A New Mexico judge’s order that Meta pay $25 billion for deceiving Facebook users about their privacy is the heaviest penalty the company has faced. The ruling was blunt: “Facebook promised users that they controlled their data. This was false.” Meta will appeal. But the case revives the Cambridge Analytica scandal, in which data from about 87 million Facebook profiles was harvested to target voters in the 2016 US election. That scandal was the starkest illustration of surveillance capitalism, the business of tracking people’s clicks, purchases and movements and selling predictions of how they will behave. The world has drifted deeper into it since, as apps and devices collect more than ever and the promise of user control wears thinner.

Then there is the downright cavalier approach to keeping data safe, and Indian institutions offer plenty of examples. The latest is State Bank of India, which disclosed this week that its customer records were among some 375,000 said to be on the dark web. Its filing came five days after the alert and did not say whether customers had been told or how the data left its systems. Also this week, eMudhra, a Bengaluru company trusted by global browsers to vouch for websites, was found to have generated security keys so weak that one of them was simply the number 4. Anyone who cracked them could have impersonated any website and intercepted its users’ traffic. Such lapses are not new. The ransomware attack on AIIMS in 2021 put patients’ data at risk and disrupted critical health services. Breaches like these feed a dark web already thick with Indians’ phone numbers, addresses and dates of birth.

Citizens have little recourse. No law now in force clearly obliges a company to tell people of a leak; that duty under the Digital Personal Data Protection Act begins only on May 13, 2027. The IT ministry’s instinct was to reassure, calling the impact of the eMudhra lapse “very limited” and warning against “fear mongering”. While the ministry has constituted a probe, it should ensure that violations are treated with the seriousness they deserve by all stakeholders.

The Supreme Court recognised privacy as a fundamental right in 2017. Nine years on, Indians cannot even count on being told when, or how badly, that right is breached.