Algorithmic Consent and Digital Contracts: Are AI Platform Terms of Service Legally Enforceable in India?
Author: Shravani Bhanuse
Co-Author: Shrushti Bhaltadak
Student, Maharashtra National Law University, Mumbai
———————————————————————————————————————–
đź’ˇ 3 Quick Takeaways
1. AI platforms increasingly rely on broad Terms of Service to justify new forms of data use that users neither expected nor expressly consented to.
2. Although electronic contracts satisfy formal contractual requirements, they often fail to meet the substantive standards of free, informed, and specific consent under Indian law.
3. Existing legal principles under the Indian Contract Act, the Information Technology Act, and the Digital Personal Data Protection Act provide a foundation for regulating AI contracts but require more technology-specific application.
Abstract
This paper examines whether the Terms of Service (ToS) of artificial intelligence (AI) platforms constitute legally enforceable contracts in India, particularly in light of the Grok AI incident. The incident, involving the large-scale generation of manipulated and doxed images using users’ data, raises significant questions regarding the validity of consent obtained through electronic agreements.
The article analyses how AI platforms rely upon clickwrap agreements and pre-existing Terms of Service to facilitate broader uses of personal data, including purposes that were neither expressly disclosed nor reasonably foreseeable at the time users accepted the agreement. It argues that these practices give rise to a form of algorithmic consent that may be formally valid but is substantively defective.
The discussion is situated within the framework of the Indian Contract Act, 1872, the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and relevant judicial precedents. The paper concludes that although electronic contracts generally satisfy the formal requirements for contract formation, substantive requirements such as free consent, certainty of terms, and considerations of public policy are frequently absent.
The article further contends that while existing legal doctrines are capable of invalidating such agreements, they require more effective application in the context of emerging AI technologies. Accordingly, it advocates clearer disclosures, AI-specific consent mechanisms, and stronger regulatory oversight to ensure that digital consent is genuinely informed rather than merely procedural.
I. Introduction
The emergence of artificial intelligence (AI) platforms has significantly transformed digital contracting, particularly through Terms of Service (ToS) agreements. Although these agreements are routinely accepted through clickwrap mechanisms, the quality and validity of user consent have increasingly come under scrutiny in data-driven digital ecosystems.
In December 2025, users of Grok AI discovered that the platform could generate pornographic deepfake images using profile photographs obtained from X, resulting in the creation of more than 1.8 million manipulated images. X defended its actions by relying upon broad Terms of Service provisions permitting the use of user data to “improve services.” While the Indian Government responded to the incident under the Information Technology Act, 2000, important questions regarding the validity of contractual consent remained unresolved.
This article analyses the Grok incident through the framework of Indian contract and data protection law to determine whether AI platform Terms of Service satisfy the legal requirements of free, informed, and meaningful consent. It also proposes reforms necessary to improve contractual protections within AI-based digital platforms.
II. Modes of Digital Consent and the Emergence of Retroactive Algorithmic Consent
Terms of Service governing AI platforms generally rely upon standardised forms of online contracting that differ in the degree of user participation. These methods significantly influence the legal validity of digital consent.
a) Clickwrap, Browse-wrap, and Shrink-wrap Agreements
A clickwrap agreement requires users to expressly accept contractual terms by selecting an “I Agree” option. This represents the strongest form of online consent and is recognised under Section 10A of the Information Technology Act, 2000, which validates electronically executed contracts provided the requirements of a valid contract are otherwise satisfied.
A browse-wrap agreement requires no explicit acceptance. Users are deemed to have accepted the terms merely by continuing to use a website after being provided access to the Terms of Service through a hyperlink. Because users may never actually review the terms, this model provides the weakest form of consent.
A shrink-wrap agreement combines aspects of both approaches by requiring affirmative acceptance while making the contractual terms accessible through a hyperlink. This model is widely used by major digital platforms during account registration.
b) Retroactive Algorithmic Consent
The Grok incident introduces a more problematic category that may be described as retroactive algorithmic consent.
