The Digital Social Contract: Protecting Identity in the Age of AI

Digital Social Contract Page 1 of 18 The Digital Social Contract: Protecting Identity in the Age of AI David Matta American University of Beirut [email protected].lb https://doi.org/10.5281/zenodo.18008047 Abstract Digital identity governance has emerged as a defining challenge of the twenty-first century. This paper develops the concept of constrained democratic agency—the theoretical position that digital identification systems are products of structural forces (privacy leakage, AI synthesis, corporate capture, geopolitical vulnerability) yet remain subject to decisive political intervention during critical junctures. Drawing on social contract theory, surveillance studies, and comparative analysis of democratic (Estonia), hybrid (India), and authoritarian (China) implementations, I demonstrate that governance—not technology—is the decisive variable determining outcomes. The paper proposes a "Digital Social Contract" as a middle-range theoretical framework comprising six components (Legal Protections, Technical Architecture, Institutional Oversight, Democratic Participation, International Cooperation, Adaptive Mechanisms) derived from first principles of democratic legitimacy and individual autonomy, and generates six testable propositions for empirical research. Process tracing of India's 2018 Supreme Court intervention demonstrates the precise causal mechanisms through which democratic agency operates during critical junctures. I address mechanisms for mobilizing political agency against structural pressures, adaptation strategies for low-capacity states (illustrated through Kenya's Huduma Namba case), and engage alternative philosophical traditions including Ubuntu relationalism and Confucian social harmony. The framework confronts the legitimation critique—that oversight mechanisms normalize rather than constrain surveillance—by specifying conditions under which accountability structures genuinely limit rather than enable expansion. The paper concludes with explicit acknowledgment of the framework's limitations and boundary conditions. The framework aims to ensure digital identity systems enhance rather than erode democratic legitimacy while maintaining applicability across diverse governance contexts. Keywords: digital identity, governance, social contract theory, surveillance studies, constrained agency, democratic theory, artificial intelligence, comparative politics, process tracing 1. Introduction Digital identity has emerged as one of the defining governance challenges of the contemporary era. Across the globe, governments are introducing digital identification systems, from India's Aadhaar program to the European Union's proposed digital wallet. These initiatives promise efficiency, security, and inclusion—yet they simultaneously generate profound unease regarding surveillance, exclusion, and governmental overreach. Digital Social Contract Page 2 of 18 The resulting debates remain polarized, with proponents and opponents frequently talking past one another. This paper advances a theoretical framework that moves beyond the sterile "adopt or reject" binary dominating public discourse. I develop the concept of constrained democratic agency—the position that while structural forces render some form of digital identity integration inevitable, the form that integration takes remains subject to decisive political intervention. This framework avoids both technological determinism (the view that technology dictates outcomes) and naive voluntarism (the view that political will alone shapes technological development). The paper makes five contributions. First, I identify four converging structural forces— privacy leakage, AI synthesis, corporate capture, and geopolitical vulnerability—that collectively render digital identity integration a pressure rather than a pure choice (Section 3). Second, through comparative analysis of Estonia, India, and China, I demonstrate that governance context is the decisive variable determining whether digital identification serves democratic or authoritarian ends (Sections 5-6). Third, I propose the "Digital Social Contract" as a middle-range theoretical framework comprising six components derived from first principles of democratic legitimacy and six testable propositions (Section 7). Fourth, I provide process tracing of India's 2018 Supreme Court intervention, demonstrating the precise causal mechanisms through which democratic agency operates during critical junctures (Section 8.1). Fifth, I address three challenges raised by critical scholarship: mechanisms for mobilizing political agency, adaptation for low-capacity states (illustrated through Kenya's Huduma Namba), and engagement with non-Western philosophical traditions (Section 8). The stakes are substantial. As Habermas (1996) argues, legitimate governance requires both technical efficiency and democratic deliberation. Digital identification systems exemplify this tension: they promise technical solutions to administrative problems while potentially undermining the communicative foundations of democratic society. Foucault's (1977) analysis of disciplinary power further suggests that identity systems can become instruments of normalization and control. Yet unlike Foucault's more pessimistic conclusions, I argue that democratic restructuring of the "surveillant assemblage" (Haggerty & Ericson, 2000) remains possible during critical junctures—moments when institutional arrangements are contested and malleable. 