Social Media and Messaging Platforms: A DPDP Act Impact Study

Executive summary

A social platform holds three things few businesses hold together: what people say in public, what they say in private, and address books that map who knows whom, including people who never signed up. Messaging apps add the SIM each account is bound to; creator platforms add identity checks and payouts.

These businesses are already heavily regulated. Section 79 of the Information Technology Act, 2000 shields intermediaries from liability for users' content if they observe due diligence. The IT Rules, 2021 define that diligence: three-hour takedowns on lawful orders, seven-day grievance resolution, synthetic-content labels and, above 50 lakh registered users, India-resident officers and message traceability on court orders. That law is about content and the State's access to it.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, 2025 are about the people behind the accounts. A data fiduciary decides why and how personal data is processed; a data principal is the person it is about; a data processor acts on a fiduciary's behalf. The core duties commence on 13 May 2027.

Headline rating: Overall impact High. Eight of the twelve scorecard areas are High; only consent manager readiness is Low.

The three biggest changes:

• Every user under 18 is a child. Section 9(3) bars behavioural monitoring and targeted advertising directed at children, reaching engagement-ranked feeds and ad targeting for users aged 13 to 17.
• Dormant accounts get a clock. Social media intermediaries with two crore or more registered users must erase after three years of inactivity, on 48 hours' notice.
• No legitimate interests ground. Safety systems, fraud detection and non-users' contact data each need a basis the Act provides.

Background

The data falls into six groups:

• Identity and account: mobile number, email, date of birth, profile details and, for messaging, the bound SIM and device.
• Content: public posts, comments, private messages, voice notes, photos and videos, many showing other people.
• Social graph: followers, groups and uploaded contact lists.
• Behaviour and inference: engagement, watch time, searches, approximate location and inferred interests.
• Verification and monetisation: verification data, creators' identity, tax and bank details, and payouts.
• Safety and legal: reports, moderation decisions, removed content held for investigation, and government notices.

The data principals include adult and teenage users, people tagged or pictured in others' posts, non-users in uploaded address books, creators, and advertisers' customers matched for audiences.

Data flows to advertisers and measurement partners, moderation centres, cloud and security vendors, payment partners, CERT-In, and government agencies under takedown notices, information requests and traceability orders.

Legal framework

The DPDP provisions that matter most

• Scope (s.3). Excluded: processing for a personal or domestic purpose (s.3(c)(i)), and data "made or caused to be made publicly available" by the data principal or someone legally obliged to publish it (s.3(c)(ii)). The illustration is a person who, "while blogging her views, has publicly made available her personal data on social media".
• Grounds (ss.4, 6, 7, 17). Consent or a listed legitimate use: s.7(a) for data a person "has voluntarily provided" for a specified purpose; s.7(d) for disclosures the law requires to the State; s.7(e) for judgments and orders. Section 17(1)(c) exempts processing for preventing, detecting, investigating or prosecuting offences from most of the Act, but not from processor accountability and security.
• Children (s.9; Rules 10 and 12). Verifiable parental consent for anyone under 18; no harm to well-being; no tracking, behavioural monitoring or targeted advertising directed at children. Part B of the Fourth Schedule permits processing, as far as necessary, to verify that a user is not a child and to keep harmful information from a child.
• Retention (s.8(7); Rule 8; Third Schedule). Erase when the purpose ends. A social media intermediary, as defined in the IT Rules, with at least two crore registered users in India must erase three years after the user last approached it or the Rules' commencement, whichever is later, on 48 hours' notice, except data needed for account access. Logs are kept for a year (Rule 8(3)).
• Security and breach (s.8(5)–(6); Rules 6–7). Encryption, access control, logging; notice to the Data Protection Board and each affected person without delay; a Board report within 72 hours.
• Rights (ss.11–14; Rule 14). Access, correction and erasure apply only to consent or s.7(a) processing; grievance redressal applies to all; 90 days to respond.
• Significant Data Fiduciaries (s.10; Rule 13). Factors include volume and sensitivity of data, "risk to electoral democracy", security of the State and public order.

