world.

It is 01.11 a.m. a person lying on the bed is scrolling across a glowing screen sees an interesting app suggestion. Installs it. A privacy notice flashes on screen. There are references to data collection, sharing, analytics, personalisation, cookies, third parties and retention. The thumb pauses for a fraction of a second over a small blue rectangle, taps “I Agree” and moves on. Total time elapsed: 1.2 seconds.

The person holding the phone may be highly educated, perfectly capable of reading the notice, and still have no meaningful idea what they have just accepted.

That is not a failure of traditional literacy. It is a failure of a literacy that we have only recently discovered to be crucial in this digital age where data mining is becoming a new normal.

What does it mean to be literate when our lives are continuously turned into data?

United Nations Educational, Scientific and Cultural Organization (UNESCO) has been celebrating International Literacy Day on 8 September since its proclamation in 1966. 2026 marks the 60th anniversary of International Literacy Day, which is being celebrated under the theme “Literacy for people, the planet and prosperity”. UNESCO took the opportunity to urge a revisit to the definition of literacy; what it means to be literate in a rapidly changing world; and the importance of media and information literacy in the digital era.¹

Perhaps one of the most important additions to that conversation is digital privacy literacy.

1. We are no longer just using internet; we are feeding it

Every time we breathe on the internet, like shop, navigate, watch, text, search or even just a simple click, we leave a digital footprint. A fragment of information may be created, collected or stored whenever we apply for a service or interact with a digital platform, and we may never know who has access to that data.

UNESCO’s Media and Information Literacy Curriculum for Educators & Learners makes this observation in its dedicated module titled Privacy, Data Protection and You. It notes that digital activity creates data through purchases, government transactions, healthcare, search engines, social media and other interactions, raising questions about who has access to that data, how it is used and what permission individuals have given for its use.²

I call this data farming.

A farm extracts value from what it grows. The digital economy increasingly extracts value from what we produce simply by living through connected systems: our searches, movements, purchases, interactions and choices.

“Data farming” is not a term of law, but it captures a reality that policymakers are increasingly recognising: personal data is being continuously collected, aggregated and turned into an economic resource, often without people fully understanding how much information they are giving away.³ It is a useful description of an economy in which cataloguing human behaviour becomes an increasingly valuable resource.

Unfortunately, unlike a regular field, this farm does not have fences.

One would rarely consciously provide their confidential information. However, a series of ordinary actions can produce an extraordinary picture of an individual. UNESCO therefore identifies awareness of the commodification and monetisation of personal information, informed decisions about what to share, the ability to evaluate organisations’ data-management practices and the ability to understand privacy risks and adjust privacy settings as core privacy competencies.⁴

This is what digital privacy literacy must include, i.e. going beyond the ability to create a “strong password”. Being aware enough to ask questions like:

1. What am I giving away? Why do they need it? What can they infer from it? Who else might receive it? And what happens when I want to take back control?

Or even a basic question like, why does my new alarm app need access to my contacts and call logs? You get the point.

2. “I Agree”, the easiest button on internet but not always the easiest choice

We have become accustomed to treating consent as just another button. But consent is not meaningful merely because a button was pressed. The problem may begin with the architecture of the choice itself.

In July 2026, the Central Consumer Protection Authority (CCPA) imposed a Rs 1 lakh penalty on SpiceJet for using deceptive design practices, commonly described as “dark patterns”, on its flight-booking platform. The CCPA found that consumers were automatically enrolled in their Spice Club loyalty programme through a pre-ticked checkbox and were treated as having agreed to receive promotional messages because of the default option. CCPA also identified such practices as “Trick Question”, “Interface Interference” and “Forced Action” practices, and held that the conduct impaired consumer autonomy and informed decision-making.⁵

Also Read: CCPA directs SpiceJet to pay Rs 1 Lakh fine for using “dark patterns” on booking platform | SCC Times

The point extends far beyond airline bookings. Sometimes the problem is not that the user failed to read the choice. The choice itself may have been designed to push the user in one direction.

The European Data Protection Board (EDPB) has confronted a related problem in its 2024 opinion on “consent or pay” models used by large online platforms for behavioural advertising. The EDPB stated that consent must involve a real choice and observed that, in many circumstances, a model forcing users to choose between behavioural advertising and paying for the service would not satisfy the requirements for valid consent.⁶

The lesson is important because privacy literacy must not become another way of blaming individuals. It is not enough to tell people, “You should have read the notice.” We must also ask whether the environment gave them a meaningful choice, and whether it was an ergonomic coercion, which is a type of digital coercion.⁷

3. Then there is the child with a smartphone

In the case of most adults, they at least have some experience of contracts, persuasion, advertising, consequences or just good old-fashioned experience with life. On the contrary, children are learning all of this while growing up inside the system itself.

A child may download a game, join a platform, search for help with homework, upload a photograph, or start a conversation with a “fun” AI bot. To the child, it may simply be conversation. To the system, it may also be data. That distinction is becoming increasingly important to impart to them.

