UPI's fee fight hits the Supreme Court, and India writes AI's first rulebook

NPCI told the Supreme Court on November 5 that merchants cannot pass UPI's new MDR fee onto customers, and the court didn't buy the merchants' request to pause the charge either. Here's what actually changed back in October: big merchants now pay NPCI 0.4% on UPI payments above ₹2,000, a fee meant to keep the free-UPI promise intact by taxing the payment chain instead of your wallet. Except that's not quite how pricing works. A fee that hits a shop's margin has a way of finding its way back to the price tag, MDR rule or not. The court case won't settle that argument, just whether NPCI can legally insist it tries.

Google, Meta and TikTok each filed a separate lawsuit on November 5 to block AB 1709, California's law against psychologically exploitative app features for under-16 users, meaning personalised feeds and autoplay. The law takes effect January 1, 2027, if it survives court. All three companies are leaning on the same two defenses, the First Amendment and Section 230, the law that's shielded platforms from liability for decades. Google's line is that parents should decide what their kids see, not Sacramento. Fair point, except the algorithm deciding what shows up next was never really a parental setting to begin with. This isn't the first fight like it, and it probably won't be the one that settles it.

Delhi Police and Hyderabad Police both put out fresh Diwali scam warnings this week, including a fake ₹1,000 Paytm gift message doing the rounds over SMS and RCS. The actual fix has been sitting inside your Messages app the whole time. Open Google Messages, tap your profile photo, go to Messages settings, then Spam protection, and switch on both Spam protection and Scam detection. The second one runs on-device, watching for the exact pattern these messages use, urgency, a reward, and a link. It won't catch everything, nothing does, but it catches the obvious ones before you even have to think about it.

CERT-In published a 107-page AI Security Auditing framework on November 5, and most of it is aimed squarely at agentic AI, the kind that plans tasks, uses tools, and sometimes hands work off to other AI systems without asking first. The checklist is genuinely thorough: test whether an agent exceeds its permissions, whether its memory can leak one user's data to another, whether a shutdown command actually shuts it down. What the guidelines don't have yet is teeth. No named compliance deadline, no stated penalty, no list of who's actually required to run one of these audits. India built the rulebook before it decided who has to follow it, and that order of operations is going to matter the first time an AI agent does something nobody approved.

UPI's free-for-everyone reputation took a quiet hit this week. Big merchants already pay 0.4% on UPI payments over ₹2,000, and NPCI just told the Supreme Court merchants can't legally bill you for that. So here's the honest question: if that fee ever did land on your receipt tomorrow, would you actually go back to cash for big purchases, or just absorb it like every other charge you already have? No judgment either way, just curious where this audience actually lands.