When the Grok Imagine feature was introduced in August 2025, users were not required to provide fresh consent. Instead, X relied upon previously accepted Terms of Service to authorise an entirely new use of personal photographs for AI-generated image creation. Users who had consented to general data processing suddenly became subject to substantially different data practices without any renewed contractual acceptance.
The platform also made opting out unnecessarily difficult by requiring users to navigate multiple settings menus. Such retrospective expansion of contractual consent cannot reasonably be characterised as a neutral contractual modification.
This concern is reinforced by X Corp. v. Union of India, where the Karnataka High Court observed that algorithmic platforms cannot evade liability by invoking technological neutrality. Although the matter remains pending in appeal, the decision recognises that platform architecture and consent design possess independent legal significance.
Consequently, the design of consent mechanisms—including default opt-ins and inaccessible opt-out procedures—must be evaluated not merely as technical choices but as legally relevant aspects of contractual consent.
III. Validity of Consent under the Indian Contract Act, 1872
The enforceability of AI platform Terms of Service must ultimately be assessed against the essential requirements for a valid contract under the Indian Contract Act, 1872.
(1) Offer and Acceptance
In Trimex International FZE Ltd. v. Vedanta Aluminium Ltd., the Supreme Court recognised that electronic communications may validly constitute offer and acceptance under Sections 2(a) and 2(b) of the Act.
Although clickwrap agreements generally satisfy the formal requirement of acceptance, the acceptance must correspond to the terms originally offered. Where X’s original Terms of Service contained no reference to AI-generated image creation, users who accepted those terms before the launch of Grok Imagine cannot reasonably be regarded as having consented to a fundamentally different future use of their personal data.
(2) Misrepresentation (Section 18)
Section 18 provides that consent obtained through misrepresentation is invalid.
In Shri Krishan v. Kurukshetra University, the Supreme Court recognised that concealment of material facts may amount to misrepresentation.
The failure to expressly disclose that users’ photographs could later be employed for AI-generated image manipulation represents a material omission. A general statement permitting the use of data “to improve services” cannot reasonably be interpreted as informed consent for sophisticated AI image generation.
(3) Mistake (Sections 20–22)
Consent is equally defective where it is founded upon a fundamental mistake.
In Waman Shriniwas Kini v. Ratilal Bhagwandas & Co., the Supreme Court recognised that misunderstanding the nature of a transaction may invalidate consent.
Users who accepted X’s Terms of Service before the development of Grok could not reasonably have understood that their uploaded photographs would later become training material or source content for AI-generated images. Such misunderstanding concerns the very nature of the contractual arrangement rather than a collateral issue.
(4) Undue Influence (Section 16)
Section 16 addresses circumstances in which one party occupies a dominant position and exploits that advantage.
In Ladli Prasad Jaiswal v. Karnal Distillery Co., the Supreme Court emphasised that unequal bargaining power may undermine genuine consent.
Online Terms of Service are typically presented on a “take-it-or-leave-it” basis, leaving users with little practical bargaining power. Following the Grok controversy, the complexity of the opt-out process further strengthened the platform’s dominance by making withdrawal of consent unnecessarily burdensome.
(5) Certainty of Terms (Section 29)
In Rajasthan Cooperative Dairy Federation Ltd. v. Maha Laxmi Mingal Dairy, it was held that agreements containing uncertain terms are void under Section 29.
The broadly worded provision permitting data use “to improve and provide services” lacks sufficient certainty to encompass AI-generated image creation or the production of manipulated images. Extending such vague language to cover materially different technological applications creates contractual uncertainty and weakens enforceability.
Collectively, these considerations demonstrate that while AI platform Terms of Service may satisfy the formal requirements of contract formation, they frequently fail to satisfy the substantive requirements of valid consent under the Indian Contract Act, 1872.
