Ad-Tech and Digital Marketing: A DPDP Act Impact Study

Executive summary

Digital marketing in India works like a relay. A phone number typed into an enquiry form can pass to a lead aggregator, a list seller, an agency, a call centre and an advertising platform within days. Each hand assumes the previous one had permission.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 end that assumption when their main duties apply on 13 May 2027. A data fiduciary decides why and how personal data is processed; a data principal is the person the data is about; a data processor processes data on a fiduciary's behalf. In marketing, one company can be all three on different campaigns.

Headline rating: Overall impact High. Six of the twelve areas in the Trayambic scorecard below are rated High for a typical agency, ad-tech platform, data broker or telemarketing operation.

The three biggest changes:

• Consent must travel with the data. There is no "legitimate interests" ground, and s.6(10) makes the fiduciary prove that consent was given to it. A purchased list carries, at best, the seller's consent, not the buyer's.
• Children cannot be targeted. Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at anyone under 18, and parental consent does not lift the bar.
• Every call and SMS needs two permissions. TRAI's Third Amendment to its commercial communication regulations (18 September 2026) makes legacy consents valid only once registered on operators' platforms, and keeps its consent separate from DPDP consent.

The Act regulates data, not creative content: the CCPA governs the message, the DPDP Act governs who receives it.

Background

The sector is a chain of specialists:

• Agencies (creative, media and performance) plan and buy campaigns, and often run lead generation on commission.
• Ad-tech platforms: demand-side platforms (DSPs), which buy ad impressions for advertisers in real-time auctions; supply-side platforms (SSPs), which sell publishers' inventory; ad networks; attribution and measurement firms.
• Martech: CRM systems, customer data platforms (CDPs) and SMS, email and WhatsApp vendors.
• Data brokers and list sellers, who compile, buy and resell contact lists and audience segments.
• Influencers, creator agencies and affiliate networks, paid per post, click or sale.
• Telemarketers and call centres working for banks, insurers, ed-tech and real estate brands.

The data principals include customers, prospects who never dealt with the brand, visitors known only by a device identifier, influencers, the children who see ads or follow creators, and everyone whose number sits on a list. The data runs from phone numbers to cookie and advertising IDs, hashed emails, app events, location, inferred interests, call recordings and lead-form answers about income or exam year. Much of it goes abroad, because the largest advertising platforms are foreign.

Legal framework

The DPDP provisions that matter most

• Personal data (s.2(t)). "Any data about an individual who is identifiable by or in relation to such data". Device IDs and hashed identifiers that a platform can match qualify.
• Fiduciary (s.2(i)). Anyone who "alone or in conjunction with other persons" decides purpose and means.
• Grounds (ss.4, 6, 7). Consent, or a closed list of legitimate uses. Section 7(a) covers data a person "has voluntarily provided" for a specified purpose, not data obtained from someone else.
• Consent (ss.5, 6; Rule 3). "Free, specific, informed, unconditional and unambiguous", with an itemised notice; withdrawal as easy as giving (s.6(4)); processors must stop on withdrawal (s.6(6)). Under s.6(10) the fiduciary must prove notice was given by it and consent given "to the Data Fiduciary". Consents taken before commencement need a fresh notice (s.5(2)).
• Children (s.9; Rules 10, 12). Verifiable parental consent for under-18s and the s.9(3) bar. The Fourth Schedule permits processing to keep harmful advertisements away from a child and to verify that a user is not a child; it has no advertising exemption.
• Fiduciary duties (s.8). Responsibility for processors "irrespective of any agreement to the contrary"; accuracy where data is disclosed to another fiduciary (s.8(3)); erasure when the purpose ends (s.8(7)).
• Rights. Access includes "the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared" (s.11(1)(b)).
• Penalties. Up to ₹200 crore for the children's duties; up to ₹250 crore for failed security safeguards.

The Act never mentions cookies or profiling. "Advertising" appears once, in s.9(3).

Marketing, telecom and consumer rules alongside

Section 72A of the IT Act, on disclosure of information in breach of a lawful contract (up to three years, a fine of up to ₹5 lakh, or both), is untouched by the DPDP Act. Section 43A is omitted when the DPDP penalties commence.

