At 2 AM, a man in Ghaziabad opened a new tab and typed “how to hide a dead body.” Then another tab. “Best acid to dissolve evidence fast.” Then, because the internet had taught him that AI chatbots answer everything humans are too embarrassed to ask Google directly, he opened ChatGPT and typed the same question again, this time with more detail. He did not know it yet, but he had just built the prosecution’s opening exhibit.
Three weeks later, when the body was found and the investigation reached his name, none of this required a confession. It required a subpoena. His search history, his chat logs, his location pings from the same night, all of it sitting quietly on servers he never thought to question, waiting to be pulled into a chargesheet. He had spent more effort hiding the body than hiding the search for how to hide it. This is not a hypothetical anymore. This is the procedure.
For most of internet history, your browser was treated like your diary. Private by assumption, even if not by design. You searched, you scrolled, you closed the tab, and the moment evaporated into whatever you told yourself was the privacy of your own home. Nobody read your search bar like a confession booth. Now they do. Investigators ask Google for search logs the way they used to ask neighbours for witness statements. Courts in India have started treating metadata, cookies, IP logs and device timestamps as standard evidentiary material, not exotic exceptions.
The Bharatiya Sakshya Adhiniyam, 2023, which replaced the old Indian Evidence Act, did not soften this. It formalised it. Electronic records, once treated with suspicion and procedural friction under the old Section 65B regime, now move through courts with far less resistance. A certificate, a chain of custody, and your three week old search history becomes as admissible as a signed letter. The law did not catch up to technology. It simply stopped pretending technology wasn’t already inside the courtroom.
And it is not only criminal law. Civil litigation has quietly become a graveyard of digital footprints too.
Take matrimonial disputes. A spouse’s location history, pulled from a phone backup during divorce proceedings, has started appearing as evidence of where someone actually was versus where they claimed to be. Employment disputes now routinely involve forensic review of company laptops, browser caches, and cloud sync logs, used to prove an employee was moonlighting, leaking data, or simply not working the hours they billed. Intellectual property theft cases lean on something even more mundane: cookies. The little tracking files nobody reads about in the consent banner can place a former employee on a competitor’s website at the exact hour confidential files went missing.
None of this required new spyware. It required lawyers learning to ask for what was already being collected.
Here is where the irony stacks itself, the way it always does when money and privacy share a room. Every website you visit greets you with a cookie consent banner promising to protect your data, to use it only for “improving your experience,” to keep it safe behind layers of encryption and trust. You click accept because the alternative is reading four thousand words of legal text designed to be unread. What that banner does not say, because no banner ever says it, is that the same data trail it promises to protect you with is the first thing handed over the moment a court order arrives. Consent to cookies and consent to evidence are the same click. You just don’t find out until later which one you actually gave.
Corporate India is discovering this from the other side now too, and discovering it the hard way. Companies that built entire ad tech businesses on granular tracking are now facing the very data they collected being used against them. Data breach lawsuits increasingly hinge not on whether a breach happened, but on what the company’s own tracking logs reveal about how long they knew, what they tracked, and who they sold it to before the breach went public. The same analytics dashboard built to optimise conversion rates becomes, in a courtroom, a timeline of negligence. The hunter’s tools become the hunted’s confession.
Under the Digital Personal Data Protection Act, 2023, Indian companies are now expected to justify what they collect and why. But the Act does not erase what was collected before it existed. Years of tracking data sit in servers like sediment, available for discovery the moment litigation makes it relevant. A company’s own terms of service, written to reassure users, now doubles as a roadmap for opposing counsel asking exactly what data exists and how to subpoena it.
This is the quiet shift nobody markets. Surveillance capitalism did not just build a business model. It built an evidence locker, and it built it for everyone, plaintiffs and defendants alike, without asking either side for permission.
Think about what this means for the average person scrolling through their day. The recipe you searched at midnight, the flight you priced and abandoned, the symptom you Googled because you were too anxious to call a doctor, the argument you had with a friend over chat, the location your phone logged while you sat in a parking lot deciding whether to go inside. None of it was written with a courtroom in mind. All of it can end up there anyway. Privacy was never really about hiding wrongdoing. It was about the basic human right to be inconsistent, embarrassing, confused, and unwatched. That right has been quietly repriced as discoverable material.