2. Theoretical Framework: Constrained Democratic Agency Debates about digital identity typically adopt one of two positions. Technological determinists argue that surveillance and control are inherent features of digital systems, making resistance futile (Ellul, 1964; Winner, 1977). Voluntarists counter that political will can shape any technology toward democratic ends (Feenberg, 2002). Both positions are inadequate: the former ignores successful democratic implementations, while the latter underestimates structural constraints. I propose instead the concept of constrained democratic agency. This framework recognizes that structural forces create powerful pressures toward digital identity integration, but maintains that political agency remains decisive in determining how integration occurs. The key insight is temporal: structural pressures operate continuously, but political agency is most effective during critical junctures—moments when institutional arrangements are being established or reformed (Capoccia & Kelemen, 2007). Digital Social Contract Page 3 of 18 This framework draws on three theoretical traditions. From historical institutionalism, I adopt the concept of path dependence: once digital identity architectures are established, they become difficult to reverse (Pierson, 2000). From surveillance studies, I adopt the concept of the "surveillant assemblage"—the distributed network of surveillance practices that operates across state and corporate actors (Haggerty & Ericson, 2000). From deliberative democratic theory, I adopt Habermas's (1996) insight that legitimate governance requires ongoing public deliberation, not merely one-time consent. The framework's central claim is that democratic restructuring of surveillant assemblages remains possible, but only under specific conditions: (1) intervention occurs during critical junctures before path dependence solidifies; (2) civil society possesses sufficient organizational capacity to contest state and corporate power; (3) legal-institutional safeguards constrain executive discretion; and (4) international pressures support rather than undermine democratic governance. 2.1 Identifying Critical Junctures: Observable Indicators A potential weakness of critical junctures theory is the difficulty of identifying these windows prospectively rather than retrospectively. To operationalize the framework for practical application, I specify four observable indicators that signal the opening of critical junctures in digital identity governance. First, legislative or regulatory review periods create formal windows for intervention. When governments propose new digital identity legislation, submit existing systems for judicial review, or conduct mandatory parliamentary assessments, the institutional architecture becomes temporarily malleable. The period between policy proposal and implementation typically offers 12-24 months of contestability. Second, technological transition points—when systems are upgraded, platforms migrated, or new biometric modalities introduced—destabilize existing path dependencies. Estonia's 2017 security vulnerability (affecting its ID card cryptographic infrastructure) created precisely such a juncture, though in this case strong institutions channeled the response toward enhanced rather than diminished protections. Third, legitimacy crises triggered by data breaches, documented exclusion incidents, or highprofile misuse cases create political openings. India's Aadhaar system entered a critical juncture following the 2017-2018 series of breaches and documented starvation deaths, creating conditions for the Supreme Court's landmark intervention. Fourth, regime transitions—whether through elections, constitutional reform, or political rupture—can reset institutional arrangements. Kenya's 2010 constitutional reform created a critical juncture that shaped subsequent digital identity debates, as the new constitution's strong privacy provisions provided resources for civil society contestation of Huduma Namba. These indicators are not deterministic: the presence of a critical juncture does not guarantee democratic outcomes. Rather, they identify moments when agency has greater efficacy— when the costs of institutional change are temporarily reduced and the range of possible outcomes expands. 3. Four Convergent Forces: The Structural Pressure Toward Integration Digital Social Contract Page 4 of 18 The debate about digital identity frequently focuses on whether societies should adopt such systems. This framing is fundamentally misleading. Four convergent forces have already created substantial pressures toward integration, rendering the question not whether but how digital identity systems will be governed. 3.1 Privacy Leakage Every citizen already generates extensive digital traces. Social media authentication, email addresses, online commerce, biometric scans, mobile phone registrations, and banking transactions produce continuous streams of identity data. The Federal Trade Commission (2022) reports that data brokers in the United States maintain an average of 1,500 data points per consumer, with some companies holding up to 5,000 distinct attributes per individual. This leakage occurs regardless of whether governments establish formal digital identification systems. Policy Implication: The question is not whether identity data will exist, but whether governments can establish protective frameworks. Centralized systems under democratic oversight may paradoxically offer greater protection than unregulated corporate data harvesting. 