How does the DPDP Act affect advertising in India?
India's Digital Personal Data Protection (DPDP) Act, 2023 requires businesses to obtain clear, specific consent before processing personal data, including data used for ad targeting, and bans tracking, behavioral monitoring and targeted advertising directed at children under 18. Rules notified in November 2025 phase in most obligations over roughly 18 months.
Under the India DPDP Act, companies ("data fiduciaries") must give notice in plain language, let people withdraw consent as easily as they gave it, and delete data once its purpose ends. It also introduces registered consent managers and a Data Protection Board to handle complaints and penalties, which can reach ₹250 crore per breach.
For advertisers and publishers, the children's provisions are significant because many Indian internet users are young. Expect more contextual targeting, first-party data programmes built on explicit consent and a stronger role for CMPs.