Intermediary and telecom law that applies alongside

• IT Act, s.79. An intermediary that does not initiate a transmission, select its receiver or modify its content, and "observes due diligence", is not liable for third-party information. It loses that shield if, on actual knowledge or government notification, it fails to remove unlawful material expeditiously "without vitiating the evidence".
• IT Rules, 2021, rule 3 (G.S.R. 139(E), as amended to G.S.R. 120(E) of 10 February 2026, in force 20 February 2026). Publish the privacy policy and user agreement (3(1)(a)) and remind users every three months (3(1)(c)). Remove unlawful information within three hours of a court order or a reasoned intimation from an officer of at least Joint Secretary rank, or Deputy Inspector General for police (3(1)(d), recast by G.S.R. 775(E) from 15 November 2025). Keep removed content and records for 180 days for investigation (3(1)(g)) and registration information for 180 days after cancellation (3(1)(h)). Follow the 2011 reasonable security practices rules (3(1)(i)), answer authorised agencies within 72 hours (3(1)(j)) and report incidents to CERT-In (3(1)(l)). Resolve grievances within seven days, and act on complaints about intimate or morphed images within two hours (3(2)). Label synthetic content and, where feasible, embed provenance metadata that cannot be removed (3(3)).
• Rule 4: significant social media intermediaries (SSMIs). The threshold is fifty lakh registered users in India (S.O. 942(E), 25 February 2021). SSMIs appoint India-resident compliance, nodal and grievance officers and publish monthly compliance reports (4(1)); collect users' declarations on synthetic content (4(1A)); for messaging, identify a message's first originator on a court or s.69 order, only for serious offences and where less intrusive means fail (4(2)); deploy automated tools against child sexual abuse material and re-uploads of removed content (4(4)); and offer voluntary verification, including by active Indian mobile number (4(7)).
• The fact check unit. In Kunal Kamra v. Union of India the Bombay High Court, following a third judge's opinion, struck down the 6 April 2023 amendment to rule 3(1)(b)(v) that let a Central Government fact check unit flag content (final order, 26 September 2024). The words still appear in MeitY's consolidated text.
• Sahyog. MHA told the Lok Sabha on 2 December 2025 that the Sahyog portal was launched to expedite s.79(3)(b) notices to intermediaries.
• SIM binding. Under the Telecom Cyber Security Rules as amended (G.S.R. 771(E), 22 October 2025), DoT directed on 28 November 2025 that messaging apps identifying users by Indian mobile numbers stay bound to the device's active SIM, with web sessions logging out at least every six hours, within 90 days.
• CERT-In Directions (28 April 2022): six-hour reporting; 180 days of logs in India.

How sections 38 and 16(2) fit them together

Section 38 makes the DPDP Act additional to the IT Act and prevail in a conflict. Most intermediary duties slot in: the 180-day holds are retention for compliance with law under s.8(7); information given to agencies falls within s.7(d) or s.17(1)(c); removals on court orders within s.7(e).

Two seams need watching. Rule 3(1)(i) points to security rules made under s.43A of the IT Act, which the DPDP Act omits from 13 May 2027; in our view, DPDP Rule 6 then becomes the working standard. And Third Schedule dormancy erasure runs alongside the 180-day hold for cancelled accounts.

Section 16(2) preserves stricter sector rules on transfers abroad, but none covers social media data, and no country is notified under s.16(1). The real transfer risk is Rule 13: an SDF must keep in India any data a government committee specifies.

The dates

• 13 November 2026: consent manager provisions commence.
• 13 May 2027: the main duties, rights and penalties commence, with Rules 3 and 5 to 16.

No compression has been notified as of October 2026; no Board members are appointed.

Analysis

The Trayambic DPDP Impact Scorecard

Overall impact: High

Teenage users and the feed

A platform admitting users from age 13 has many users the DPDP Act treats as children (s.2(f)), and all of s.9 applies to them.

What s.9(3) reaches. A feed ranked by predicting what will keep a 15-year-old scrolling depends on monitoring her behaviour. In our view that is behavioural monitoring, as is building her interest profile for advertising, and targeted advertising directed at children is barred whatever the parent says. Workable options for under-18 accounts are feeds ordered by time or accounts followed, safety-screened popular content, and contextual-only advertising.

Parental consent. Rule 10 requires checking that the consenting parent is an identifiable adult, using reliable details already held or a virtual token from an authorised entity such as DigiLocker: a linked parent account, not a checkbox.

Age assurance. Part B of the Fourth Schedule permits processing to verify that a user is not a child, only to that extent. It covers the check, not keeping the selfie or document for other uses. Tokens confirming "over 18" without revealing identity carry the least risk.

Moderation. Rule 3(1)(b) already requires reasonable efforts against content "harmful to child". Classifiers that screen content fall within Part B; classifiers that profile a child's behaviour do not.

Trayambic's ed-tech impact study and its children's data article cover parental consent in more detail.

Public posts, private messages and people who never signed up

Public posts. Section 3(c)(ii) takes data a person has herself made public outside the Act. In our view the exclusion is narrower than it looks:

• It covers what the data principal published, not posts about her by others, such as a tagged photo.
• It does not cover private messages, closed groups, private accounts, metadata or inferences.
• Once a user restricts or deletes a post, it is arguably no longer data she has made public.

Ranking and advertising systems mix public posts with private signals, so in practice the Act applies to them. Trayambic's article on training AI on personal data covers model training on public posts.

