Matrimonial and Dating Platforms: A DPDP Act Impact Study

Executive summary

A matrimonial profile is a disclosure most people would make to no other business: caste and sub-caste, religion, income, family members' jobs, health conditions, a horoscope and photographs, often written by a parent. A dating profile adds sexual orientation, location and private conversations with strangers.

So far the law around these services has been intermediary law: s.79 of the Information Technology Act, 2000, the IT Rules, 2021, and an advisory MeitY issued to matrimonial websites in June 2016. That law is about content, fraud and police access. The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 ask a different question: whose data is this, and who agreed to its use? A data fiduciary decides why and how personal data is processed; a data principal is the person it is about; a data processor acts on a fiduciary's behalf. The core duties commence on 13 May 2027.

Overall impact: Medium-High. Four of the twelve scorecard areas rate High; consent manager readiness rates Low.

The three biggest changes:

• A parent cannot consent for an adult child. The Act treats parents as data principals only for children, so profiles created by families need the candidate's own consent.
• Written consent for orientation, health and biometrics ends with the SPDI Rules. The IT Act's 2011 rules on sensitive personal data (the SPDI Rules) apply, in our view, until 13 May 2027. After that, ordinary consent, minimisation and security carry the weight, and outing remains the worst-case harm.
• Retention must be planned around fraud and the police. Deleted accounts, IT Rules holds, one-year logs and complaints of marriage fraud all pull on the same records.

Trayambic's impact study on social media and messaging covers intermediary duties generally; this study applies them to matchmaking.

Background

The industry covers:

• Matrimony portals, general and community-specific, including services for second marriages, people with disabilities and people living with HIV, often with paid assisted matchmaking.
• Dating apps, including apps for LGBTQ+ users, with algorithmic matching, chat and calls.
• Marriage bureaus with paper files, now scanning biodata and sharing it over messaging apps.
• Community matchmaking by caste associations, religious trusts and alumni groups, from spreadsheets to apps.

The data includes contact details; marital history; occupation and income; caste, gotra and religion; birth details for horoscopes; family details; disability and health; photos and liveness selfies; gender identity and sexual orientation; location; chats; who viewed whom; and safety reports.

The data principals are candidates, the relatives who manage profiles, siblings and former spouses described in profiles, and everyone each user talks to.

Vendors include identity and liveness verification providers, background verification agencies, calling providers, horoscope engines, AI photo tools and moderation teams.

Legal framework

The DPDP provisions that matter most

• The data principal (s.2(j)). The individual the data relates to; for a child, this includes the parents; for a person with disability, her lawful guardian. No other adult stands in.
• Scope (s.3). The Act covers digital data and paper data digitised later (s.3(a)), so a bureau scanning biodata is covered. Personal or domestic processing (s.3(c)(i)) and data a person has made publicly available (s.3(c)(ii)) are excluded.
• Consent and legitimate uses (ss.6, 7). Consent must be specific and unconditional, and as easy to withdraw as to give. Section 7(a) covers data a user voluntarily provides for a specified purpose, such as showing her profile to matches.
• Accuracy and duties (ss.8(3), 15). Data used to make a decision affecting a person must be complete and accurate. Data principals must not impersonate another person when providing personal data (s.15(b)).
• Children (s.9). Anyone under 18 is a child. Part B of the Fourth Schedule permits processing only as far as needed to verify that a user is not a child.
• Security, breach and retention (s.8(5)–(7); Rules 6–8). Reasonable safeguards; notice to the Data Protection Board and each affected person; erasure when the purpose ends. Rule 8(3) keeps personal data, traffic data and processing logs for at least a year. Social media intermediaries with two crore or more registered users must erase after three years of inactivity, on 48 hours' notice.
• Offences (s.17(1)(c)). Processing to prevent, detect, investigate or prosecute offences is exempt from most of the Act, but not from security and processor accountability.

Intermediary law and the 2016 advisory

• IT Rules, 2021, as amended by G.S.R. 120(E) of 10 February 2026. A social media intermediary is one that "primarily or solely enables online interaction between two or more users" (r.2(1)(w)); in our view most dating apps and matrimony portals fit. Intermediaries must make reasonable efforts to stop users sharing content that invades another's privacy or impersonates another person (r.3(1)(b)). Registration information is kept for 180 days after an account is cancelled (r.3(1)(h)). Agencies receive information within 72 hours of a written order (r.3(1)(j)). Complaints of intimate or morphed images are acted on within two hours (r.3(2)(b)), and synthetic content is labelled (r.3(3)).
• Significant social media intermediaries (50 lakh registered users, S.O. 942(E), 25 February 2021) must offer voluntary verification, and may not use information collected for it for any other purpose without the user's express consent (r.4(7)).
• MeitY's advisory of 6 June 2016. MeitY told the Lok Sabha on 27 July 2016 that it had issued an advisory under the IT Act for online matrimonial website service providers, after consulting the Ministry of Women and Child Development, the Ministry of Home Affairs and the National Commission for Women. We could not retrieve its text.

