Quick Answer
OTT platforms and media companies collect viewing behaviour, payment details, and account information of Indian subscribers. Under the DPDP Act 2023, personalisation algorithms using personal data require consent, and subscription data cannot be used for purposes beyond service delivery without separate consent. Large OTT platforms are likely to be designated as Significant Data Fiduciaries given their scale of processing.
Quick AnswerOTT platforms must provide granular consent choices for content recommendations, advertising profiling, and data sharing with content partners. Users must be able to delete their viewing history and account data on demand.
DPDP Compliance Checklist
- Implement granular consent toggles: content personalisation, advertising, and analytics — separately
- Allow subscribers to download their personal data (viewing history, payment info) on request
- Implement account deletion within 30 days — including all viewing data and payment tokens
- Review ad tech integrations: ensure programmatic advertising partners are DPDP compliant
- Restrict children's profiles from behavioural advertising — apply DPDP minor protections
- Publish clear privacy notice explaining what data is collected and why
- Audit content recommendation algorithms for use of sensitive personal data
- Train customer support on DSAR handling — 30-day response requirement
- Implement 72-hour breach notification SOP for subscriber data incidents
- Conduct annual DPDP impact assessment for new personalisation features
Download Full Compliance Guide (Free)
Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.
Frequently Asked Questions
Can OTT platforms use viewing history for advertising?+
Only with explicit, specific consent for advertising purposes. General acceptance of terms is insufficient — users must affirmatively opt in to ad profiling.
Do children's profiles on OTT need special protection?+
Yes. DPDP requires verifiable parental consent before processing data of users under 18. OTT platforms must prevent targeted advertising on children's profiles.
What about cross-border content licensing and data sharing?+
Cross-border data sharing with content studios or licensing partners must comply with DPDP's data transfer restrictions and obtain user consent where required.
Every Sunday
The Sunday DPDP Brief
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
