Programmatic advertising under India's DPDP Act requires valid, specific consent before personal data — cookies, device IDs, behavioural signals — is collected and shared with adtech partners such as DSPs, SSPs and data-management platforms. Bundled or implied consent buried in terms and conditions will not satisfy the Act. Advertisers and publishers are Data Fiduciaries for the audience data they control and must ensure processors and partners are under DPDP-aligned agreements. The biggest gap in Indian programmatic today is that consent is captured for the site visit but not specifically for the downstream sharing that programmatic depends on.
Programmatic runs on shared audience data — and the DPDP Act now governs every part of that flow. Check your consent, data-sharing and partner readiness.
Programmatic advertising is built on collecting and sharing personal data at scale — cookies, device identifiers, behavioural signals and inferred audience segments moving in milliseconds between publishers, DSPs, SSPs and data-management platforms. Under India's DPDP Act, every one of those data points is personal data that requires valid consent to collect, and a lawful basis and agreement to share. The mechanics that make programmatic work — automated, real-time data sharing across many partners — are precisely what make it hard to keep compliant.
The most common gap is consent scope. A company captures consent for the website visit, but the specific, informed consent for downstream sharing with dozens of adtech partners — which programmatic fundamentally depends on — is missing or buried. As the Data Fiduciary for its audience data, the advertiser or publisher remains accountable no matter how many hands the data passes through. Niti Bharat helps adtech-reliant businesses close exactly this gap before May 2027 enforcement.
Three things determine whether a programmatic operation is DPDP-defensible: granular consent captured before any tracking loads, a withdrawal mechanism that genuinely propagates downstream so sharing stops, and DPDP-aligned agreements with every partner in the chain. Missing any one of these leaves you processing personal data without a valid basis. Sensitive-inference segments — health, financial status, or anything touching children — raise the stakes sharply, since children's data requires verifiable parental consent and carries penalty exposure up to ₹200 crore.
Because adtech stacks change constantly — new partners, new segments, new tags — this is not a one-time fix but an ongoing governance discipline. Niti Bharat's fixed-price DPDP engagements (₹75K–₹3.2L depending on scope) map your full data-sharing chain, standardise partner agreements, and set up the consent and withdrawal plumbing so your programmatic operation can defend how audience data flows through it.
A practical pack covering consent-before-tracking setup, a partner data-sharing agreement checklist, and a consent-withdrawal propagation guide for programmatic stacks.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
