Every person has the right to privacy in terms of data available in electronic means. Such data cannot be used or shared without the consent of the concerned person. 

In relation to the cookies and location data, there is no exclusive provision for it. However, if a data subject’s personal information or location data is collected using cookies or otherwise, the concerned entity must adhere to the Privacy Act; and such information must be used for the same purpose as it was collected for.

The Directives for Managing the Use of Social Networks, 2023 (“Social Network Directives”) prohibit users from breaching personal privacy, including editing, publishing, or broadcasting private photographs and videos without permission, except for content of a public nature. Violation of the Social Media Directives may lead to penalties under the Electronic Transactions Act, 2008, including a fine of up to NPR 50,000, imprisonment for up to six months, or both, depending on the severity of the offence.

The E-commerce Act requires e-commerce businesses to maintain the privacy of personal information or personally identifiable information in relation to e-commerce transactions. Such information must not be disclosed to anyone, or utilized by the business itself, except in accordance with the prevailing laws. This restriction does not prevent the exchange of transaction-related information between the buyer, the business, or the delivery person involved in the purchase and sale of the goods/services as per the contract. Businesses are also required to provide users with the facility to access the platform to input or amend personal information, or deactivate sources that identify them.