Identity, criminal and family law

• Aadhaar. Authentication and offline verification need the holder's consent (Aadhaar Act ss.8(2)(a), 8A(2)(a)), and an entity doing offline verification may not store the Aadhaar number (reg. 14A(1)(b) of the 2021 Regulations). Under amendment rules notified on 31 January 2025, private entities may seek approval for authentication through the relevant ministry, UIDAI and MeitY.
• Bharatiya Nyaya Sanhita, 2023 (BNS). Section 69 punishes sexual intercourse obtained by deceitful means or a false promise to marry, with deceit including "marrying by suppressing identity", by up to ten years' imprisonment. Sections 77 (voyeurism) and 78 (stalking, including monitoring electronic communications) also apply.
• HIV and AIDS (Prevention and Control) Act, 2017. No one may disclose another's HIV status or private information shared in confidence without informed consent, subject to exceptions (s.8(1)(ii)); establishments keeping HIV-related records must adopt data protection measures (s.11).
• Prohibition of Child Marriage Act, 2006. A man under 21 or a woman under 18 is a child (s.2(a)); abetting a child marriage is an offence (s.10).
• Navtej Singh Johar v Union of India, (2018) 10 SCC 1. The Supreme Court held s.377 of the Indian Penal Code unconstitutional to the extent it criminalised consensual sexual conduct between adults.

Signals from Parliament

The Committee on Empowerment of Women's fourth report, Cyber Crimes and Cyber Safety of Women, presented on 23 March 2026, records that I4C, the Home Ministry's cyber crime centre, monitors fraud tactics on matrimonial platforms, and records a call for mandatory age verification on dating apps. Neither is law.

How sections 38 and 16(2) fit them together

Section 38 makes the DPDP Act additional to intermediary law and prevail in a conflict. The IT Rules' 180-day hold is retention "necessary for compliance with any law" under s.8(7), and disclosures to police on written orders fall within s.17(1)(c). In our view the 2016 advisory is guidance on due diligence, not "law" for s.8(7); its reported one-year IP log can rest on Rule 8(3) instead.

Section 16(2) preserves stricter transfer rules, but none covers matchmaking data. Foreign dating apps offering services to people in India fall within the Act under s.3(b) wherever they process.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: Medium-High

Profiles made by parents

In many families a parent or sibling writes the profile, uploads the photos and takes the first calls. Section 2(j) gives a parent the data principal's role only for a child. For an adult candidate, the candidate is the data principal and must consent.

In our view the parent's own activity is personal and domestic, but the platform's processing is not, and s.7(a) cannot cover data the candidate did not provide herself. A defensible flow:

• the profile goes live only after the candidate confirms by OTP to her own number or email, with a plain notice of what will be shown and to whom;
• the profile states who manages it;
• the candidate can take over, edit, hide or delete it at any time, and her instruction beats the manager's;
• chats conducted by a relative are labelled as such, in line with the s.15(b) duty not to impersonate another person.

Family details deserve minimisation. Siblings' names and employers, or a former spouse's details in a divorce explanation, are other people's data; occupations and numbers serve matching as well as names do.

Bureaus that scan paper biodata come within s.3(a)(ii) once it is digitised. A family forwarding a biodata to relatives is processing for a personal purpose; an association that compiles hundreds and circulates them is, in our view, a fiduciary.

Verification without hoarding identity

Verification badges answer impersonation and marriage fraud, but create the most dangerous dataset a matchmaking service holds.

• Aadhaar. Offline verification with the holder's consent confirms identity without the service keeping the number, which reg. 14A(1)(b) forbids. Online authentication needs approval under the 2025 amendment rules.
• DigiLocker. Documents fetched with consent avoid scans and photocopies.
• Purpose lock. Rule 4(7) already bars large platforms from using verification information for anything else without express consent. In our view every platform should adopt that rule.
• Keep the result, not the document. Store "verified on this date by this method", and delete document images and liveness selfies after the check. Liveness selfies are biometric data needing written consent under the SPDI Rules until May 2027.

A "verified income" or "never married" badge is data used to make a decision about the person, so s.8(3) requires it to be accurate, and users must be able to correct it.

Orientation, caste, health and location: designing for the worst case

Outing. Navtej Singh Johar ended criminal liability, not the social cost of exposure. For an LGBTQ+ dating app, in our view, the fact of using the app is itself data about sexual orientation, and passing a device identifier and app events to an advertising network can reveal it. Such apps should keep advertising and analytics SDKs out or limit them to aggregate data, offer discreet icons and notification text, and blur photos until both users match.

