OTT Streaming and Digital Media: A DPDP Act Impact Study

Executive summary

A streaming service knows which titles each household member starts and abandons, when the children watch, and which devices are in the home. A news app knows which stories a reader opens and how far she reads. That viewing record drives recommendations, advertising and renewals.

Indian media regulation has so far looked at the screen, not the viewer. Part III of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 sets a Code of Ethics for streaming and digital news publishers, with age ratings and parental locks. The Cinematograph Act governs certified films. The draft Broadcasting Services (Regulation) Bill has not reached Parliament. None of these gives a viewer rights over her data.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 do. A data fiduciary decides why and how personal data is processed; a data principal is the person it is about; a data processor acts on a fiduciary's behalf. The core duties, rights and penalties commence on 13 May 2027.

Headline rating: Overall impact Medium-High. Four of twelve scorecard areas are High for a typical streaming or news platform; two are Low.

The three biggest changes:

• Children's profiles become a no-profiling zone. Section 9(3) bars behavioural monitoring and targeted advertising directed at anyone under 18. A recommendation row built from a child's viewing history is, in our view, behavioural monitoring, and parental consent does not cure it.
• Ad tiers need their own consent. Streaming what a subscriber asked for rests on her request; profiling her viewing to sell audiences does not.
• Lapsed subscribers stop being a marketing list. Data goes once its purpose is served, and the largest subscription platforms may fall within the Third Schedule's three-year dormancy rule as e-commerce entities.

Background

Digital media platforms hold six kinds of personal data:

• Account: name, email, mobile number, credentials, and household profile names and PINs.
• Subscription and payment: plan history, invoices, tokens and recurring mandates held by payment partners, and partner identifiers for telecom or device bundles.
• Viewing and listening: watch history, searches, completion, ratings, downloads and time of day; for news apps, articles read, scroll depth, comments and newsletters.
• Device and network: device and smart-TV identifiers, IP address and approximate location used for territorial licensing.
• Advertising: advertising identifiers, impressions, audience segments, and hashed emails or numbers matched against advertisers' lists.
• Support and security: transcripts, account-sharing signals, and forensic watermarks that tie a stream to an account to trace piracy.

The data principals go beyond the paying customer: other adults and children in the household, free-tier viewers, readers and commenters and, for news publishers, the people in the stories.

Data flows to cloud and delivery networks, anti-piracy vendors, analytics kits, ad servers, measurement partners, advertisers, payment aggregators, support centres and telecom distribution partners. Broadcasters straddle two regimes: the Ministry of Information and Broadcasting (MIB) licenses their linear channels, while their apps' on-demand catalogues sit under Part III of the IT Rules.

Legal framework

The DPDP provisions that matter most

• Grounds (ss.4, 6, 7). Consent or a listed legitimate use. Section 7(a) covers data a person "has voluntarily provided" for a specified purpose. There is no "legitimate interests" ground.
• Notice and consent (ss.5–6; Rule 3). Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", on an itemised, standalone notice; withdrawal must be as easy as giving it.
• Children (s.9; Rules 10 and 12). Everyone under 18 is a child. Verifiable parental consent is required, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited. Part B of the Fourth Schedule permits processing, to the extent necessary, to verify that a user is not a child or to keep harmful information from a child.
• Retention (s.8(7); Rule 8; Third Schedule). Erase when the purpose is served, unless law requires retention. Large e-commerce entities, online gaming intermediaries and social media intermediaries must also erase after three years of inactivity, on 48 hours' notice. The e-commerce class borrows the Consumer Protection Act, 2019, whose s.2(16) defines e-commerce as "buying or selling of goods or services including digital products over digital or electronic network".
• Security and breach (s.8(5)–(6); Rules 6–7). Encryption, access control, a year of logs, and notice to the Data Protection Board and each affected person without delay, with a Board report within 72 hours.
• Rights (ss.11–14; Rule 14). Access includes "the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared"; grievances answered within 90 days.
• No journalism exemption. Section 17's exemptions do not include journalism. Data a person has herself made public is outside the Act (s.3(c)(ii)).