3.2 Artificial Intelligence Synthesis Artificial intelligence has dramatically enhanced the capacity to synthesize fragmented data into coherent identity profiles. Narayanan and Shmatikov (2008) demonstrated that supposedly anonymous datasets could be re-identified through linkage attacks. More recent research shows that machine learning models can infer sensitive attributes (political orientation, sexual orientation, health conditions) from behavioral patterns with high accuracy (Kosinski et al., 2013; Wang & Kosinski, 2018). Computer vision systems now achieve 99.8% accuracy in facial recognition across contexts (Wang & Deng, 2021). Policy Implication: AI synthesis will occur regardless of government action. The substantive question is whether synthesis serves public accountability or private profit and political manipulation. 3.3 Corporate Capture In the absence of public frameworks, corporations have become de facto custodians of digital identity. Google processes 8.5 billion searches daily (Statista, 2023a); Amazon maintains purchase histories for 300 million active users (Statista, 2023b); Meta holds identity profiles for 3 billion monthly active users (Meta, 2023). These corporations possess more granular behavioral data than most governments. As Zuboff (2019) argues, this represents a new form of "surveillance capitalism" that extracts behavioral surplus for prediction and manipulation. Policy Implication: Identity governance is not a choice between state control and freedom—it is a choice between accountable public frameworks and unaccountable corporate control. 3.4 Geopolitical Vulnerability Globalized data flows mean that foreign actors frequently hold more information about citizens than their own governments. The U.S. Office of Personnel Management breach (2015) exposed 21.5 million records (OPM, 2016). The SolarWinds attack (2020) compromised 18,000 organizations across multiple nations (CISA, 2021). India's Aadhaar system has experienced multiple breaches affecting over one billion citizens (Rao, 2018; Digital Social Contract Page 5 of 18 Privacy International, 2023). States without robust digital infrastructure cede effective sovereignty over citizen data. Policy Implication: Protecting identity is a matter of sovereignty, not merely privacy. Governments must invest in secure domestic infrastructure while establishing international governance frameworks. 4. From Fragmentation to Integration: Understanding the Transition A crucial distinction separates fragmented digital footprints from integrated digital identity. Citizens already possess the former: scattered data across financial systems, telecommunications, government programs, and social media platforms. What governments now propose is not the creation of digital identity but its integration and legitimization— unifying fragments into coherent systems with official backing. Traditional paper-based identification (passports, licenses, national ID cards) provided privacy through separation: a passport could not reveal financial transactions, and a driver's license did not expose medical records. As Lessig (1999) observed, the architecture of identification systems shapes possibilities for both freedom and control. Paper systems provided privacy at the cost of efficiency; digital integration reverses this trade-off. This transition generates both opportunities and risks. Integration can reduce administrative duplication, increase efficiency, and expand access for marginalized populations lacking formal documentation. The World Bank (2018) estimates nearly one billion people globally lack formal identity. Yet integration also concentrates risk: system compromise exposes all domains simultaneously, and governmental misuse enables comprehensive surveillance. Rawls's (1971) "veil of ignorance" test illuminates the institutional design challenge: would citizens choose unified digital identification without knowing whether they would live under democratic or authoritarian governance? The answer depends entirely on the safeguards embedded within the system—which is precisely why the governance framework matters more than the technology itself. 5. Comparative Analysis: Three Models of Digital Identity Governance To test the framework's central claim—that governance context determines outcomes—I examine three cases selected for maximum variation in political systems while controlling for technological sophistication. Estonia represents consolidated democracy with strong rule of law; India represents electoral democracy with uneven state capacity; China represents single-party authoritarianism with high state capacity. This "most different systems" design (Przeworski & Teune, 1970) allows identification of governance as the decisive variable. 