Introduction
Artificial intelligence (“AI”) agents are not merely responding to user queries. They are now operating on behalf of a person. To carry out these functions, they require extensive access to a user’s stored device data. A controversy between Meta and a tech analyst centred on Meta’s Muse agent has now led to pressure on Apple to act. Apple has said it will change macOS to show users more clearly when AI agents request access to all data on a Mac. This incident did not originate in India, but it questions for Indian regulators, employers and consumers once agentic AI reaches Indian devices.
The Development in Brief
On iPhones and iPads, Sandboxing keeps apps isolated from one another where one app cannot access another app’s data. The situation is different on Macs. The operating system has a feature called Full Disk Access which allows an app like a backup tool to access almost any file on the hard drive. Jason Aten, in his technology column, accused Meta of syncing his Messages app with Meta’s cloud service even though the Full Disk Access option was disabled. He claims that when asked, the Muse first explained that it had only seen notification previews. While Meta has taken issue with this account, the company insists that Muse requires both Full Disk Access and a standalone connector to be set up in Messages for it to connect to the app. The parties dispute the facts and no regulators has yet established them. There is no mention of Meta in the Apple’s statement, but it states that Full Disk Access is sometimes misused by developers, that the danger is higher as agents become more automatic, and that users should know the risks beforehand.
Consent Under the DPDP Act, 2023
The first question is regarding whether the Full Disk Access is the type of consent that Digital Personal Data Protection (DPDP) Act expects. The language of Section 6 demands consent that is freely given, specific, informed, unconditional and unambiguous, and given as a clear affirmative act, signifying an agreement, limited to the personal data required for the specific purpose. A blanket consent granting access to an entire Disk does not follow this condition, as it does not tie the consent to a specific purpose or specific data. Section 5 and the notice requirement of the DPDP Rules specify the requirement of a plain-language itemized description of the information processed and its purpose. Therefore, a generic prompt from an operating system will not suffice.
If a dispute like Aten’s arose in India, the fiduciary will be required to prove not only the information provided to the user but also what the user allowed. Section 3(b) of the law expands its application outside India, as per the terms of the act, whenever services or goods are offered to the individuals residing in India.
Third-Party Data and the Question of Breach
The message database includes personal information of people with whom an individual has communicated, including the editor and co-host of the podcast whom Muse allegedly copied from. These people have never given their consent.
Under Section 3(c)(i), covers only the individual’s own personal or domestic use, not a company’s processing data in their cloud storage. The same logic would apply to co-workers, customers, family members, OTPs, bank messages and shared IDs in Indian context. The user’s consent does not cover other person’s data. Section 7(a) allows processing without consent only where the Data Principle has voluntarily provided her own data for a specified purpose and has not objected to its use. People whose messages sit on the user’s divide has provided nothing to the agent’s provided, so Section 7(a) is unlikely to protect a fiduciary that collects their data.
In situations when an agent uses data that exceeds their permission. This may amount to a personal data breach under Section 2(u) of the Act, which covers any unauthorized processing of personal data that compromises its confidentiality, integrity or availability. The section is followed by section 8 of the Act, which requires reasonable security safeguards (Section 8(5)), and requires the fiduciary to notify the Data Protection Board and affected Data Principals of a breach (Section 8(6)).
The Schedule provides for penalties of up to ₹250 crore for failure to maintain safeguards and up to ₹200 crore for failure to give breach intimation. If the Act does not apply to a situation, section 43 of the Information Technology Act provides the mechanism for compensation in case of unauthorized access or extraction of information from a computer. Moreover, the CERT-In Directions mention that several cyber incidents, including unauthorized access to data, should be reported within a timeframe of six hours.
Significant Data Fiduciaries and Agentic AI
A provider of a widely used AI agent that can reach messages, files and accounts is a natural candidate for notification as a Significant Data Fiduciary under Section 10, which turns on the volume and sensitivity of the data processed and the risk to Data Principals. A notified fiduciary must appoint a Data Protection Officer in India, hire an independent auditor, and conduct regular Data Protection Impact Assessments.
Rule 13 requires Significant Data Fiduciary to verify technical safeguards, including algorithmic software, are not likely to risk Data Principals’ rights. An agent that can work freely with users data is exactly the kind of system that this rule seems to foresee. However, the DPDP Act does not establish a separate category of sensitive personal data, and neither does it or the India AI Governance Guidelines issued by MeitY in November 2025 refer to agentic AI by name. Instead, the Guidelines reply on existing laws and a principle-based approach, so regulation of agents rests on the general rules on consent and security. The substantive obligations are not due to take effect until mid-May 2027, although MeitY has proposed shortening that period.
The action taken by Apple indicates that obtaining consent is partly attributable to the responsibility of the platform. Under the DPDP Act places responsibility on Data Fiduciaries, meaning those who determine the purpose and means of processing. The provider of the operating system does not automatically become a fiduciary regarding the actions of third-party apps concerning permissions granted by them, but they remain a fiduciary with respect to their own processes and the methods applied and will influence the notion of reasonable precautions in the industry. A regulatory authority considering the way the app producer has received informed consent could take into account the prompts provided by an operating system.
If platforms start providing transparent agent access, this could contribute to the elevation of the responsibility standards for fiduciaries in India. Section 9 introduces an additional layer as in the case where an agent reads a minor’s texts it will raise the requirement for verifiable parental consent, and the bar for the ability to track children’s behavior will be raised.
AMLEGALS Remarks
The Muse app case demonstrates that the actual implication of consent is being evaluated at the moment the user presses “allow” on a prompt by the system. The DPDP Act contains principles that will help in evaluating the described behaviour, such as specific consent, easy withdrawal, safety measures and informing about a breach, but it was created when autonomous agents had not yet appeared and did not feature anything about data belonging to somebody else stored on the user’s device. Thus, it is likely that India will rely on how the Data Protection Board of India is going to apply generic rules to agentic systems once the duty starts. Companies that implement specific permissions into their agents now will be in a better position than those that will wait till the case clarifies how to behave.
For any queries or feedback, feel free to connect with mridusha.guha@amlegals.com or Khilansha.mukhija@amlegals.com