Media and consumer law that applies alongside

• IT Rules, Part III (G.S.R. 139(E), 25 February 2021). It covers publishers of news and current affairs content and of online curated content: a curated catalogue of "audio-visual content" on demand, expressly including podcasts (whether a music-only catalogue is caught is less clear). Publishers classify content (rule 11), join a self-regulating body (rule 12), acknowledge grievances within 24 hours and decide them within 15 days (rule 10), and give MIB their entity details (rule 18). The Code of Ethics uses five ratings: U, U/A 7+, U/A 13+, U/A 16+ and A. Access controls, "including parental locks", are required from U/A 13+ upwards, and A-rated content needs "a reliable age verification mechanism".
• The 2021 stay. On 14 August 2021 the Bombay High Court stayed sub-rules (1) and (3) of rule 9, which make the Code binding and create the three-tier oversight structure (WP(L) No. 14172 of 2021). MIB nonetheless advised platforms on 19 February 2025 to follow the Code, including stricter age classification and access controls for A-rated content.
• Cinematograph (Amendment) Act, 2023 (Act 12 of 2023, 4 August 2023). It introduced advisory UA 7+, UA 13+ and UA 16+ markers for certified films, which CBFC has used since 24 October 2024, and new offences of unauthorised recording and exhibition (ss.6AA and 6AB).
• Broadcasting. The draft Broadcasting Services (Regulation) Bill, 2023 (10 November 2023) would have covered OTT content and digital news; comments closed on 15 October 2024. On 5 December 2025 the Minister of State told the Rajya Sabha that all suggestions had been examined and wide consultation would continue. No Bill has been introduced. MIB's draft Telecommunications (Television, Radio and Associated Services) Rules, 2026 (12 June 2026) consolidate rules for television channels, DTH, HITS, IPTV and radio, but not on-demand streaming.
• Consumer law. Disclosing personal information given in confidence is an unfair trade practice (Consumer Protection Act, s.2(47)(ix)). The 2023 dark patterns guidelines name "subscription trap", "disguised advertisements" and "nagging" among 13 prohibited practices; Trayambic's blog on dark patterns and consent design covers them.
• Payments. RBI's e-mandate framework (21 August 2019) requires authentication at registration, a pre-debit notice 24 hours before each recurring charge and online withdrawal. Merchants may not store card data under RBI's tokenisation circulars.
• CERT-In Directions (28 April 2022): six-hour incident reporting; 180 days of logs in India.

How sections 38 and 16(2) fit them together

Section 38(1) makes the DPDP Act additional to other law, and s.38(2) makes it prevail in a conflict. Media rules govern content, so conflicts are rare. On children the regimes reinforce each other: the Code's parental locks and age checks are practical machinery for s.9, and Part B of the Fourth Schedule lets a platform check age before any parental consent.

Section 16(2) preserves stricter sector laws on transfers abroad, but no media law requires viewing data to stay in India, and no country has been notified under s.16(1). Payment data stays subject to RBI's storage rules, another reason to keep card data out of the platform's systems.

The dates

• 13 November 2026: consent manager provisions commence.
• 13 May 2027: the main duties, rights and penalties commence, with Rules 3 and 5 to 16.

No compression of this timeline has been notified as of October 2026, and no Board members have been appointed.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: Medium-High

Children's profiles and the recommendation engine

Where a platform offers a kids' profile, that profile is effectively a declaration that the user is a child, and s.9 follows.

Recommendations. A "because you watched" row on a child's profile is built by tracking what she watched and predicting what will keep her watching. In our view that is behavioural monitoring under s.9(3). Lower-risk designs include editorially curated rows, popularity within the profile's age band, and suggestions keyed to a title's rating rather than the child's history. Keeping a resume point is closer to delivering the service than to monitoring, though the line is untested.

Advertising. Targeted advertising directed at children is prohibited outright. Child profiles should be ad-free or carry only contextual advertising chosen without the child's data.

Parental consent. Rule 10 requires checking that the consenting person is an identifiable adult, using reliable identity and age details already held or a virtual token from an authorised entity such as DigiLocker. A card or UPI payment is weaker evidence than it looks: RBI permits minors aged ten and above to operate savings accounts independently. Consent fits best when the account holder creates the child profile.

Untagged children. Children also watch on adult profiles. The Code calls for parental locks from U/A 13+ and age verification for A-rated content; Part B of the Fourth Schedule allows processing to verify that a user is not a child. A PIN on A-rated titles, set by a verified adult, serves both regimes, provided the check collects no more than it needs.

Trayambic's article on children's data in schools and ed-tech covers s.9 in more detail.

Ad tiers and the partner map

The DPDP Act does not forbid a cheaper tier with advertising, but it separates three activities that ad-supported products blend:

• Serving the stream and an ad break. This follows from the viewer's request and, in our view, rests on s.7(a).
• Targeting ads using viewing history. Profiling viewing to sell audience segments is a separate purpose needing consent and a Rule 3 notice that names it.
• Sharing with advertisers. Matching hashed emails or numbers against an advertiser's customer list, in a clean room or otherwise, discloses personal data to another fiduciary.

Consent must be "unconditional", so refusing the ad tier to anyone who declines targeting risks invalid consent. Contextual advertising for those who decline is the safer design.

An ad server acting only on the platform's instructions is a processor under contract. A measurement company or advertiser that keeps data for its own purposes is a separate fiduciary, and a viewer can ask for its identity under s.11(1)(b). Segments that reveal a viewer's faith, politics or taste for A-rated titles should never be offered to advertisers; the Act has no sensitive category, but such disclosures do real harm.

