The acceleration of artificial intelligence (AI) and digital surveillance technologies has profoundly recon’ured contemporary social, political, and legal dynamics. Zuboff (2019), in her seminal work The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power, proposes that a new model of capitalism “surveillance capitalism” emerged from the commercialization of behavioural data. This paradigm represents not merely a technological shift but a structural transformation in the dynamics of power, autonomy, and social control. Whereas industrial capitalism relied on physical and finite resources, surveillance capitalism is grounded in the extraction, processing, and economic use of personal information, generating what Zuboff defines as “behavioural futures markets” (Zuboff, 2019, p. 150).

Through algorithmic profiling and behavioural targeting, multinational corporations such as Google, Meta, and Amazon collect both ordinary and sensitive personal data (as defined in Article 4 of the European Union, 2016), building predictive systems that shape and influence individual preferences and decision-making. This continuous monitoring subjects’ individuals to unprecedented forms of exposure, while reducing their capacity for autonomous action (Brundage et al., 2022; Meissner and Wulf, 2023). The proliferation of virtual assistants, facial recognition systems, and Internet of Things (IoT) devices further extends this dependency, expanding the risks of data breaches, surveillance opacity, and accountability gaps (Narayanan et al., 2023; Algorithm Watch, 2022). Behavioural data thus emerges as the raw material of a new regime of digital power, used to anticipate and manipulate conduct for commercial, political, or social control purposes. These developments place fundamental rights of privacy, freedom of expression, and political participation under increasing pressure, raising urgent concerns about the preservation of democratic legitimacy (Fjeld et al., 2020; European Parliament, 2022).

Within this evolving landscape, scholars such as Pariser (2011) and van Dijck et al. (2021) have shown how algorithmic filtering produces “filter bubbles” that narrow the horizon of public discourse and foster epistemic polarization. Such mechanisms, by privileging engagement and personalization, systematically restrict plural deliberation, thereby undermining the robust exchange of ideas that democracy requires (Noble, 2018; Napoli, 2021).

In parallel, Bauman and Lyon (2012) introduce the concept of “liquid surveillance” to describe a networked, dispersed, and often voluntary form of data gathering that contrasts with the coercive models of disciplinary control described by Foucault (1993). Unlike traditional forms of surveillance that operated through centralised authority, liquid surveillance operates flawlessly through digital infrastructures framed as convenient, connected, and configurable. Such opacity disguises exclusionary patterns and discriminatory practices, as algorithmic systems reproduce social hierarchies while claiming neutrality (Benjamin, 2019). Scholars such as Lyon (2023) and Amoore (2021) caution that these dynamics normalise the internalization of control, eroding critical consciousness and reinforcing conformity. The erosion of deliberative diversity and the algorithmic curation of information contribute to a broader crisis of democratic communication, in which access to information becomes contingent on the invisible architectures of platform capitalism.

From a broader philosophical perspective, several thinkers have emphasised the social implications of this algorithmic turn. Lanier (2018) contends that the digital environment commodifies social interaction, eroding empathy and incentivizing performative self-presentation (Matzner, 2022). Similarly, Han (2015, 2022, 2023) argues that the culture of digital transparency and self-exposure undermines civic freedom by transferring mechanisms of control from the state to the market. Within this “society of transparency,” citizens increasingly become participants in their own surveillance, internalizing observation as a normative condition of social validation (Couldry and Mejías, 2021). This structural shift transforms the public sphere from a collective arena of democratic deliberation into a spectacle of individualised visibility, diluting politics into atomised expression.

Extending this analysis, Couldry and Mejías (2019, 2021) conceptualise the global data order as a form of “data colonialism.” They argue that data extraction reproduces colonial logics of appropriation, particularly in the Global South, where technological infrastructures remain largely controlled by transnational corporations (Birhane, 2023; Veale and Zuiderveen, 2021). Behavioural data becomes a new resource frontier, mirroring historical resource extraction and perpetuating dependency structures under the guise of innovation. This process deepens geopolitical asymmetries, undermining digital autonomy and civic sovereignty in developing nations.