The UN Committee on the Rights of the Child recognises that the digital environment now encompasses AI, automated systems, algorithms, data analytics, biometrics and other rapidly evolving technologies, and makes clear that children’s rights continue to apply within that environment.⁸

United Nations Children’s Fund’s (UNICEF) Guidance on AI and Children, published in December 2025, places protection of children’s data and privacy among its ten requirements for child-centred AI. The guidance responds to emerging forms of artificial intelligence, including generative AI and AI companions, alongside wider risks to children’s safety and rights.⁹

The issue, therefore, is not merely that children are “online”. Rather, the real concern is that children are increasingly becoming data-generating participants in systems they may not fully understand. This changes how we look at privacy education and what it must accomplish.

UNESCO recommends teaching digital footprints, online reputation, privacy settings, the permanence of online information and the implications of data generated through searches and browsing. It even proposes classroom exercises in which students search for themselves online and examine critically what different search engines reveal about them.¹⁰

This suggests a better model for teaching children privacy principles. Not a superficial lesson like: “Do not share your password.” Rather, simple but effective logical reasoning like:

A photograph can reveal more than the photograph itself.

A location can become a pattern.

A pattern can become a profile.

A conversation can become a record.

And before sharing something deeply personal with an AI model, a child should learn a simple litmus test which starts with asking the question: Would I be comfortable if this information became public? The answer might not always be a “no”.

The aim of privacy literacy is not to induce fear of technology among children. Rather, it is about giving them enough understanding to use it without surrendering judgment.

4. India has given privacy a constitutional vocabulary. We now need to give citizens a practical one.

In K.S. Puttaswamy (Privacy-9J.) v. Union of India¹¹ a nine-Judge Bench of the Supreme Court recognised privacy as a constitutionally protected right, rooted in Article 21, with liberty, dignity and autonomy, and recognised informational privacy as an aspect of that right.

The Digital Personal Data Protection Act, 2023 (DPDP Act) gives this right a statutory framework. It identifies the individual/users as the “data principal” and the entity determining the purpose and means of processing as the “data fiduciary”. The Act provides rights relating to access to information about personal data, correction and erasure, grievance redressal and nomination. Section 9 contains specific provisions concerning children’s data, including verifiable parental consent and restrictions concerning detrimental processing, tracking, behavioural monitoring and targeted advertising, subject to the statutory framework and prescribed conditions.¹²

India’s privacy framework is still at a nascent stage, while the digital ecosystem continues to expand. The DPDP framework is being implemented in phases. While some provisions have already taken effect, the Act’s core substantive provisions, along with several key provisions of the Rules¹³ are scheduled to come into force on 13 May 2027, as per the Ministry of Electronics and Information Technology’s (MeitY) November 2025 notifications.¹⁴

But the larger point does not depend upon the commencement date; it depends on us. A legal right hardly has a value to a person who does not know that the right exists, what it protects or how it can be exercised. That is where literacy becomes indispensable.

5. David versus Goliath: Literacy makes it less daunting

The average citizen might see technology companies as giants. The company has teams of engineers, lawyers, compliance departments and vast resources. Whereas an individual has a phone. That imbalance can make legal rights appear theoretical or reserved for elites.

Privacy law, however, has a different kind of story to tell, as the David versus Goliath idea is not merely rhetorical.

Let us look at the experience of Max Schrems, an Austrian privacy activist who challenged the transfer of his personal data from Facebook’s European operations to the United States of America (USA). His concern was straightforward: If European users’ data was being transferred to the USA, what protection did that data actually have once it was under USA authorities’ reach?

His complaint eventually reached the Court of Justice of the European Union (CJEU). In Maximillian Schrems v. Data Protection Commr. (Schrems I)¹⁵ the Court invalidated the European Commission’s “Safe Harbour” arrangement that had allowed companies to transfer personal data from the European Union (EU) to the USA, finding that it did not provide adequate protection against interference by the USA’s authorities.

Our David, Max Schrems, did not stop there. In Data Protection Commr. v. Facebook Ireland Ltd. (United States of America and others intervening) (Schrems II)¹⁶ the CJEU again examined the safeguards governing transfers of Europeans’ personal data to the USA. CJEU invalidated the EU—US “Privacy Shield” framework, while holding that standard contractual clauses could remain valid, provided that adequate protection could actually be ensured in practice.

The significance of Schrems cases is therefore not that one individual somehow “defeated Facebook”. It is that one individual’s curiosity to understand what happened to his data triggered legal scrutiny and a domino effect that ultimately changed the rules governing international data transfers. That’s the potential of privacy literacy; it can give individuals the knowledge to recognise when their privacy is at stake, the confidence to question what is being done with their data, and the legal tools to hold even the institutional giants accountable.

6. From “I Agree” to “I Object”: WhatsApp’s Story

India offers a more recent example which shows why privacy literacy matters. In 2021, WhatsApp updated its privacy policy and asked Indian users to accept expanded terms on data sharing with Meta companies. Users who did not accept the update risked losing access to WhatsApp, a service which essentially monopolised messaging services. The issue therefore raised a larger question: whether a user who had little practical alternative could meaningfully refuse it.

