India passed the Digital Personal Data Protection Act. Companies started talking about compliance. Consultancies started selling privacy check-ups. Conferences started running DPDP panels.
We wanted to see what's actually happening on the ground.
So we did.
We opened the public websites of 107 Indian companies — fintech, food delivery, e-commerce, health, education, insurance, travel, and more. We visited each site in a clean browser. We captured every tracker that loaded. We read every privacy policy word by word. We emailed companies asking what data they have on us. We wrote down everything.
What we found
Many companies have trackers running on their websites that are never mentioned in their privacy policy. Many ask for your consent in ways that don't meet what DPDP requires. Some use tools that record your screen — your taps, scrolls, and typing. A few didn't properly answer when we asked them what data they have on us.
This is not a compliance audit. We are not regulators. We do not declare violations or certify readiness.
What we do is make the evidence visible. Every tracker we found is dated. Every policy finding is tied to an actual quote from the policy. Every claim says exactly what we can and can't prove. The evidence is public so that companies, regulators, journalists, and regular people can see for themselves.
Who built this
State of Privacy is an investigation by Meridian Bridge Strategy, an independent DPDP consultancy founded by Sushant Pasumarty. MBS helps companies understand and fix the privacy risks that investigations like this one surface.
The investigation is the public layer. The consultancy is the private layer. They are separate by design: the evidence stands on its own, and companies that want help fixing what was found can work with MBS directly.
What happens next
State of Privacy 2026 is Year Zero. 107 companies. One public snapshot. We plan to expand to more companies, deeper investigations, and regular updates. The DPDP Act is not a one-time thing — companies have to stay compliant forever. Our investigation will keep growing with it.
For press inquiries, evidence brief requests, or DPDP consultancy
Contact Meridian Bridge Strategy