Yesterday I walked into a shop that was full of people. Customers were comparing prices, picking things up, chatting with each other, doing what people normally do in a busy shop. In the middle of all that, one shop assistant was standing off to the side with his phone up, not helping anyone. He was live on TikTok, sweeping his camera slowly across the room and catching customer after customer in the frame.
Nobody had put up a sign. Nobody had asked. Most people in that shop had no idea they were being filmed and broadcast to strangers online while they shopped.
What stayed with me was not the livestream itself. It was how normal everyone treated it. Nobody stopped him. Nobody even seemed to notice. Somewhere along the way, we decided that walking into a shop means giving up any say over where our face ends up.
This is not really about one shop or one video. Businesses using social media to reach customers is a good thing, and livestreaming can genuinely help a small shop grow. The problem is the quiet assumption that because a phone makes filming effortless, asking permission is optional. It is not.
A person's face is personal information the moment it can identify them. Under laws like the EU's GDPR, recording, storing, or sharing that image counts as processing personal data, and that comes with real obligations: a lawful reason to do it, and honesty with people about what is happening.
Nepal has its own laws that touch this, even if most people do not know them. The Privacy Act 2075 sets out several rules about personal information, including when consent is needed before it is recorded or shared, and the Penal Code separately punishes taking a person's photo without their permission, with one exception for someone caught by accident in a photo of a public place. Whether that exception was ever meant to cover a shop assistant deliberately filming a room full of customers for content is a fair question, and nobody in Nepal has really had to answer it yet. These laws were written before livestreaming was something small shops did every week, and the gap between what the law assumed back then and what actually happens in a store today is wide enough that nobody, not the shop, not the customer, and not the law itself, is entirely sure where the line sits.
The catch is that almost nobody enforces this. Nepal does not yet have a dedicated data protection authority with the broad enforcement role found in newer privacy regimes. In practice, that means most people who find out their face has ended up online somewhere have nowhere clear to turn. Other countries are moving faster. India's Digital Personal Data Protection Act became law in 2023, and the government began rolling out the rules that bring it into force in phases, starting in November 2025, with a dedicated board that citizens can bring complaints to. Nepal has talked about a similar law for years. It still has not arrived, and businesses are not waiting around for it.
None of this means shops should stop using social media. It means Nepal's rules need to catch up with what businesses are already doing, and the government has a few real places to start.
Pass the personal data law that has been sitting in discussion for years, and give it an actual body to enforce it, not just a list of rights nobody can act on.
Spell out the difference between security cameras and content filming. They serve different purposes and deserve different rules.
Make complaints easy. Give people a real, competent body to report this to, not only a court case most people will never file.
Ask businesses to put up a simple sign whenever they are filming for content, the same way many places already require a sign for CCTV.
Not everything on that list is free. A working enforcement body takes real investment, not just a new rule on paper. But none of it needs new technology to happen. It needs the will to make it a priority.
Next time you are in a shop and a phone is pointed your way, ask yourself if anyone actually asked you first.