The Competition Commission of India (CCI) examined the policy through the lens of competition law. The CCI found that WhatsApp, by virtue of its dominant position in the market for messaging services, had imposed unfair conditions on users by requiring them to accept expanded data collection and sharing without a meaningful opt-out. The CCI also found that the data collected through WhatsApp could further strengthen Meta’s position in the online advertising market. Thus, the CCI imposed a penalty of Rs 213.14 crore and directed WhatsApp to provide greater transparency and user choice over the sharing of data.¹⁷

In November 2025, the National Company Law Appellate Tribunal (NCLAT) largely upheld these findings. It recognised that privacy can have a direct implication on competition: when a dominant platform can make access to its service conditional on accepting extensive data-sharing terms, the resulting loss of user choice can itself become a competition concern. The NCLAT also emphasised a principle that is particularly relevant here: users should retain the ability to decide what data is collected, for what purposes, and whether it can be shared beyond what is necessary to provide the service.¹⁸

The WhatsApp case therefore illustrates the other half of the problem. Privacy literacy is not merely about teaching people to read a privacy policy. Rather, it is about enabling them to recognise when an apparently routine “accept” button conceals a consequential choice and to know where such choices can be questioned through law.

The lesson is not that every privacy grievance will become a landmark case. It is that size does not put an institution beyond the reach of law. That is a lesson worth remembering.

7. What should teachers teach?

India has just observed Teachers’ Day on 5 September, a day observed on the birth anniversary of Dr Sarvepalli Radhakrishnan¹⁹. The timing offers an apt connection with International Literacy Day. A teacher’s job in the 21st century cannot be completed by just teaching a child how to read information. They must also help the child understand how the digital world is reading them.

Although we can neither expect every teacher to become a data-protection lawyer nor is it required. Instead, it requires teaching habits.

While granting permission: Why does this app need it?

While uploading a photograph: What else does this reveal?

While telling an AI something deeply personal: Would I be comfortable if this information became public?

While clicking “Accept”: What am I actually accepting?

While assuming tech giants cannot be challenged: What rights or remedies are available?

UNESCO‘s own framework points in precisely this direction through proposed privacy competencies. This includes understanding the value of privacy rights, recognising the commodification of personal information, exercising informed judgment over disclosure, evaluating organisations’ data-management practices and understanding privacy risks in digital environments.²⁰

That is what privacy literacy really looks like when it leaves the textbook and becomes a life skill.

8. Privacy is beyond having something to hide

Privacy matters not only because information can be misused, but because it is directly connected to an individual’s independence and personal liberty. UNESCO connects privacy with autonomy, freedom of expression, and freedom of information, and notes that fear that activity can be traced can cause people to self-censor, including journalists and whistle-blowers who may need anonymity.²¹

Privacy, in that sense, has a much wider interpretation. It is about owning enough space to think, speak, experiment, dissent, and make mistakes without every chapter of one’s life becoming conveniently accessible to someone else. That is why digital privacy literacy is ultimately about having agency.

Therefore, it is also why the answer cannot be entirely left to the individual.

For instance, Australia is currently developing a Children’s Online Privacy Code²² under its Privacy Act, 1988. The Australian Information Commissioner’s 2026 exposure draft places children’s interests at the centre of online privacy protections and proposes safeguards around targeted advertising, children’s requests for deletion and the handling of children’s personal information. The draft is currently under consultation, with the final Code required to be registered by 10 December 2026.

The direction is instructive: children cannot be expected to carry the entire burden of protecting themselves in environments built by adults and operated by powerful institutions. Law, design, schools, parents, regulators, and platforms all have responsibilities. However, literacy remains one of the few forms of protection that travels with the individual everywhere.

Conclusion: From “I Agree” to “I Understand”

Literacy has always been about more than recognising words. It is about understanding what those words mean and being able to act on that understanding. In the digital world, that principle has acquired a new dimension. A person may be perfectly capable of reading a privacy policy and still be unable to understand what agreeing to it means for their data, their choices and, ultimately, their autonomy.

The challenge, therefore, is not to make everyone a lawyer or a technology expert. It is to give ordinary users enough understanding to recognise what is happening to their information, question practices that affect them, and know what choices and remedies are available to them. Privacy literacy turns the user from a passive recipient of terms and conditions into an informed participant in the digital economy.

This matters because the imbalance of power is real. A person clicking “I Agree” is often dealing with an institution that has lawyers, engineers, data scientists, and vast quantities of information at its disposal. The answer cannot simply be to tell the individual to read more carefully. It must also be to build a culture in which individuals understand their rights, institutions are expected to exercise power responsibly, and the law provides meaningful avenues to challenge abuse.

That is why privacy literacy is not merely a matter of personal caution. It is a question of democratic participation. If data can influence what we see, what we are offered, how we are profiled and even what we feel safe enough to say, then understanding how data is collected and used becomes part of understanding the society in which we live.

The internet has made data farming ordinary. It must not make helplessness ordinary too.

On this International Literacy Day, perhaps literacy should mean something more than just knowing how to read “I Agree.” It should mean knowing what we are agreeing to, what it means, when we can question it, and when we should say no.