5.1 Estonia: Democratic Model Estonia's e-ID system, launched in 2002, is widely regarded as a global model of democratic digital identity. The system enables citizens to file taxes, access healthcare records, vote online, and conduct banking through a single secure credential. Crucially, the system embeds accountability mechanisms: citizens can view who has accessed their data, creating transparency at every level. The system logs all access, with 2% of officials disciplined annually for inappropriate data access (e-Estonia, 2023a). Adoption has reached 99% of the eligible population, with trust levels exceeding 89% (e-Estonia, 2023b). The system saves Digital Social Contract Page 6 of 18 Estonian citizens an estimated 820 years of working time annually through reduced administrative burden. Key success factors: small population enabling comprehensive implementation; strong rule of law tradition; EU membership providing external accountability; early intervention establishing democratic norms before path dependence solidified; active civil society participation in system design. 5.2 India: Hybrid Model India's Aadhaar system, enrolling over 1.3 billion people since 2009, represents the world's largest biometric identification program. The system has achieved substantial inclusion benefits: 450 million bank accounts opened, $33 billion saved through reduced welfare leakage (Ministry of Finance India, 2023). Yet the system has also generated significant exclusion and privacy concerns. Khera (2019) documents at least 25 starvation deaths linked to Aadhaar-related denial of food rations, with authentication error rates affecting 12% of rural beneficiaries. Multiple data breaches have exposed citizen information (Privacy International, 2023). The Indian Supreme Court's 2018 judgment (Justice K.S. Puttaswamy v. Union of India) represents a critical juncture intervention: the Court struck down mandatory private sector use of Aadhaar while upholding voluntary government use, establishing judicial oversight of the system. This demonstrates that democratic institutions can constrain digital identity expansion even after initial implementation. Key lessons: scale creates implementation challenges; biometric systems produce exclusionary errors; judicial review can constrain executive overreach; privacy safeguards require ongoing enforcement, not merely initial design. 5.3 China: Authoritarian Model China's integration of digital identity with the Social Credit System represents the authoritarian potential of identification technology. The system tracks 1.4 billion citizens, processing 50 billion facial recognition scans daily and maintaining behavioral profiles affecting access to travel, education, and employment (Qiang, 2023). As of 2023, 23 million people have been restricted from purchasing plane or train tickets due to low social credit scores (Human Rights Watch, 2023). The system exemplifies Foucault's (1977) concept of disciplinary power: identity becomes an instrument for shaping behavior through continuous surveillance and graduated sanctions. Key observations: identical technologies produce radically different outcomes under different governance contexts; absence of judicial review, civil society, and political competition removes constraints on surveillance expansion; efficiency gains coexist with comprehensive control. Table 1: Digital Identity Outcomes by Governance Context Metric Estonia (Democratic) India (Hybrid) China (Authoritarian) Adoption Rate 99% voluntary 95% enrolled 100% mandatory Citizen Trust 89% 62% N/A (compliance) Data Transparency Full visibility Limited None Judicial Review Active Significant (2018) Absent Exclusion Rate Minimal 12% rural error 23M restricted Digital Social Contract Page 7 of 18 Note: Data sources: Estonia figures from e-Estonia (2023a, 2023b); India from UIDAI (2023), Lokniti-CSDS (2022), Khera (2019); China from Human Rights Watch (2023). 6. Two Futures: The Stakes of Governance Choice The comparative analysis reveals that identical technologies produce radically different outcomes under different governance contexts. To illustrate the stakes, consider two projected scenarios for 2035. The Democratic Path: Digital identification systems are embedded within strong accountability frameworks. Citizens access healthcare, banking, and education seamlessly. Privacy protections are enforced through independent oversight, transparent audits, and active civil society monitoring. Digital identification reduces corruption by eliminating ghost beneficiaries, expands inclusion by providing formal identity to marginalized populations, and strengthens institutional trust. Projected outcomes: 95% reduction in identity fraud; universal access to basic services; 50% reduction in administrative costs; citizen trust in government increases to 80%. The Authoritarian Path: Digital identification is fused with comprehensive surveillance. Every purchase, movement, and expression is tracked. Dissenters are flagged, travel is restricted, and services are denied through algorithmic assessment. What began as efficiency becomes coercion; what promised inclusion ends in control. Projected outcomes: 100% population surveillance; 30-40% of citizens experience digital exclusion for behavioral noncompliance; social credit systems determine life opportunities; democratic backsliding accelerates. Both futures remain possible. The technology is identical. The difference lies in governance: whether power is constrained by oversight, accountability, and citizen participation, or concentrated in state or corporate hands. As Sen (1999) argues, technology's impact on human capability depends entirely on the institutional context in which it operates. 