IV. Validity of AI Platform Clauses and the Need for Reforms
Determining the enforceability of AI platform Terms of Service requires consideration not only of contract law but also of statutory and constitutional safeguards.
a) Bundled Consent and Inadequate Data Use Disclosure
Section 6 of the Digital Personal Data Protection Act, 2023 requires consent to be free, specific, informed, unconditional, and unambiguous. It also prohibits bundled consent for non-essential processing.
Using personal photographs for AI-generated image creation cannot be regarded as necessary for operating a social media platform. Consequently, such processing should not be bundled within general Terms of Service.
The Supreme Court’s decision in Justice K.S. Puttaswamy v. Union of India further reinforces informational privacy and bodily autonomy under Article 21.
Accordingly, the article recommends that rules framed under Section 6 expressly require separate consent for AI-generated image creation and manipulation.
b) Liability Waivers and Unconscionability
Liability exclusion clauses should be examined under Section 23 of the Indian Contract Act, which renders agreements contrary to public policy void.
In Central Inland Water Transport Corporation v. Brojo Nath Ganguly, the Supreme Court held that unconscionable terms within standard-form contracts are unenforceable.
Where AI platforms disclaim liability for foreseeable harms arising from AI-generated content, including deepfakes, such exclusions should not be enforceable. Section 2(46) of the Consumer Protection Act, 2019 similarly treats unilateral liability exclusions as unfair contractual terms.
c) Forum Shopping and Limitation of Liability
Several AI platform Terms of Service require disputes to be resolved exclusively before foreign courts, thereby making access to justice significantly more burdensome for Indian users.
Section 28 of the Indian Contract Act invalidates contractual provisions that restrain legal proceedings.
Similarly, Hussainbhai v. Alath Factory Thozhilali Union and Perkins Eastman Architects DPC v. HSCC (India) Ltd. demonstrate judicial reluctance to uphold dispute-resolution mechanisms that undermine genuine contractual consent.
The article therefore recommends an explanatory clarification under Section 28 invalidating jurisdiction clauses that effectively deny meaningful legal remedies.
d) Missing AI-Specific Consent Mechanisms
Beyond these deficiencies, the Grok incident reveals a more fundamental contractual problem: the absence of AI-specific consent mechanisms.
Current Terms of Service rely upon broad and continuing consent, enabling companies to deploy users’ data for future technological purposes that were neither specified nor foreseeable at the time of contracting.
The article proposes amendments to Section 10A of the Information Technology Act, 2000 requiring fresh and specific consent whenever new AI-powered features substantially alter the scope of personal data usage.
Similarly, clarification under Section 2(b) of the Indian Contract Act should expressly recognise that agreement cannot be inferred for unspecified future technological developments.
Overall, these reforms would ensure that the enforceability of AI platform contracts depends not merely upon technical acceptance but upon genuinely informed, relevant, and specific consent.
V. Conclusion
The Grok AI incident demonstrates the limitations of existing online contractual frameworks when applied to rapidly evolving AI technologies.
Although X relied upon users’ previous acceptance of its Terms of Service to justify AI-generated image manipulation, such consent failed to satisfy the requirements of validity, specificity, and voluntariness under Indian contract and data protection law.
Broad contractual clauses, retrospective data-use provisions, bundled consent, liability waivers, and foreign jurisdiction clauses collectively weaken the enforceability of AI platform agreements.
The article demonstrates that the principal challenge does not lie in the absence of legal safeguards. Rather, existing legal principles have yet to be adequately adapted to emerging AI technologies.
The Indian Contract Act, 1872, the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and constitutional privacy jurisprudence already provide a strong legal foundation. However, AI platforms require more precise statutory protections, including AI-specific consent mechanisms, renewed consent for materially different technological uses, and greater regulation of unfair contractual terms.
Ultimately, consent within AI contracts should represent genuine understanding, freedom, and fairness rather than a mere click-through formality.
Disclaimer: The views expressed in this article are those of the author and do not necessarily reflect the views of The Lawscape.
The Lawscape — clear, practical legal insight for students and future lawyers.