And AI chatbots have made this worse, not better, despite what their privacy pages claim. Every prompt you type into an AI assistant is a written record, often more detailed and more self incriminating than a search query ever was, because chatbots invite explanation in a way search engines never did. You don’t type full sentences into Google. You type fragments. You type full sentences into a chatbot, because it asked you to elaborate, and you did, because confessing to a blank text box at 2 AM feels safer than confessing to a person. It is not safer. It is simply slower to surface, and faster to retrieve once someone knows to ask for it.
The man in Ghaziabad believed his crime lived in a moment, in an act, in a body he thought he had hidden well enough. He never accounted for the fact that his crime actually lived in three places at once: the act itself, the search for how to commit it, and the chat log where he asked an AI to confirm he was doing it right. Two of those three locations were never under his control. They belonged to servers, to companies, to terms of service he agreed to without reading, to a legal system that has finally caught up to the idea that intent leaves a paper trail even when it leaves no fingerprints.
He thought the acid would dissolve the evidence. He never thought the search for the acid would become the evidence instead.
Your Browser History Is a Legal Document Now
A man searches for “how to hide a dead body.” Then “best acid to dissolve evidence.” Then, because he trusts machines more than he trusts silence, he asks an AI chatbot the same question again. He thinks he is being careful. He has just written the prosecution’s first exhibit. This is not a hypothetical. This is the procedure now.
For most of internet history, the browser was treated like a diary. Private by assumption, even if never by design. That assumption is dead. Investigators request search logs the way they once requested witness statements. Indian courts have stopped treating metadata, cookies, IP logs and device timestamps as exotic evidence. They treat it as routine.
The Bharatiya Sakshya Adhiniyam, 2023, replaced the old Evidence Act and did not soften this shift. It formalised it. Electronic records, once slowed down by procedural friction under the old Section 65B regime, now move through courts with far less resistance. A certificate, a chain of custody, and a three week old search history becomes as admissible as a signed letter. The law did not catch up to technology. It simply stopped pretending technology wasn’t already inside the courtroom.
Civil litigation has quietly become a graveyard of digital footprints too. Matrimonial disputes now pull location history from phone backups to prove where someone actually was. Employment disputes lean on browser caches and cloud sync logs to prove moonlighting or data leaks. IP theft cases use cookies, the tracking files nobody reads about in the consent banner, to place a former employee on a competitor’s website at the exact hour confidential files went missing.
None of this required new spyware. It required lawyers learning to ask for what was already being collected.
Here is where the irony stacks itself, the way it always does when money and privacy share a room. Every website greets you with a cookie banner promising to protect your data, to use it only to “improve your experience.” You click accept because the alternative is reading four thousand words designed to be unread. What the banner never says is that the same trail it promises to protect comes out the moment a court order arrives. Consent to cookies and consent to evidence are the same click. You just don’t find out which one you gave until later.
Corporate India is learning this from the other side now. Companies that built ad tech businesses on granular tracking are facing their own data turned against them. Data breach lawsuits increasingly hinge not on whether a breach happened, but on what the company’s own logs reveal about how long they knew and what they sold before going public. The dashboard built to optimise conversion becomes, in a courtroom, a timeline of negligence. The hunter’s tools become the hunted’s confession.
The Digital Personal Data Protection Act, 2023, asks companies to justify what they collect going forward. It does not erase what was collected before it existed. Years of tracking data sit in servers like sediment, available for discovery the moment litigation makes them relevant. A company’s own terms of service, written to reassure users, doubles as a roadmap for opposing counsel asking exactly what exists and how to subpoena it.
Surveillance capitalism did not just build a business model. It built an evidence locker, for everyone, without asking permission from either side.
AI chatbots have made this worse, not better. A search query is a fragment. A chatbot prompt is a full sentence, because the chatbot asks you to elaborate, and you do, because confessing to a blank text box at 2 AM feels safer than confessing to a person. It is not safe. It is only slower to surface. The man believed his crime lived in one place, the act itself. It actually lived in three: the act, the search for how to commit it, and the chat log where he asked an AI to confirm he was doing it right. Two of those three were never under his control.
He thought the acid would dissolve the evidence. He never thought the search for the acid would become the evidence instead.