Contrasting with these critical frameworks, Unwin (2017, 2021) proposes that AI and digital technologies can advance civic rights and democratic inclusion when governed by ethical and participatory principles. For Unwin, digital access and literacy constitute integral dimensions of modern citizenship, requiring states to develop equitable infrastructures and regulatory mechanisms that promote responsible digital participation. International frameworks similarly position AI ethics within a broader agenda of human-centred governance, emphasizing inclusivity, transparency, and accountability as essential to the continuity of democratic societies (Floridi, 2021; United Nations, 2022; UNESCO, 2022).

In synthesis, the convergence of surveillance capitalism, data colonialism, and digital transparency delineates a complex ethical and political field. Contemporary scholarship (Bietti, 2020; European Commission, 2024) reinforces that AI governance must reconcile innovation with the protection of civil liberties, demanding mechanisms of public oversight to ensure the accountability of algorithmic systems. The transformation of surveillance into a diffuse, participatory, and self-reinforcing sociotechnical system represents one of the central challenges of the twenty-first century (Christodoulou and Limniotis, 2024). Ensuring that automation and data-driven governance remain compatible with democratic norms requires a recalibration of power, law, and technological design.

The identification and analysis of the principles, regulatory instruments, and fundamental rights safeguards in the GDPR and AI Act reveal complementary yet distinct approaches. The GDPR focuses on the protection of personal data, establishing core principles such as lawfulness, transparency, data minimisation, purpose limitation, and accountability, alongside robust data subject rights including access, rectification, objection, portability, and restriction of processing (European Union, 2016). These safeguards primarily operate at the level of data processing, imposing obligations on any entity that collects or uses personal information, including scenarios where processing involves AI systems (Bietti, 2025).

The AI Act (European Commission, 2024) adopts a risk-based approach to regulating artificial intelligence systems, categorizing them into four levels of risk: unacceptable, high, limited, and minimal. Systems classified as unacceptable risk are prohibited outright due to their potential to cause significant harm or violate fundamental rights, including practices such as social scoring and subliminal manipulation. High-risk AI systems, which encompass applications with substantial implications for safety and fundamental rights, such as human identification, critical infrastructure management, and law enforcement, are subject to stringent requirements. These include comprehensive risk management, data governance standards, technical documentation, transparency obligations, human oversight, and post-market monitoring mechanisms. Limited-risk systems are subject to lighter regulatory obligations, primarily focused on transparency, such as informing users of AI interaction (e.g., chatbots), while minimal-risk AI systems face minimal to no mandatory requirements (European Commission, 2021a).

Within the context of this study, the EU GDPR framework remains paramount as the primary legal instrument protecting fundamental rights through the control of personal data processing. Although the AI Act regulates the entire lifecycle of AI systems to prevent practices threatening these rights, it assumes a secondary role relative to the GDPR. The GDPR ensures rights-based safeguards directly tied to personal data privacy and governance, while the AI Act complements this by addressing the broader governance of AI system risks (European Commission, 2021b; Trail, 2025).

In India, under Prime Minister Narendra Modi (2014—present), personal data protection legislation had little relevance until 2023. Regulatory oversight tends to be politically conditioned, granting the state a broad scope of discretionary authority (Kaye, 2019; Yadav and Yadav, 2025). There is often a combination of state surveillance and private platforms, which collectively exercise control over information and public discourse (Bradshaw and Howard, 2018; Udupa and Pohjonen, 2019).