7. The Digital Social Contract: A Middle-Range Theoretical Framework If digital identity integration is structurally pressured but politically contestable, the question becomes: what framework can guide democratic governance of these systems? I propose the "Digital Social Contract" as a middle-range theory (Merton, 1968)—abstract enough to generalize across contexts, concrete enough to generate testable propositions and actionable policy. 7.1 Theoretical Foundations and Derivation of Components The framework synthesizes three theoretical traditions. From Rousseau (1762/2002), I adopt the premise that political authority is legitimate only when it reflects the will of the people— identity belongs to citizens, not states or corporations. From Habermas (1996), I adopt the requirement that legitimacy demands ongoing deliberation, not merely initial consent. From Rawls (1971), I adopt the "veil of ignorance" test: systems should be designed as if designers did not know their position in society, leading to protections for the most vulnerable. Critical surveillance scholars object that identity systems are inherently instruments of control, incapable of democratic restructuring (Gilliom & Monahan, 2013). This critique must be taken seriously. Yet I argue that the surveillant assemblage is not monolithic: it comprises multiple actors (state agencies, corporations, civil society) with partially Digital Social Contract Page 8 of 18 conflicting interests. Democratic restructuring does not eliminate surveillance but redirects it toward accountability—ensuring that those who watch are themselves watched. Rather than presenting the framework's components as an ad hoc list, I derive them systematically from two foundational principles: democratic legitimacy and individual autonomy. Democratic legitimacy, following Habermas, requires that those affected by decisions participate in making them; that decision-making processes are transparent and contestable; and that power is checked through institutional separation. Individual autonomy, following Kant and contemporary liberal theory, requires that persons are treated as ends rather than means; that individuals retain control over information constitutive of their identity; and that intrusions on autonomy are proportionate, necessary, and subject to consent. From the democratic legitimacy principle, I derive three components. Legal Protections (Component 1) instantiate the requirement that power be constrained by publicly known and consistently applied rules—the rule of law foundation of legitimate governance. Institutional Oversight (Component 3) instantiates the separation of powers principle, ensuring that those who operate identity systems are subject to independent scrutiny. Democratic Participation (Component 4) instantiates the requirement that affected parties participate in governance, not merely as one-time consent but as ongoing deliberation. From the individual autonomy principle, I derive two components. Technical Architecture (Component 2) operationalizes the principle that intrusions on autonomy should be minimized—privacy-enhancing technologies enable verification without unnecessary disclosure. Data minimization requirements, zero-knowledge proofs, and decentralized architectures all serve to limit state and corporate access to information beyond what is strictly necessary. Adaptive Mechanisms (Component 6) operationalize the requirement that consent be ongoing rather than one-time—as technologies and threats evolve, so too must the protections that safeguard autonomy. The remaining component, International Cooperation (Component 5), is derived from the interaction of both principles with the empirical reality of globalized data flows. Democratic legitimacy within borders is undermined when foreign actors access citizen data without accountability; individual autonomy is compromised when data flows beyond the jurisdiction of protective frameworks. International cooperation thus becomes a necessary condition for the domestic realization of both foundational principles. 7.2 Six Components The Digital Social Contract comprises six essential components: Component 1—Legal Protections: Constitutional or statutory protections for privacy and identity; clear limits on government surveillance and corporate data use; algorithmic accountability provisions including the right to explanation (following GDPR Article 22); data minimization requirements limiting collection to necessary purposes. Component 2—Technical Architecture: Privacy-enhancing technologies including zeroknowledge proofs (Ben-Sasson et al., 2014), enabling verification without disclosure; differential privacy techniques preventing re-identification (Dwork & Roth, 2014); options for decentralized or federated architectures reducing single points of failure (W3C, 2022). Component 3—Institutional Oversight: Independent oversight bodies with genuine enforcement powers; regular third-party audits with public reporting; whistleblower Digital Social Contract Page 9 of 18 protections for those reporting abuse; clear accountability mechanisms for officials who misuse data. Component 4—Democratic Participation: Citizen engagement in system design through deliberative forums; ongoing participatory governance rather than one-time consent; civil society monitoring and advocacy capacity; accessible grievance mechanisms for affected individuals. Component 5—International Cooperation: Agreements preventing cross-border data exploitation; mutual recognition frameworks respecting sovereignty while enabling interoperability; cybersecurity cooperation and shared threat intelligence; international tribunals for identity-related disputes. Component 6—Adaptive Mechanisms: Mandatory review cycles (every 2-3 years) updating safeguards as technology evolves; sunset clauses for emergency surveillance measures; horizon scanning for emerging threats (quantum computing, advanced AI); built-in flexibility for incorporation of new privacy-enhancing technologies. 