Conventional responses to privacy protection, such as the notice-and-consent framework, are inapposite to a datafied world where ubiquitous data collection is facilitated by a range of advanced technologies. Such traditional frameworks also commonly vest the State with more leeway than private companies to access personal data, which amplifies privacy harms in case of State use of data. Despite the ominous possibility of State surveillance, the Indian judiciary has thus far grappled with the right to privacy through a narrow lens focused on individual privacy risks rather than structural moves towards a surveillance society. This article explores a different viewpoint by studying the structural effects of the Aadhaar project on privacy, which drastically differ from the individual harms that Indian privacy jurisprudence is equipped to address. It first introduces the Supreme Court’s engagement with the right to privacy through prior verdicts. It then explores the surveillance concerns raised by the petitioners in the Aadhaar verdict. This part examines the Supreme Court’s response to these surveillance challenges and its failure to address structural inroads on privacy through architectural design choices that deliberately prescribe low baseline protection. Finally, the article contrasts this approach with the more holistic perspective on citizen-State interaction evident in Justice Chandrachud’s minority view.