When Loan Apps Misuse Your Gallery: Understanding Consent and Cyber Law

Mobile loan applications have gained widespread popularity in India in the era of instant online lending. The problem, however, is that many of these apps try to access phone galleries, contacts, and other private information. It is questionable whether such access amounts to a privacy violation and a cybercrime.
Such access can be misused, causing emotional stress, damage to reputation, and even blackmail. This blog outlines what Indian laws say about the legality of such acts and the remedies available to protect yourself.

1. What Data Access is Legal?
When you download a mobile application, it occasionally requests authorisation to use certain functions on your device, such as the storage, camera, microphone, or connections.
Under Indian law, only data that’s essential for the introductory functioning of the app can be allowed— and indeed that must be with your clear authorisation.

It is rarely justifiable for a lending app to access your gallery or contact list. In most cases, such access violates the principle of necessity and proportionality under digital privacy standards.

According to platform policies (e.g., Google Play), permission requests must be linked to the service offered by the app. For online loans, there is no valid reason to retrieve personal pictures. Unfortunately, many apps still demand this access, claiming to prevent fraud or confirm your identity.

2. Consent Under the IT Act and DPDP Act
The Information Technology Act, 2000 (Section 43A) penalises companies that fail to protect personal information. If your data is misused or accessed beyond what you agreed to, the company can be fined.
The law says that consent must be informed, specific, and clear. Rather than being buried in user agreements or pre-ticked boxes, which do not meet this standard.
The Digital Personal Data Protection (DPDP) Act, 2023, strengthens data rights in India. Apps can store only data that is necessary — and only with your full consent. You can refuse access and request deletion of your data. If a loan app still has access to your gallery after you deny permission, it is outright illegal.

3. Supreme Court Rulings on Privacy
In the Puttaswamy Judgment (2017), the Supreme Court ruled that the right to sequestration is an abridged right under Article 21 of the Constitution. This protects people against unreasonable or forced hindrance with their sequestration, including digital sequestration.
Using your gallery film to wring, cheapen, or hang you isn’t only unethical but also unconstitutional. However, if an app leaks your photos or shares your connections, it can spy on you.

4. Steps to File a Complaint
If your gallery or contact list has been misused by a loan app:
● Report it to the National Cyber Crime Portal (www.cybercrime.gov.in) under “financial fraud” or “online harassment.” Attach call logs or screenshots.
● Visit your nearest cyber police station or local police station and file an FIR under Sections 66C, 66D of the IT Act and Section 420 IPC (cheating).
● Flag the app on Google Play Store or Apple App Store to prompt removal.

5. Filing for Damages and Interim Relief
Victims can claim compensation through:
● Section 43A of the IT Act or tort law for privacy invasion and emotional distress.
● Civil suits for damages.
● Court orders for interim relief — such as restraining the app from further misuse or ordering deletion of your data.

If the lender is an NBFC, you can also complain to the Reserve Bank of India or the concerned ombudsman.

Conclusion
Access to your gallery may seem like a minor permission, but it can easily become a tool for harassment. Thousands of Indians have suffered because of such practices.
Thankfully, the IT Act, DPDP Act, and Article 21 of the Constitution provide strong protection. If you’re a victim, do not stay silent — act immediately and demand your rights.