7.3 Confronting the Legitimation Critique The surveillance studies literature raises a fundamental objection that demands direct engagement: oversight mechanisms may normalize surveillance rather than constrain it. Gilliom and Monahan (2013) argue that accountability frameworks can function as legitimation devices—creating the appearance of democratic control while surveillance expands beneath the veneer of procedural compliance. On this view, the Digital Social Contract framework risks providing cover for the very dynamics it purports to constrain. This critique contains genuine insight. Oversight can indeed function as window-dressing when: oversight bodies lack genuine independence from the agencies they monitor; enforcement powers are nominal rather than substantive; review cycles occur too infrequently to constrain rapid technological change; civil society lacks the technical capacity to detect violations; and international pressures push toward surveillance expansion rather than democratic accountability. However, the critique proves too much. If all accountability mechanisms inevitably normalize surveillance, then the observed variation across governance contexts becomes inexplicable. Estonia's 2% annual disciplinary rate for officials who improperly access data demonstrates that oversight can impose real costs; China's absence of such constraints demonstrates that these mechanisms are not merely symbolic. The critique correctly identifies a risk but incorrectly treats it as an inevitability. I propose three conditions under which accountability structures genuinely constrain rather than legitimate surveillance expansion. First, oversight must be adversarial rather than cooperative: oversight bodies must be institutionally positioned as antagonists to surveillance agencies rather than partners in "responsible" expansion. This requires genuine independence—separate budgets, distinct appointment mechanisms, and protection from executive removal. Second, accountability must be ex ante rather than purely ex post: systems that require prior authorization for new surveillance capabilities constrain expansion more effectively than systems that only review violations after they occur. Third, transparency must be public rather than internal: oversight findings must be accessible to civil society actors with the technical capacity and political resources to mobilize Digital Social Contract Page 16 of 18 This paper has developed the concept of constrained democratic agency to navigate between technological determinism and naive voluntarism. Structural pressures are real and powerful, but political agency remains decisive during critical junctures when institutional arrangements are established or contested. Comparative analysis of Estonia, India, and China demonstrates that governance context—not technology—is the decisive variable determining outcomes. Process tracing of India's Puttaswamy judgment reveals the precise mechanisms— coalition formation, evidentiary accumulation, strategic litigation, and judicial intervention— through which democratic agency operates. The Digital Social Contract framework provides both normative guidance and empirical propositions. Its six components—Legal Protections, Technical Architecture, Institutional Oversight, Democratic Participation, International Cooperation, and Adaptive Mechanisms— are derived from first principles of democratic legitimacy and individual autonomy, specifying the conditions under which digital identity can serve democratic rather than authoritarian ends. Its six propositions provide testable hypotheses for empirical research. The framework directly confronts the legitimation critique by specifying conditions under which oversight constrains rather than normalizes surveillance expansion. Critical challenges remain. Mobilizing political agency against structural pressures requires coalition building, strategic litigation, technical counter-expertise, and international solidarity. Low-capacity states require adaptation strategies emphasizing phased implementation, regional cooperation, and harm mitigation—as Kenya's Huduma Namba experience demonstrates. Non-Western philosophical traditions—Ubuntu, Confucianism, Islamic jurisprudence—enrich the framework by emphasizing relational identity, social harmony, and communal deliberation alongside individual rights. The framework operates within boundary conditions that limit its applicability to contexts with minimum state capacity and institutional differentiation. As Winner (1980) observed, "The crucial decisions about technology are not made in laboratories or boardrooms, but in the political arena." Digital identity will be shaped not by algorithms but by the strength of democratic institutions and the vigilance of citizens. The window for intervention may be narrowing as path dependencies solidify. Scholars, policymakers, and civil society must act before technological