Quick Answer
AdTech companies processing behavioural data of Indian users face the highest DPDP Act 2023 compliance burden — consent must be obtained before tracking, retargeting, or profiling. Consent for advertising cannot be bundled with service terms and must be granular (per purpose). AdTech platforms, DSPs, and ad networks operating in India must redesign their consent flows and data pipelines before enforcement in May 2027.
Quick AnswerAdTech companies must obtain granular, specific consent for each use case — cookie-based tracking, lookalike audiences, and retargeting require separate opt-ins. Generic cookie banners will not be sufficient.
DPDP Compliance Checklist
- Implement granular consent management: separate consents for analytics, marketing, and third-party sharing
- Audit all pixel integrations on publisher sites — ensure publisher has valid consent
- Review data clean-room and DMP data sources for DPDP-compliant consent provenance
- Implement consent signal passing through your ad stack (IAB TCF or equivalent India standard)
- Restrict behavioural profiling of users who have not consented to tracking
- Train sales and data teams on what data can be used for campaign targeting
- Review third-party data purchases — ensure all data has valid DPDP consent chain
- Implement data retention limits for audience segments — delete unused segments quarterly
- Publish clear privacy notice for all first-party data collection points
- Conduct quarterly DPDP compliance reviews of consent infrastructure
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Do cookie banners satisfy DPDP consent requirements?+
Not automatically. DPDP requires explicit, informed, unambiguous consent. Pre-ticked boxes or implied consent from browsing are insufficient. Users must actively opt in.
How does DPDP affect lookalike audiences?+
Lookalike audience creation using personal data requires that the source audience data was collected with consent for advertising purposes. Using CRM data for lookalikes without ad consent violates DPDP.
Will third-party cookies be banned under DPDP?+
DPDP does not ban cookies but requires consent for any tracking. Third-party cookies used without consent will be non-compliant.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