Caste, religion and income. In our view members-only profiles are not "made publicly available" under s.3(c)(ii), because the platform controls who sees them. Let candidates choose which attributes are visible and to whom, and never use them for advertising.

Health. In our view a matrimony service for people living with HIV is an establishment keeping HIV-related records and must adopt data protection measures under s.11 of the HIV Act. On general sites, health disclosures should be optional and hidden until a contact is accepted.

Location. Show distance in bands, not metres, and stop location updates when the app is closed. Precise distance helps a determined user find someone, and s.78 of the BNS treats monitoring a woman's electronic communications as stalking.

Photos. Profile photos are raw material for morphed images. Watermarks, screenshot friction and fast takedowns help; the IT Rules require action within two hours on a complaint of intimate or morphed images. Photos that the platform's own AI tools materially alter must carry the synthetic content label; routine enhancement that does not materially alter an image is outside the definition.

Fraud, police requests and deleted accounts

Marriage fraud and romance scams follow a pattern: a convincing profile, a quick move off-platform, then a request for money or a false promise of marriage. Complaints under s.69 of the BNS, and of cheating and extortion, bring police requests for profile data, verification records, chats and IP logs.

Requests. Disclose on written orders within 72 hours under r.3(1)(j). Section 17(1)(c) exempts this from notice and consent, not from security. Log each request, its basis and what was sent.

Reporting and blocking. Point victims to the National Cyber Crime Reporting Portal and the 1930 helpline, which the Home Ministry told Parliament take reports of all types of cyber crime. Tell other users that a profile was removed without revealing who reported it. To stop banned users returning, keep a hashed phone number rather than the whole account, and say so in the notice.

Retention.

A match that ends in marriage is a purpose served. Success stories and wedding photos need fresh consent from both people.

Minors. Dating apps should be 18-plus, and matrimony profiles should respect the Prohibition of Child Marriage Act's ages of 21 for men and 18 for women. Age checks under Part B of the Fourth Schedule should use the least data that works, such as a yes-or-no token.

Worked example: a community matrimony portal launches a dating app

An illustrative portal serves one language community, with franchise bureaus in several towns, a paid assisted service and a new urban dating app.

Its review finds:

1. 1.Parent-made profiles. Most profiles were created by parents. They are paused unless the candidate confirms by OTP within 60 days.
2. 2.Franchise bureaus. Bureaus upload scanned biodata and keep copies. Contracts now make them processors for portal data, with deletion on exit.
3. 3.Verification. Staff stored photos of Aadhaar cards. They are deleted and replaced with offline verification.
4. 4.Dating app. An analytics SDK received orientation fields. It is removed; orientation is optional and never shared.
5. 5.Retention. Deleted accounts were kept indefinitely "for the police". The table above replaces that.
6. 6.Fraud. A false-promise-of-marriage complaint brings a written police order; the team discloses within 72 hours and logs it.

Compliance framework

Phased roadmap to 13 May 2027

• Now to December 2026: map attributes and flows; stop storing ID images; close the SPDI written-consent gap.
• January to March 2027: launch candidate confirmation and visibility controls; sign bureau and vendor contracts; band locations.
• April to May 2027: run deletion jobs and rights tests; brief the board on outing and fraud scenarios.
• Ongoing: watch for action on the committee report or any bill, and for Board guidance.

Recommendations

1. 1.Make the candidate, not the family, the owner of the profile, with power to override anyone who manages it.
2. 2.Verify identity without keeping identity documents.
3. 3.Design for outing: no SDKs near orientation or health, discreet modes, banded location.
4. 4.Minimise family details and other third-party data in profiles.
5. 5.Build one retention matrix covering deletion, IT Rules holds, Rule 8(3) logs and police orders.
6. 6.Disclose to police on written orders only, log every disclosure, and direct victims to the national portal.
7. 7.Keep minors out with proportionate age checks, and apply marriage ages to matrimony.

Key takeaways

• Parents are data principals only for children; a profile a parent creates for an adult needs the candidate's own consent.
• Until 13 May 2027 the SPDI Rules require written consent for sexual orientation, health and biometric data; after that consent, minimisation and security carry the load.
• Verify identity without hoarding it: Aadhaar offline verification forbids storing the number, and r.4(7) bars reusing verification data.
• Retention must reconcile erasure with the IT Rules' 180-day hold, one-year logs under Rule 8(3) and police orders in BNS s.69 cases.
• For LGBTQ+ users, using the app is itself orientation data: keep advertising SDKs out and band locations.