Shared accounts: one subscriber, many data principals

Every adult using a household profile is a separate data principal; only for a child does the Act treat the parent as the data principal (s.2(j)). The account holder cannot consent for other adults, so features needing consent, such as personalised advertising, should ask each profile.

Three design questions follow:

• Visibility. Can the account holder see another adult's viewing history? A profile lock and a hide-history option respect the person whose data it is.
• Rights requests. Answer access, correction and erasure for the requester's own profile, after identity checks, not the whole account.
• Password-sharing controls. Detecting viewers outside the household uses IP addresses, device identifiers and approximate location. That new purpose belongs in the notice, collection should be limited to the check, and results should not feed advertising.

Lapsed subscribers and the Third Schedule

Win-back campaigns are a familiar tactic. Under s.8(7), once a subscription ends and a reasonable period for returning has passed, the service purpose is served and the data should be erased. Win-back marketing continues only on an unwithdrawn consent. Invoices stay for the 72 months the CGST Act requires, logs for a year under Rule 8(3), and CERT-In logs for 180 days.

The Third Schedule adds a fixed clock for e-commerce entities with at least two crore registered users in India: one that "owns, operates or manages a digital facility or platform for e-commerce", using the Consumer Protection Act's definition, which includes "digital products". A "user" is anyone who "accesses or avails" its computer resource.

In our view, a subscription platform selling its own catalogue at that scale can fairly be read as an e-commerce entity, with free-tier sign-ups counting towards the threshold. The contrary view is that the class targets retail marketplaces; a platform hosting user uploads and interaction may instead meet the social media intermediary class. Until the Board or MeitY says otherwise, large platforms should build the three-year dormancy engine, with its 48-hour warning and account-access exception.

Worked example: a regional-language broadcaster's app

Consider an illustrative broadcaster running entertainment and news channels in one Indian language. Its app offers catch-up television, original web series, a live news stream, a free ad-supported tier and a premium subscription sold alone and in telecom bundles.

Classification. Original series carry Code of Ethics ratings; films keep their CBFC certificates. A-rated series sit behind a PIN set by the age-verified account holder. Kids' profiles show curated rows by age band and no targeted ads.

Notice. One Rule 3 notice itemises account, viewing, device and advertising data and states each purpose separately. Targeting and marketing have their own toggles per profile.

Partners. The bundling telecom operator is a separate fiduciary; the two exchange only an activation identifier and plan status (Trayambic's telecom impact study covers the operator's side). The ad server is a processor; the measurement partner, which keeps panel data for its own clients, is a fiduciary named in the notice.

News. Where information about people in news reports was not made public by them, or by someone legally obliged to publish it, the broadcaster records why its processing is lawful and keeps sources' details in restricted systems. In our view the missing journalism exemption is a gap for Parliament or the Board to close, not one publishers can assume away.

A breach. Attackers use leaked passwords to take over thousands of accounts. In our view that is a personal data breach. The broadcaster reports to CERT-In within six hours, notifies the Board and each affected subscriber without delay, files the Board report within 72 hours, forces password resets and offers two-step login.

Retention. Lapsed subscribers get win-back offers only if they consented to marketing. Their viewing history is deleted after a documented grace period; invoices stay for the tax period.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: data map; inventory every software kit; settle the child-profile design; assess Third Schedule exposure.
• January to March 2027: ship parental consent, the notice and toggles; sign partner terms; launch the breach runbook.
• April to May 2027: test rights responses and deletion jobs; purge unconsented ad segments; brief the board.
• Ongoing: track the Broadcasting Bill, MIB advisories and Board guidance; review child-facing features before release.

Recommendations

1. 1.Treat a kids' profile as a declaration that the user is a child: no history-based recommendations, no targeted ads.
2. 2.Split every ad-supported product into service, targeting and sharing, and seek consent for the last two.
3. 3.Classify each software kit and partner as processor or fiduciary, and remove those you cannot classify.
4. 4.Give each household profile its own privacy controls and answer rights requests per profile.
5. 5.Retire lapsed-subscriber data on a published schedule, and plan for the Third Schedule above two crore registered users.
6. 6.Make parental locks and age checks serve both the Code of Ethics and the DPDP Act, collecting the minimum.

Key takeaways

• A recommendation row built from a child's viewing history is, in our view, behavioural monitoring that s.9(3) prohibits; parental consent does not cure it.
• Ad-supported tiers must separate serving ads from targeting and sharing; only the first rests on the viewer's own request.
• Each adult in a shared household is a separate data principal; the account holder cannot consent for them.
• Large subscription platforms may be 'e-commerce entities' under the Third Schedule, which borrows the Consumer Protection Act definition covering digital products.
• The IT Rules' parental locks and age checks for A-rated content can double as DPDP age assurance if they collect the minimum.