On June 30, 2026, Uber launched Record My Ride at its Uber Surakshit safety conference in New Delhi, alongside ambulance assistance and rider-set trip PINs. The flagship feature lets drivers capture encrypted in-cab video from their own phones across ten Indian cities — Delhi, Mumbai, Bengaluru, Chennai, Hyderabad, and Kolkata among them. Footage encrypts locally on the driver's device, auto-deletes after 14 days unless a safety report is filed, and is inaccessible to everyone — including Uber — unless the driver voluntarily uploads it alongside that report.
The engineering is privacy-conscious. The legal position is not.
Passengers receive an in-app notification before the trip begins informing them that recording is active. They can cancel the ride if they object. They cannot stay in the cab and opt out of being filmed. Under India's Digital Personal Data Protection Act, 2023, that notification is the beginning of the consent process — not the end of it.
A Real Problem, a Thoughtful Solution
Record My Ride exists because drivers face a documented problem. Drivers in Delhi-NCR have told media they regularly encounter passengers who demand route deviations and then file false misconduct complaints when refused, triggering account suspensions and economic harm with no recourse. Uber's design — encrypted footage inaccessible to anyone unless the driver uploads it as part of a safety report — attempts to address that asymmetry without building a passive surveillance system.
The strongest case for the feature is intuitive. A driver documenting their own cab, with footage they alone control, is comparable to a dashcam or retail CCTV. In many jurisdictions, notifying passengers is exactly what the law requires — several US states and EU member states treat in-vehicle recording as lawful under single-party consent or public interest exemptions. The safety benefit is real, the privacy architecture is considered, and the problem being solved is one that regulators have not addressed.
India, however, enacted one of the stricter consent regimes among major economies.
What the DPDP Act Actually Requires
The Digital Personal Data Protection Act, 2023 establishes a mandatory two-stage sequence. Section 5 requires a Data Fiduciary to give notice specifying what personal data will be collected and for what purpose before processing begins. Section 6 then requires consent that is "free, specific, informed, unconditional and unambiguous with a clear affirmative action."
Each word in that definition was deliberate. The statute was designed to exclude opt-by-inaction models: no pre-checked boxes, no implied consent from service continuation. A passenger who keeps the trip after seeing a notification has decided not to cancel — that is the absence of an action, not an affirmative one. Silence and inaction are explicitly excluded as mechanisms of consent.
Notice under Section 5 is a precondition to seeking consent, not a substitute for it. The lawful sequence is: disclose, then obtain agreement. Record My Ride completes step one and skips step two.
Video footage of identifiable passengers, linked through Uber's own records to their account, payment data, and trip history, is unambiguously personal data under the Act's broad definition. The DPDP Act does not create a separate "sensitive data" tier requiring heightened consent — the base obligation under Section 6 applies to all personal data, and it was not met here.
The Legitimate Use Question
The DPDP Act's Section 7 permits processing without consent in enumerated categories: government service delivery, medical emergencies, employment-related data, and judicial functions. Uber might argue that driver-safety recording falls within employment-adjacent processing. The argument has a structural flaw: the employment carve-out covers data relating to the data principal's own employment — not a third party's data collected to protect someone else. Passengers have not entered into any relationship with Uber that places their image inside the company's safety infrastructure.
The absence of a flexible "legitimate interests" balancing test — equivalent to Article 6(1)(f) of the EU's GDPR — is the structural gap that makes India's law stricter than most. GDPR allows controllers to process personal data where their legitimate interests are not overridden by those of the data subject, after a documented balancing exercise. India's DPDP Act contains no equivalent provision. Processing is based on consent or on a specific statutory exemption; Uber's current design fits neither cleanly.
The company's own documentation implicitly acknowledges the tension. Uber's Record My Ride help page states that "in certain regions, it may be required by law to obtain a rider's consent to record them." India, under the DPDP Act, is precisely such a region.
The Enforcement Window
The DPDP Rules 2025 were notified on November 14, 2025, alongside a phased enforcement schedule. The Data Protection Board of India was constituted immediately and is already operational. Consent manager obligations become mandatory from November 2026. Full enforcement of substantive consent obligations — including Section 6 — begins May 13, 2027.
Uber launched Record My Ride into a window where the Board exists but cannot yet apply the full weight of the consent regime. That window runs less than a year. Practices embedded now will either need to be corrected before May 2027 or will become the subject of the Board's first major enforcement actions. The Act's penalty schedule reaches ₹250 crore for the most serious violations.
The Proportionate Fix
Banning Record My Ride would be the wrong outcome. The driver safety case is legitimate, the encryption model is sound, and 14-day auto-deletion reflects genuine restraint. The issue is not the product — it is the consent flow.
The fix is a single UI change: replace the notification screen with a consent screen. One in-app tap — acknowledging the recording and affirmatively agreeing to proceed — satisfies Section 6's clear affirmative action requirement without altering the feature's safety function. The driver protection benefit is unchanged. The passenger's statutory right is restored. The legal ambiguity is extinguished.
The Data Protection Board would be well-served to issue sector-specific guidance on safety-use recording in transportation before May 2027, providing a clear framework for tools like this. The DPDP Act was designed to be proportionate and technology-forward. There is nothing in it that prevents Uber's feature from operating lawfully. There is only the requirement that passengers say yes — and that one word is all Uber needs to ask for.