OTT platforms, news publishers, and ad-tech firms collect vast volumes of viewer behavioural data. DPDP Rules 2025 require explicit, purpose-specific consent for every use — including content recommendations, targeted ads, and children's profiles — with penalties up to ₹250 Cr per incident.
The DPDP Act 2023 and Rules 2025 apply fully to OTT platforms (Hotstar, SonyLIV, Zee5, JioCinema), news media sites, digital publishers, ad-tech firms, and podcast platforms — all of which qualify as Data Fiduciaries processing subscriber and viewer personal data. Every distinct processing purpose — content recommendations, programmatic advertising, subscription analytics, children's profiles — requires separate, explicit consent. Platforms cannot bundle consent for all uses in a single click-through. The enforcement deadline is May 2027, but implementation of consent management and children's data frameworks typically requires 12–18 months, making immediate action essential.
OTT and media companies sit at the intersection of behavioural profiling, programmatic advertising, and children's content. Here's what you're navigating under DPDP Rules 2025.
OTT platforms build detailed behavioural profiles from every viewing session — genres watched, time-of-day patterns, episodes abandoned, search queries, and content ratings. Under the DPDP Act 2023, each distinct profiling purpose — personalised recommendations, watch history, content discovery, user segmentation — requires specific, informed consent. A blanket consent at sign-up is not sufficient. Platforms must redesign their consent architecture to capture granular, withdrawable consent per use case, and must delete profiles when consent is withdrawn or the subscription lapses.
The ad-tech stack powering digital media — DSPs, DMPs, SSPs, ad exchanges, data brokers, and measurement vendors — processes viewer data across every impression. Under DPDP, the OTT platform as Data Fiduciary is responsible for ensuring that every vendor in this chain who processes viewer personal data has a signed Data Processing Agreement (DPA) in place. Sharing audience segments or ad IDs with ad networks without viewer consent for that purpose is a DPDP violation. Real-time bidding pipelines that pass user data to third-party bidders must be redesigned or gated behind explicit ad-personalisation consent.
Credit card details, UPI transaction IDs, and subscription tier history, when combined with a viewer's full content consumption profile, create an exceptionally rich personal dataset. DPDP imposes strict security obligations and purpose limitations on combined financial and behavioural data. Payment data collected for subscription billing cannot be retained for analytics, shared with content partners for audience insights, or used for cross-sell targeting without separate consent and documented legal basis. Platforms must implement data silo controls to prevent automatic commingling of billing and viewing data in analytics pipelines.
Kids' shows, educational content, and children's profiles on OTT platforms are watched by users under 18. The DPDP Act 2023 imposes the highest protection standard for children's data — verifiable parental consent is required before any personal data of a minor is collected or processed. Platforms cannot rely on self-declared age at sign-up. Age verification mechanisms must be implemented, and once a minor is identified, the platform is prohibited from profiling them, serving targeted advertising, or sharing their data with the ad-tech stack. Parental consent must be freely withdrawable, and the platform must provide a mechanism for parents to access and delete their child's data.
Every category below is personal data under the DPDP Act 2023. Each requires a valid legal basis, purpose documentation, and Data Principal rights enablement.
A structured approach built for the consent complexity and ad-tech scale of digital media — not a generic compliance checklist.
Redesign your consent capture to obtain separate, specific, informed consent for each distinct processing purpose: content recommendations, watch history, personalisation, targeted advertising, third-party data sharing, and audience analytics. The single "I agree to our Privacy Policy" at sign-up does not satisfy DPDP's consent standard. Build a consent preference centre — accessible from account settings — that allows subscribers to grant or withdraw consent per purpose at any time. Ensure that withdrawal of consent for advertising does not impair access to the subscription service (consent must be voluntary). Maintain consent records with timestamps and retain them for the duration of the subscription and three years thereafter.
Map every third party that receives viewer personal data — DSPs, SSPs, DMPs, ad exchanges, verification vendors, measurement platforms, CDN providers, and analytics tools. For each vendor that processes personal data on your behalf, execute a Data Processing Agreement (DPA) that specifies: the categories of data shared, the processing purpose, the retention period, security obligations, sub-processor restrictions, and Data Principal rights support. Review your real-time bidding integrations specifically — if viewer data (including ad IDs or device fingerprints) flows to third-party bidders without subscriber consent for advertising, this pipeline must be consent-gated or restructured. Contextual advertising (based on content being watched, not on viewer profiles) does not require consent and is a DPDP-compliant alternative.
Build an age verification mechanism that goes beyond self-declaration — the DPDP Act requires verifiable parental consent for users under 18. For dedicated kids' profiles or sections: (a) identify minor users through date-of-birth validation or parental-account-linked profiles; (b) present a separate, age-appropriate consent notice to the parent or guardian; (c) implement a hard block on ad-tech tracking and profiling for verified minor accounts; (d) provide parents with a dashboard to view, correct, and delete their child's data. Platforms that offer children's content even incidentally — not just dedicated kids' platforms — must assess whether their general subscriber base includes minors and design appropriate age-verification checkpoints at account creation. Document your age verification methodology and retain parental consent records.
Media companies face two critical milestone dates. Consent management platform (CMP) implementations and ad-tech restructuring typically require 12–18 months — planning must begin now.
Fixed-price tools and expert engagements built for India's digital media sector. Start with a readiness assessment or go straight to a targeted deep-dive.
Tell us about your platform and your biggest DPDP concern — viewer profiling, ad-tech DPAs, or children's data. We'll come prepared with observations specific to your content model and data stack.
Answers to the questions we hear most from OTT platforms, publishers, and ad-tech compliance and legal teams.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