The Personal Data Bill (Government of India, 2018) was not adopted and was instead replaced by a new law; the original bill process led to the enactment of the Digital Personal Data Protection Act (2023), constituting the country’s first legal framework for personal data. The DPDPA applies to digital personal data processed in India, including data collected online or digitised offline, and extends extraterritorially when targeting Indian residents. It defines “personal data” as any information relating to an identifiable individual and requires that processing be carried out only for lawful purposes based on free, specific, and informed consent, with exceptions for certain “legitimate purposes,” such as government services, emergencies, or employment-related processing. Data controllers are obligated to ensure data accuracy, security, purpose limitation, and erasure once the purpose has been fulfilled, while data principals (individuals) are granted rights including access, correction, erasure, grievance redressal, and the ability to appoint representatives.

Compared to the European Union’s GDPR, the DPDPA applies only to digital personal data, excluding non-digital formats unless they are subsequently digitised, whereas the GDPR covers personal data regardless of format. India’s DPDPA places strong emphasis on government exemptions, granting broad powers to the executive regarding national security, public order, and sovereignty. This means exempted government agencies can process personal data without adhering to fundamental safeguards such as obtaining consent, ensuring data security, or transparency obligations (PRS India Legislative Research, 2023).

This point applies the theoretical and normative framework to two comparative case studies, employing qualitative methodology and exploratory analysis. The proposed structure is as follows: (i) Cambridge Analytica and data manipulation in electoral contexts, (ii) AI-based media censorship in India, and (iii) a cross-cutting comparison.

The right to information, understood as the free and pluralistic access to trustworthy data, was gravely threatened by the Cambridge Analytica scandal, which involved the undue collection of personal data from millions of Facebook users for manipulative political profiling, thus violating data protection regulations such as the GDPR and precursor directives. Cambridge Analytica accessed data from millions of profiles via a quiz application, using it for microtargeting in elections, such as the 2016 US election and Brexit Techniques included aggregating behavioural data, such as likes and shares, to create voter profiles for personalised political messaging, often without explicit consent.

The creation of political campaigns aimed at manipulating voters constituted a reprehensible and unlawful act, for both ethical and legal reasons, namely due to the violation of data protection principles established in the GDPR, and violated fundamental democratic guarantees such as freedom to vote and electoral integrity. These political messages were tailored to influence electoral behaviour, particularly in key swing states such as Michigan, Wisconsin, and Pennsylvania (Cadwalladr and Graham-Harrison, 2018). This violated fundamental rights to privacy and information both in the EU and globally. Although the GDPR provided safeguards such as data minimisation and purpose limitation (Articles 5 and 25), enforcement proved insufficient due to delayed fines, highlighting gaps in cross-border accountability mechanisms.

The Indian government has systematically manipulated the media through a combination of coercion, ownership control, and strategic propaganda. Since the Bharatiya Janata Party (BJP) came to power in 2014 to the present day, it has employed financial and political pressure, including allocation or withdrawal of government advertising, to incentivise media outlets to align with its ideological agenda and marginalise dissenting voices (Jeffrey, 2020). Journalists and media houses critical of the government often face intimidation, legal harassment, and economic sanctions, leading to self-censorship (Kumar and Ravi, 2021). Furthermore, prominent news channels have been co-opted to function as government mouthpieces, promoting a pro-government narrative while suppressing opposition views (Chatterjee, 2019). The government also deploys extensive digital tactics such as fake social media accounts and AI-driven bots to amplify favourable content and discredit critics domestically and internationally (Singh and Patel, 2023). Independent investigations reveal collusion between political actors and media executives to influence election coverage and public opinion (Rao, 2024). Combined with opaque regulatory frameworks lacking transparency and limited judicial oversight, these practices have effectively transformed significant segments of the Indian media landscape into instruments of state propaganda, thereby undermining democratic discourse and pluralism (Bhatia, 2020; Iyer, 2023).

