Every person has the right to privacy in terms of data available in electronic means. Such data cannot be used or share such data without the consent of the concerned person. In relation to the cookies and location data, there is no exclusive provision for it. However, if a data subject’s personal information or location data is collected using cookies or otherwise, the concerned entity must adhere to the Privacy Act and further such information must be used for the same purpose as it was collected for.

The Directives for Managing the Use of Social Networks, 2023 (“Social Network Directives”), prohibits users from breaching personal privacy, including editing, publishing, or broadcasting private photographs and videos without permission, except for content of a public nature. Violation of the Social Media Directives may lead to penalties under the Electronic Transactions Act, 2008, including a fine of up to NPR 50,000, imprisonment for up to six months, or both, depending on the severity of the offense.

The Social Media (Use and Regulation) Management Bill, 2024 (“Social Media Bill”) has received approval from the council of ministers and may either be introduced via ordinance or be tabled in the Parliament. Section 16 of the Social Media Bill mandates social media platforms to adopt necessary security measures to safeguard privacy of users’ personal information and ensure that such information is not publicly disclosed or used for any other purpose. Any social media platform acting in contravention to this requirement may be subject to a fine of up to NPR 10,00,000. 

Section 42 of the Social Media Bill prohibits use of social media to breach a person’s privacy, including privacy of life, family, residence, property, documents, data, correspondence, or information. A person committing an offense under this section shall be referred to the concerned authority for further investigation and punishment in accordance with the prevailing law.