Contact syncing. A user's own use of her address book is personal and outside the Act; the platform's use is not. Storing non-users' numbers, matching them to suggest connections or sending invitations processes data of people who neither consented nor "voluntarily provided" it, so s.7(a) does not fit. In our view the defensible design is to match on hashed numbers, discard unmatched numbers and build no profiles of non-users. Non-users cannot use access or correction rights, which run only for consent and s.7(a) processing, so minimisation is their real safeguard; the s.13 grievance route stays open.

Retention: five clocks on one account

The Third Schedule clock runs from the later of the user's last approach and "the commencement of" the Rules. In our view, counting from 13 November 2025, when the Rules were first brought into force, no account reaches three years before November 2028. Rule 8 applies from 13 May 2027, so the engine can be built and tested well before the first erasures. It should treat a log-in or exercise of rights as an approach, not passive receipt of notifications.

Platforms between fifty lakh and two crore users are SSMIs but outside the Third Schedule; s.8(7) still governs them.

Safety, verification and government requests

With no "legitimate interests" ground, trust and safety work needs careful mapping. In our view:

• Spam, fraud and abuse detection that prevents or detects offences can rely on s.17(1)(c), which still demands processor accountability and security.
• Ordinary moderation against the terms a user accepted fits s.7(a) best.
• Agency requests answered within 72 hours under rule 3(1)(j) fall within s.7(d); removals on court orders within s.7(e). A register of each request, its basis and the data disclosed serves both regimes.
• Verification and SIM-binding data serve one purpose; reusing them for advertising needs consent.

Traceability under rule 4(2) sits uneasily with s.8(5): any design that can identify a first originator creates metadata that must be secured, kept briefly and disclosed only on the orders the rule allows. Provenance metadata for synthetic content can likewise identify the uploader and should carry only what provenance requires.

Worked example: a regional-language short-video and chat app

Consider an illustrative app with 60 lakh registered users in India, open from age 13, offering short videos, direct messages, a creator fund, contact syncing and AI filters.

Status. As an SSMI it has India-resident officers, monthly reports and voluntary verification. It is outside the Third Schedule, but its growth plan crosses two crore users within two years, so the dormancy engine is on the roadmap.

Teen mode. Users who declare an age under 18, or whom age checks flag, get a following-only feed, no targeted ads and messages only from accounts they follow. A token-verified parent account gives parental consent.

Contacts. Uploaded numbers are hashed, matched once and discarded if unmatched; invitations go only from the user's own phone.

Synthetic content. Filter outputs carry a visible label and provenance metadata with a content identifier, not account details.

A breach. A misconfigured storage bucket exposes creators' bank and tax details. The app reports to CERT-In within six hours, notifies the Board and each affected creator without delay, and files the Board report within 72 hours; its payout vendor's contract required notice within hours.

SDF risk. Moderate, rising with scale and political content; a DPIA and audit plan are kept ready.

Compliance framework

Roadmap to 13 May 2027

• Now to December 2026: data map; SIM binding for messaging products by DoT's deadline; teen-mode design.
• January to March 2027: ship teen mode, parental consent and notices; launch the request register; sign vendor terms.
• April to May 2027: test rights responses and deletion jobs; rehearse the breach runbook; brief the board on SDF readiness.
• Ongoing: track the fact check unit appeal, any Karnataka law, MeitY amendments and Board guidance.

Recommendations

1. 1.Treat every user under 18 as a child, with a feed and ads that do not depend on monitoring them.
2. 2.Discard non-users' contact data after matching; never profile people who have not joined.
3. 3.Map each purpose to a specific ground, and keep s.17(1)(c) for genuine offence-related work.
4. 4.Build one retention matrix covering s.8(7), the Third Schedule and the IT Rules' 180-day holds.
5. 5.Run one register for takedowns, agency requests and disclosures, so the same facts answer MeitY, courts and the Board.
6. 6.Never reuse verification, SIM-binding or provenance data for advertising.
7. 7.Large platforms should prepare for SDF designation now: an India-based DPO, an independent data auditor and an annual DPIA.

Key takeaways

• Every user aged 13 to 17 is a child under the DPDP Act; in our view engagement-ranked feeds and ad targeting for them are barred by s.9(3).
• Social media intermediaries with two crore or more registered users must erase dormant accounts after three years, on 48 hours' notice; in our view no account reaches that mark before November 2028.
• The s.3(c)(ii) exclusion covers what a user herself made public, not private messages, inferences or posts about her by others.
• Contact syncing processes non-users' data with no obvious ground; hash, match and discard.
• IT Rules retention (180 days) and agency disclosures (72 hours) fit within s.8(7), s.7(d) and s.17(1)(c), but need a single register.