How sections 38 and 16(2) fit them together

Section 38(1) makes the DPDP Act additional to other laws; s.38(2) makes it prevail in a conflict. TRAI has designed out the conflict: Explanation 3 to its new consent definition preserves senders' DPDP obligations, and its explanatory memorandum says revoking TRAI consent does not by itself withdraw DPDP consent. The two consents are cumulative.

Section 16(2) preserves stricter sector rules on transfers abroad. Marketing has none, and no country is restricted under s.16(1).

The dates

• Not before 18 October 2026: most of TRAI's Third Amendment applies 30 days after Gazette publication; other parts follow at 60 and 90 days.
• 13 November 2026: consent manager provisions commence. A consent manager is a Board-registered company through which people give, manage and withdraw consent.
• 13 May 2027: the main DPDP duties, rights, Rules 3 and 5 to 16, and penalties.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Bought lists and the consent chain

A data broker is a data fiduciary in its own right: it decides to collect, combine and sell personal data. Resale is a purpose that no item in s.7 covers, so the broker needs consent that names resale and, in our view, describes the buyers specifically enough to satisfy s.6(1).

The buyer carries its own burden. Section 6(10) requires it to prove that notice was given "by her" and consent given "to the Data Fiduciary". A seller's warranty that "all data is consented" proves neither. In our view, a buyer can safely use a third-party list only if it can produce, for each record, the notice the person saw, naming the buyer or a precise class of buyers and the purpose, and the consent itself.

Three duties follow:

• Accuracy. Section 8(3) requires completeness and accuracy where data is disclosed to another fiduciary. Recycled lists are a compliance failure, not just poor marketing.
• Who bought it. Under s.11(1)(b), a person can ask the broker to name every fiduciary that received her data.
• Withdrawal. Withdrawing from the buyer does not reach the broker or other buyers. Each must honour withdrawal and stop its processors.

Section 5(2) is no amnesty. It lets processing continue on pre-commencement consent, with a fresh notice, only where consent was actually given to that fiduciary. Data a person posted publicly is outside the Act (s.3(c)(ii)), but in our view a profile joining public posts to a phone number obtained elsewhere is not. Trayambic's real estate impact study applies the same test to property leads.

Cookies, pixels and matched audiences

India has no cookie law, but most cookies and software development kits (SDKs) collect personal data, so the only question is which ground applies. For advertising and analytics, it is consent.

The Business Requirement Document for consent management sketches the expected model: essential cookies on by default, every other category off until the user opts in, a first-visit banner, a preferences screen, and renewed consent when the cookie policy changes. Keep "essential" to session, security and load balancing. Banner design is covered in Trayambic's blog on dark patterns and consent design.

Pixels raise the fiduciary question. The site owner decides to fire one; the receiving platform uses the data for its own measurement and optimisation. In our view both are fiduciaries for that flow, acting "in conjunction with" each other. Trayambic's e-commerce impact study covers the retail pixel audit.

In our view, hashing does not take an email address outside the Act. The platform matches the hash to its account holders, so the person is identifiable "by or in relation to" it, and Rule 6 treats obfuscation as a security measure, not anonymisation. Uploading a customer list for matching, or as a lookalike seed, is a disclosure for advertising that the notice and consent must cover. In programmatic auctions, one bid request can carry a device ID and location to many bidders; DSPs and SSPs should be able to tell clients which fields leave and to whom.

Children and the targeting ban

Section 9(3) reads: "A Data Fiduciary shall not undertake tracking or behavioural monitoring of children or targeted advertising directed at children." Unlike s.9(1), it does not yield to parental consent, and none of the Rule 12 exemptions covers advertising.

In our view, a campaign is "directed at children" where:

• the audience is defined by an age band below 18, or by a proxy such as school class, board exam year or "teen" interests;
• known child users are retargeted, for example from a children's app or a coaching enquiry form;
• a lookalike audience is seeded with children's data.

Contextual placements that use no personal data, such as an ad beside a cartoon video, fall outside the DPDP Act but remain subject to the CCPA's conditions for advertisements aimed at children, which bar exaggeration that creates unrealistic expectations.

Creators complicate this. A brand that pays a 16-year-old creator, or runs a giveaway collecting names and numbers from a teen audience, processes children's data, needs verifiable parental consent under Rule 10, and cannot then target the entrants. Trayambic's articles on children's data in schools and on ed-tech cover the parental-consent mechanics.

