The Game-Changer: What draft DPDP rules mean for advertisers

The Draft Digital Personal Data Protection (DPDP) Rules, released late on Friday evening, represent a pivotal moment for India's advertising industry. With stringent provisions aimed at safeguarding personal data, these rules will compel advertisers to recalibrate their strategies, focusing on transparency, user consent, and data minimization.

Transforming Data Collection and Consent

One of the most significant changes the advertising industry will face under the DPDP Rules is the mandate for specific and informed consent, as highlighted in Rule 3. Rishabh Gandhi, Founder of Rishabh Gandhi and Advocates, emphasizes, “Advertisers will need to redesign their data collection and user engagement strategies, shifting towards greater transparency and user control.” This shift will likely demand a more nuanced approach to obtaining consent, ensuring users are fully aware of how their data is being used.

The Indian advertising market was valued at approximately INR 916.32 billion in 2024. This market is expected to grow at a compound annual growth rate (CAGR) of 11.0% during the forecast period of 2025-2034, potentially reaching around INR 2,344.01 billion by 2034.

The data minimization principle under Rule 24, restricting excessive data collection, will compel advertisers to streamline their data practices, focusing only on essential information for targeted campaigns. This could potentially impact the personalization aspect, which has been a key driver of digital advertising success.

Challenges in Cross-Border Data Transfers and Retention

The rules on cross-border data transfers (Rule 14) and data retention policies (Rule 8) are poised to create significant operational challenges. Gandhi notes that cross-border restrictions could disrupt global data-sharing ecosystems critical to digital advertising. The prescribed retention timelines might conflict with existing operational and regulatory requirements, necessitating a delicate balance between privacy safeguards and business practicality.

Arya Tripathy, Partner at Cyril Amarchand Mangaldas, underscores the stringent requirements around consent, especially for children's data. “The proposals around notice seeking consent and limited exceptions to prohibition on profiling and targeted advertising for children are likely to have a momentous impact on the advertising industry,” she explains. The demanding consent regime will necessitate greater transparency and stricter contractual obligations around data security measures.

Impact on Targeted Advertising and Revenue Models

The advertising industry, heavily reliant on personalized ads, may see a decline in effectiveness due to these new consent requirements. Ankit Sahni, Partner at Ajay Sahni & Associates, warns that the limitations on processing personal data without explicit consent could diminish the personalization of advertisements. Social media platforms, which depend on behavioral data, might need to shift to less invasive models, potentially impacting their revenue streams.

The digital advertising sector has shown impressive growth, and is naturally the focus of the DPDP Rules. In 2023, it was valued at INR 40,685 crore (approximately INR 406.85 billion) and is estimated to reach INR 62,045 crore (approximately INR 620.45 billion) by 2025, growing at a CAGR of 23.49%. Digital media is expected to comprise 55% of the overall ad spending by 2025. Targeted advertising, a cornerstone of digital marketing strategies, may see reduced effectiveness, leading to potential revenue declines for platforms and advertisers alike.

Goldie Dhama, Partner at Deloitte, points out that data fiduciaries like e-commerce entities and social media intermediaries will have to delete data within three years of the DPDP Act's commencement or the last exercise of data principal rights. This compliance requirement, given the significant revenue these entities generate from advertising, will undoubtedly affect the industry.

Ashok Hariharan, CEO and Co-founder of IDfy, considers the DPDP rules a ‘game-changer’ for making processes more transparent and responsible. However, he acknowledges the challenges, especially in lead generation and social media marketing. “Businesses now need to clearly disclose how they will use personal data, ensuring users understand its use and sharing with advertisers,” he says. This increased transparency could create friction but is necessary for building trust.

Balancing Privacy and Operational Feasibility

While the DPDP rules aim to strengthen user privacy, their implementation will require careful balancing to ensure they do not stifle the advertising industry's growth. Hariharan highlights potential areas for further clarification, such as parental consent and the role of Consent Managers. “Identifying if the user is a minor and verifying parental consent is no easy task,” he notes. Moreover, the complexity of managing consent across various fiduciaries could necessitate additional guidance.

Despite these challenges, the long-term benefits of fostering a trustworthy ecosystem could outweigh the initial hurdles. As Hariharan succinctly puts it, “Consent lost is business lost,” highlighting the critical nature of user consent in the evolving digital landscape.

The Road Ahead

The DPDP Draft Rules herald a new era for the advertising industry in India. By prioritizing user privacy and data protection, these rules are set to transform how advertisers engage with consumers. While the industry may face significant adjustments, the potential for building a more transparent and responsible ecosystem offers a promising future.

As the draft rules continue to be refined, industry stakeholders must remain agile, adapting to the new regulatory landscape while advocating for practical solutions that balance privacy with operational feasibility. The path forward may be challenging, but with a concerted effort, the advertising industry can navigate these changes and emerge stronger, more transparent, and more user-focused than ever before.