and political choices become irreversible. The stakes are substantial: a Digital Social Contract that balances efficiency with freedom, technology with humanity, and standardization with diversity—or a future where identity becomes an instrument of control. The choice remains ours to make. References Bell, D. A. (2008). China's new Confucianism: Politics and everyday life in a changing society. Princeton University Press. Ben-Sasson, E., Chiesa, A., Genkin, D., Tromer, E., & Virza, M. (2014). Zerocash: Decentralized anonymous payments from Bitcoin. IEEE Symposium on Security and Privacy, 459-474. Bhatia, G. (2019). The transformative constitution: A radical biography in nine acts. Harper Collins India. Capoccia, G., & Kelemen, R. D. (2007). The study of critical junctures: Theory, narrative, and counterfactuals in historical institutionalism. World Politics, 59(3), 341-369. Chan, J. (2014). Confucian perfectionism: A political philosophy for modern times. Princeton University Press. Digital Social Contract Page 17 of 18 CISA. (2021). Alert (AA20-352A): Advanced persistent threat compromise of government agencies. Cybersecurity and Infrastructure Security Agency. Drèze, J. (2019). Sense and solidarity: Jholawala economics for everyone. Oxford University Press. Dwork, C., & Roth, A. (2014). The algorithmic foundations of differential privacy. Foundations and Trends in Theoretical Computer Science, 9(3-4), 211-407. Ellul, J. (1964). The technological society. Vintage Books. e-Estonia. (2023a). Data governance framework. https://e-estonia.com/data-governance/ e-Estonia. (2023b). Digital society statistics. https://e-estonia.com/statistics/ Federal Trade Commission. (2022). Data brokers: A call for transparency and accountability. FTC Report. Feenberg, A. (2002). Transforming technology: A critical theory revisited. Oxford University Press. Foucault, M. (1977). Discipline and punish: The birth of the prison. Vintage Books. Gilliom, J., & Monahan, T. (2013). SuperVision: An introduction to the surveillance society. University of Chicago Press. Habermas, J. (1996). Between facts and norms: Contributions to a discourse theory of law and democracy. MIT Press. Haggerty, K. D., & Ericson, R. V. (2000). The surveillant assemblage. British Journal of Sociology, 51(4), 605-622. Human Rights Watch. (2023). China's algorithms of repression. HRW. Kamali, M. H. (2008). Shari'ah law: An introduction. Oneworld Publications. Khera, R. (2019). Dissent on Aadhaar: Big data meets big brother. Orient Blackswan. Kosinski, M., Stillwell, D., & Graepel, T. (2013). Private traits and attributes are predictable from digital records of human behavior. PNAS, 110(15), 5802-5805. Lessig, L. (1999). Code and other laws of cyberspace. Basic Books. Lokniti-CSDS. (2022). State of democracy in India survey. Centre for the Study of Developing Societies. Merton, R. K. (1968). Social theory and social structure. Free Press. Meta. (2023). Q4 2023 earnings report. Meta Platforms, Inc. Metz, T. (2007). Toward an African moral theory. Journal of Political Philosophy, 15(3), 321-341. Ministry of Finance India. (2023). Economic survey 2022-23. Government of India. Narayanan, A., & Shmatikov, V. (2008). Robust de-anonymization of large sparse datasets. IEEE Symposium on Security and Privacy, 111-125. Nubian Rights Forum & Others v. Attorney General. (2020). Kenya High Court, Petition No. 56 of 2019. OPM. (2016). Cybersecurity incidents. U.S. Office of Personnel Management. Ostrom, E. (2010). Beyond markets and states: Polycentric governance of complex economic systems. American Economic Review, 100(3), 641-672. Pierson, P. (2000). Increasing returns, path dependence, and the study of politics. American Political Science Review, 94(2), 251-267. Privacy International. (2023). The global surveillance industry. PI Research. Przeworski, A., & Teune, H. (1970). The logic of comparative social inquiry. Wiley-Interscience. Qiang, X. (2023). The rise of China's digital authoritarianism. Journal of Democracy, 34(1), 45-59. Ramose, M. B. (1999). African philosophy through Ubuntu. Mond Books. Digital Social Contract Page 18 of 18 Rao, U. (2018). Biometric citizenship: Aadhaar and the politics of inclusion in India. South Asia, 41(3), 511-526. Rawls, J. (1971). A theory of justice. Harvard University Press. Rousseau, J.-J. (2002). The social contract (M. Cranston, Trans.). Penguin Classics. (Original work published 1762) Sen, A. (1999). Development as freedom. Oxford University Press. Statista. (2023a). Google search statistics. Statista. Statista. (2023b). Amazon user statistics. Statista. Supreme Court of India. (2018). Justice K.S. Puttaswamy (Retd.) v. Union of India, Writ Petition (Civil) No. 494 of 2012. UIDAI. (2023). Aadhaar dashboard. Unique Identification Authority of India. W3C. (2022). Decentralized identifiers (DIDs) v1.0. W3C Recommendation. Wang, M., & Deng, W. (2021). Deep face recognition: A survey. Neurocomputing, 429, 215-244. Wang, Y., & Kosinski, M. (2018). Deep neural networks are more accurate than humans at detecting sexual orientation from facial images. JPSP, 114(2), 246-257. Winner, L. (1977). Autonomous technology: Technics-out-of-control as a theme in political thought. MIT Press. Winner, L. (1980). Do artifacts have politics? Daedalus, 109(1), 121-136. World Bank. (2018). ID4D: Global dataset. World Bank Group. Zuboff, S. (2019). The age of surveillance capitalism. PublicAffairs.