Body Without Consent: Virtual Try-On, Biometric Body-Scanning, and the Blind Spot in India’s DPDP Regime

Introduction

A shopper browsing a fashion e-commerce platform uploads a full-body photograph to visualise how a garment might fit before purchase. Within seconds, the platform’s AI analyses body proportions, silhouette, and often facial geometry to generate a virtual try-on or size recommendation. What looks like a routine convenience feature simultaneously enables the collection of intimate, body-derived data. Most users, and many commentators, would assume Indian law treats such information the way the GDPR does: as specially protected biometric data. That assumption is mistaken. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) abandons the earlier distinction between ordinary and sensitive personal data, subjecting a facial scan to the same statutory framework as an email address. This article argues that virtual try-on technology across Indian fashion e-commerce exposes the resulting regulatory blind spot. It shows, first, that omitting a biometric category was a deliberate legislative choice, not an oversight; second, that virtual try-on tools extract identifying body data without triggering any enhanced safeguard; and third, that the Act’s remaining institutional check, Significant Data Fiduciary status, offers no meaningful backstop for this sector today.

The Missing Category: Biometric Data Under the DPDP Regime

Deliberate Departure

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules”) expressly classified biometric information as sensitive personal data, alongside financial records and passwords, requiring heightened security for its collection. The Committee of Experts chaired by Justice B.N. Srikrishna, constituted by the Ministry of Electronics and Information Technology to draft India’s first comprehensive data protection framework, preserved this distinction in its 2018 report and accompanying draft Bill, treating sensitive personal data , including biometric information, as warranting a materially higher standard of protection because its processing could cause disproportionate harm to the individual. The Personal Data Protection Bill, 2019 and the Joint Parliamentary Committee’s subsequent report retained this same architecture through further rounds of legislative scrutiny. The DPDP Act broke from this trajectory. Section 2(t) defines “personal data” in a uniform, technology-neutral manner, with no separate category for sensitive information. Recent scholarship examining the Act’s jurisprudential foundations identifies this absence of data categorisation as one of the central structural gaps in the Indian framework, contrasting it directly with category-based models such as the GDPR. The practical result: a facial scan generated by a virtual try-on system today receives no more statutory protection than a delivery address.

Note: This figure is generated by the authors to depict the legislative evolution of biometric data protection in India from the SPDI Rules to the DPDP Act, 2023 (SDF obligation will become operational by May 2027).

The Section 8 Mirage

Biometric data appears only once in the Act, in Section 8, governing “deemed consent.” Its illustration involves an employee providing a fingerprint for attendance, consent to which is presumed solely for that purpose. This provision is sometimes read as an implicit biometric safeguard. It is not. Section 8 identifies when consent may be inferred in one narrow scenario; it does not create a distinct protected category, raise the consent threshold, or restrict subsequent use of biometric data. Outside that illustration, body-derived data is governed by the same general obligations as any other personal data, regardless of its heightened capacity to identify or profile an individual.

FLJ Insider Pro is open: live fashion law jobs and internships, five career guides and two roadmaps. Early bird USD 12/month. See what's inside

The Comparative Baseline

Article 9 of the GDPR classifies biometric data used for unique identification as a “special category,” presumptively prohibited from processing except under narrowly enumerated grounds, generally requiring explicit consent. India’s earlier drafts reflected this same philosophy before the DPDP Act departed from it, leaving technologies that process body-derived data, particularly virtual try-on systems, within a framework that recognises neither the distinctive nature of that data nor the risks of its commercial exploitation.

Body-Scanning in Fashion E-Commerce: Where the Gap Bites

What the Technology Captures

Platforms such as Myntra, Ajio, Nykaa Fashion, Lenskart, and CaratLane now use AR and computer vision to let shoppers visualise apparel, eyewear, cosmetics, or jewellery before purchase. These systems analyse body proportions, facial landmarks, skin tone, and silhouette geometry to generate overlays and sizing recommendations. Though this data may not be “biometric” in the classical fingerprint-or-iris sense, it produces persistent, re-identifying body profiles. The legal significance lies not in the photograph itself but in the algorithmic extraction of measurable physical characteristics from it; precisely the category of data that falls into the DPDP Act’s blind spot.

Consent That Isn’t Specific

Section 6 requires consent to be free, specific, and informed, supported by an itemised notice. In practice, virtual try-on is activated through a single request for camera access or a photo upload, with body-scan extraction disclosed nowhere separately; instead folded into general privacy policies accepted at sign-up. A 2023 policy analysis by the Observer Research Foundation, prepared for consideration in India’s forthcoming Digital India Act, similarly flags the absence of transparent, itemised consent mechanisms specifically for biometric-adjacent data as a structural weakness of the current regime.  Because body-derived data carries no elevated status, no rule compels platforms to isolate this consent from blanket account-level consent, leaving the statute’s specificity requirement unmet in practice.

Safeguard That Isn’t There Yet

The Act’s main institutional check, Significant Data Fiduciary (“SDF”) status, brings mandatory audits, a Data Protection Officer, and impact assessments. But SDF designation is discretionary, based on government notification rather than the sensitivity of data processed under Section 10, and no fashion or beauty platform has yet been designated. Even where SDF obligations eventually apply, they do not take effect until eighteen months after the 2025 Rules were notified; it will become operational by May 2027. A platform scanning bodies today therefore sits outside both the category-based protection India once had and the institutional check the Act defers to later.

Note: This diagram is generated by the authors to illustrate the regulatory blind spot in the Digital Personal Data Protection Act, 2023, for AI-powered virtual try-on technologies.

Conclusion and Recommendation

The Supreme Court grounded informational privacy in the right to life partly because some data is more intimate and more permanent than the rest. The DPDP Act’s uniform treatment sits uneasily against that reasoning, and virtual try-on technology shows exactly where the strain becomes visible: a sector collecting body data for an entirely commercial purpose, without the consent precision or retention limits its sensitivity would otherwise demand. Lack of a specific class does not imply safe data — it means that some sort of protection was not provided for it. The Act contains a narrow solution: the Data Protection Board should recommend that the Central Government use the power provided to it under Section 10 of the Act to declare the data of body and face scans used for virtual fitting a separate category that would require separate informed consent and a limit on the data retention to completing the purchase transaction rather than the lifetime of the account. However, if this step is not taken, this gap would not be reduced.

Author: Subham Sourav

Subham Sourav is a fourth-year B.A. LL.B. (Hons.) student at the National University of Study and Research in Law (NUSRL), Ranchi, with research interests spanning technology law, artificial intelligence governance, intellectual property, data protection, and regulatory policy. His work has been published on platforms including the Kluwer Patent Blog, the Indian Journal of Law and Technology at NLSIU, and the Vidhi Centre for Legal Policy. He has also contributed a chapter to Bloomsbury Publishing India’s volume WTO and Digital Trade. He has earned several accolades in national-level research, policy formulation, debate, drafting, and advocacy competitions.