The Indian government used the revelations about Cambridge Analytica as a pretext to tighten information technology laws. India’s Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules (IT Rules, 2021) and the Digital Personal Data Protection Act (2023). The first impose stringent obligations on social media intermediaries, especially those with large user bases, requiring proactive AI-driven content monitoring and the identification of the first originator of information upon government or judicial orders. These rules broaden the government’s power to restrict content deemed harmful to sovereignty, security, or public order, with fast timelines for content removal and mandatory cooperation from intermediaries. However, the rules rely heavily on automated filtering and government “fact-check” units, which often lack transparency and independent oversight, leading to over-censorship and suppression of dissent (Access Now, 2024). The broad and subjective definitions of prohibited content create uncertainty and enable potential misuse, allowing the government to manipulate media narratives despite the regulatory framework’s intent to safeguard against misinformation (Bhatia, 2020).

Unlike the European GDPR, Indian law does not guarantee the right to journalistic information. The DPDP Act altered the Right to Information (RTI) Act of 2005, prohibiting the disclosure of almost all personal information, which makes it difficult for the press to scrutinise public officials. According to the RSF World Press Freedom Index (RSF, 2025), India ranks 159th out of 180 countries in 2025, a slight improvement from 161st place in 2023. This change was due to the decline of other countries, as press freedom in India continues to fall after The Telecommunications Act (2023) and other government legislation that restricts the right to information and freedom of the press (Freedom House, 2025).

The comparison between the Cambridge Analytica scandal and media manipulation in India under the BJP highlights distinct yet converging threats to democratic integrity (transparency, accountability and legality) and the right to information (including freedom of expression and quality of information, inter alia). In the Cambridge Analytica case, the violation stemmed not only from unauthorised harvesting of personal data, but also from the distortion of citizens’ informational environment itself. By secretly extracting millions of Facebook profiles through a deceptive quiz app and deploying psychometric profiling to microtarget voters in the 2016 US election and the Brexit referendum, Cambridge Analytica undermined individuals’ ability to access balanced, truthful, and non-manipulative political information (Cadwalladr and Graham-Harrison, 2018). The opaque nature of the targeted messaging created information asymmetries in which certain groups received tailored political narratives unknown to the broader public, compromising the transparency necessary for informed democratic participation (Azgin and Kiralp, 2024; Malgieri and Santos, 2025).

In India, the erosion of the right to information is driven primarily by state power: the BJP’s use of AI-driven bots, fake accounts, and co-opted media outlets amplifies pro-government messaging while systematically discrediting dissenting voices, reshaping public discourse through orchestrated digital propaganda (Singh and Patel, 2023; Rao, 2024). This manipulation is reinforced by the opaque and expansive 2021 IT Rules, which mandate algorithmic content surveillance and the ability to trace message originators, enabling censorship under vague “public order” justifications. Such mechanisms contribute to widespread self-censorship among journalists and platforms, further shrinking informational plurality (Jeffrey, 2020; Bhatia, 2020; Iyer, 2023).

In both cases, information ecosystems are turned into instruments of political influence: Cambridge Analytica through covert behavioural assessment that simultaneously violated privacy and the right to receive impartial public information, and the Indian government through overt regulatory pressure and narrative control. Together, they illustrate how both private actors and state institutions can compromise free expression, electoral fairness, and democratic pluralism by shaping what citizens can know, and what they are prevented from knowing, during critical political moments (Kumar and Ravi, 2021; Chatterjee, 2019).

The normative and institutional framework of the two cases reveals differences between the European context and that of India, with direct implications for how algorithmic surveillance is deployed and contested. In the Cambridge Analytica scandal, the existence of the GDPR provides a relatively robust set of principles and obligations, including lawfulness of processing, purpose limitation, data minimisation and strong data subject rights, enforced by independent data protection authorities with investigative and sanctioning powers (European Union, 2016; Veale and Zuiderveen, 2021). By contrast, in India, data protection rules are less comprehensive and inviolable (they allow data sharing between government agencies without explicit consent), which limits both regulatory predictability and the institutional capacity to oversee large-scale data processing and enforce effective sanctions. This asymmetry translates institutionally into clearer avenues for individual and collective redress, as well as regulatory investigations, in the European setting, whereas in India oversight tends to be politically conditioned, with broad room for executive discretion (Bradshaw and Howard, 2018; Kaye, 2019).