Telemarketing: two permissions, two registers

TRAI's consent asks whether a sender may open a channel to a subscriber. The DPDP Act asks whether anyone may use the subscriber's number and profile for that purpose. TRAI's memorandum says a customer who wants to withdraw data-processing consent must go to the fiduciary.

In our view, the reverse also holds: once DPDP consent for marketing is withdrawn, calls must stop whatever TRAI's register shows, because the number can no longer be processed for that purpose. Brands need a two-way sync between the two records.

The Third Amendment changes the practical position:

• Legacy consents are valid only if obtained through verifiable means and registered in the Consent Register by the sender. TRAI piloted the process with eleven banks under a direction of 10 December 2025, sending customers a link to view and revoke consents.
• Inferred consent from an existing relationship is a TRAI concept with no DPDP equivalent. It may let a bank message a customer; it does not let it build a cross-sell profile.
• Enforcement tightens: TRAI's press release describes action at three unique complaints in ten days combined with AI-based flagging, against five before.

The brand that registers headers and templates on operators' distributed-ledger (DLT) platforms is normally the DPDP fiduciary; the telemarketer and SMS aggregator are its processors, and their contracts should say so. Trayambic's telecom impact study covers the operator side.

Worked example: a performance agency running student and loan leads

All figures are illustrative. A Gurugram agency with 60 staff runs lead generation for a coaching chain and a home-loan company. It buys a list of 40,000 "Class 12 science students, Delhi NCR"; runs social ads aimed at 16 to 19-year-olds interested in engineering entrance exams; seeds a lookalike audience with the coaching chain's hashed past enquirers; has a call-centre vendor dial leads from ordinary mobile numbers; and pays a 17-year-old physics creator to run a giveaway through an online form.

• The student list is unusable. It is children's data with no evidence of parental consent to the broker, still less to the coaching chain, and targeting by school class is targeted advertising directed at children anyway.
• The social campaign splits. The under-18 slice is barred. Re-aimed at parents aged 35 to 55, it is, in our view, not directed at children, although the creative can still talk about exams.
• The lookalike seed is cleaned. Minors' records come out; adults' records go in only if the enquiry notice covered advertising matching.
• The calls move. TRAI's February 2025 amendment bars ordinary ten-digit numbers for telemarketing. The coaching chain uses the 140 series through registered telemarketers, and the call-centre contract becomes a processor contract with deletion terms.
• The giveaway is redesigned. Entrants are likely children, so the form goes, or entry is limited to verified adults. The creator discloses the paid relationship under the endorsement guide.
• The agency checks its own role. If it keeps leads to sell to other coaching clients, it is a broker and a fiduciary, with every duty above.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: source inventory; halt unproven list purchases; prepare legacy consent registration with TRAI; decide on consent manager support.
• January to March 2027: age floors; new notices and consent flows; vendor and creator contracts.
• April to May 2027: recipient logs, withdrawal propagation and erasure jobs; test rights and breach processes end to end.
• Ongoing: check every new audience, tool and list against the consent record before launch; track TRAI directions, CCPA advisories and Board guidance.

Recommendations

1. 1.Treat consent as an asset you can prove record by record, not a warranty you can buy.
2. 2.Put an 18-plus floor on every targeted campaign and remove age proxies from audience definitions.
3. 3.Load no advertising cookie, pixel or SDK before consent.
4. 4.Keep TRAI consent and DPDP consent as separate records that update each other.
5. 5.Decide for every vendor and creator whether it is your processor or a fiduciary, and write the contract to match.
6. 6.If you sell or share audiences, run the business as a fiduciary: specific consent for resale, accuracy checks, recipient logs and fast withdrawal.

Key takeaways

• There is no legitimate-interests ground: targeting, list-building, audience matching and telemarketing all rest on consent the user of the data must be able to prove (s.6(10)).
• A data broker is a fiduciary in its own right; resale needs specific consent, and a seller's warranty does not give the buyer a lawful basis.
• Section 9(3) bars targeted advertising directed at under-18s, and parental consent cannot lift it.
• Hashed emails and device IDs remain personal data when a platform can match them; uploading them is a disclosure the notice must cover.
• TRAI's 2026 amendment requires legacy telemarketing consents to be registered, and says TRAI consent is separate from DPDP consent.