'Pronto's use of customer data early test of DPDP Act implementation'

Instant home-services startup Pronto’s use of customer interaction data to train artificial intelligence (AI) models is emerging as an early test of how far Indian startups can go in turning user activity into AI infrastructure, legal and technology policy experts said.

 

The issue has also brought back focus on unresolved issues likely to crop up during the on-ground implementation of the Digital Personal Data Protection (DPDP) Act, particularly regarding the use of personal information for AI training, the experts said.

 

“While user consent may be obtained for data collection, significant ambiguity remains around the principle of purpose limitation, specifically whether data shared for the provision of a service can subsequently be repurposed for training AI systems, especially in cases where individuals may not have reasonably anticipated large-scale machine learning use of their information,” said Kamesh Shekar, associate director at technology policy advocacy body The Dialogue.

 

The DPDP Act allows companies to collect personal data for a stated purpose, but using the same information to train AI systems may require fresh, explicit consent, according to Salman Waris, managing partner at tech law firm TechLegis Advocates & Solicitors.

 

“A startup cannot quietly repurpose transactional or behavioural data for model training without fresh, explicit consent from the data principal,” said Waris.

 

Following reports that Pronto and other startups, as well as companies, have been using such data to train their AI models, the Ministry of Electronics and Information Technology (Meity) is likely to look into the legality of these service models and whether they violate any provisions of the DPDP Act, a senior government official said.

 

“Though both the (DPDP) Act and its rules have been notified, some portions are yet to be operationalised. Companies have been given some runway to put in place a compliance framework. We are looking into the issue to see if there are any violations,” the official added.

 

India’s data-protection framework offers some guardrails but leaves wide room for interpretation in how those rules apply to AI training. Under the DPDP Act, companies designated as data fiduciaries are expected to collect only the data necessary for a disclosed purpose and erase it once that purpose has been fulfilled. AI model training complicates that principle because information may continue to influence models long after the original transaction ends.

 

As scrutiny grew over allegations that Pronto recorded videos inside customers’ homes to train AI systems, rival service providers moved quickly to distance themselves from it.

 

“In light of recent reports regarding recordings inside customers’ homes by one of our competitors, many people have asked whether Urban Company engages in anything similar, or intends to do so in the future. The answer is clear and unequivocal: We do not,” said Urban Company Chief Executive Officer (CEO) Abhiraj Singh Bhal on X (formerly Twitter).

 

“We are in the business of trust, and we take customer trust and privacy extremely seriously. We do not engage in any such activities, have never done so in the past, and have no plans to do so in the future. Our customers’ privacy is paramount to us, and we remain fully committed to upholding the highest standards of confidentiality, safety, and trust,” Bhal said on X.

 

Aayush Agarwal, founder and CEO of Snabbit, another rival of Pronto, also clarified on X that the company does not engage in any such practice.

 

“No customer's home has ever been recorded by us, in any way. When customers let our experts in, they place immense trust in us: that our experts are verified, well-trained, and that their privacy is absolute. We don't take that lightly,” Agarwal said on X.

 

“In the interest of transparency, yes, we were approached by several players, and yes, we have studied how this technology works. But understanding something and deploying it in our customers' homes are two very different things. We have not done the latter, have no partnership with anyone in this regard, and have no intention of changing that. We're in the business of home services and of trust. We intend to keep it that way,” Agarwal said.

 

Waris of TechLegis said there is little regulatory clarity on whether using personal data to train AI constitutes a permissible extension of service delivery or a separate purpose that requires renewed consent. Courts and regulators have yet to establish precedents on the derivative use of consumer data for AI development.

 

The Pronto case could also signal a broader shift across consumer internet companies. As AI becomes central to product development, startups may increasingly treat customer behaviour, language, and transactions not simply as usage signals but as training inputs for proprietary systems.

 

“Consumer-facing startups treat their user base not merely as customers but as data labellers, with their real-world behaviour, language, and decisions becoming the raw material for proprietary AI systems,” Waris said.

 

For now, India lacks an AI-specific law, mandatory algorithmic disclosure requirements, or a dedicated authority focused on oversight of model-training practices. Existing protections remain fragmented across the DPDP Act, the Information Technology Act, and sector-specific frameworks such as those overseen by financial and insurance regulators.

 

If such practices become widespread, legal experts expect regulation to tighten. They said policymakers responding to public backlash or high-profile misuse often move quickly, creating compliance burdens that larger incumbents can absorb more easily than startups.

 

Litigation risk is also likely to rise as consumer awareness grows and public interest litigation (PIL) increasingly becomes a mechanism for accountability.

 

Waris, however, also believes that the longer-term threat may be less legal than behavioural.

 

“Once users internalise that signing up for a delivery app or a tutoring platform means contributing to a commercial AI asset they have no stake in, the social contract underlying the ‘free service for data’ economy fractures,” Waris said.

 

That erosion of trust, he said, could push users towards competitors, encourage complaints to regulators, or lead consumers to deliberately limit or distort the data they share.

 

As more consumer companies seek to convert transactions and behaviour into proprietary models, the debate is expanding beyond compliance to consumer trust and the boundaries of data use.

 

“As AI ecosystems continue to mature, these challenges underscore the need for more sophisticated consent and governance frameworks, including dynamic consent mechanisms, standardised AI transparency disclosures, and risk-tiered regulatory obligations that can better balance innovation with user autonomy, accountability, and data protection principles,” Shekar said.