DPDP for media, ad tech and marketing

Marketing and media businesses trade in attention, and attention is measured with personal data: cookies, advertising IDs, hashed emails, phone numbers, viewing histories, lead forms and audience segments. Much of it moves between companies in milliseconds, in bid requests, audience syncs and lead-delivery APIs, and most of the people involved have never heard of the companies that hold their data.

That is exactly what DPDP is built to change. The Act has no general “legitimate interests” ground, so most advertising, profiling and list-sharing needs consent that is specific to the purpose (and, in practice, names the recipients), and the business relying on it must be able to prove it (section 6(10)). The risk sits in third-party data you did not collect yourself, resale of leads and lists, tracking without a real choice, and children reached by targeted ads. This guide applies the Data Fiduciary playbook to media, ad tech and marketing.

Are you a Data Fiduciary, a processor, or both?

The same company is often both. The question is always who decides why and how the data is used.

• Publisher or OTT service: you are the Data Fiduciary for readers, viewers and subscribers: accounts, payments, viewing or reading history, comments and newsletters. Ad tech partners that receive data from your pages or apps and use it for their own profiling are separate fiduciaries, and sending it to them is a disclosure that needs consent. Your CMS, video platform, CDN, payment gateway and email service are your processors.
• Ad network, SSP, DSP or exchange: when you use data only to deliver one client’s campaign under its instructions, you act as a processor. When you build profiles across sites and apps, enrich bid requests with your own data, or use data to improve your own models, you are a fiduciary for that use and need your own basis.
• Data management platform or data broker: you decide which segments to build and whom to sell them to, so you are a fiduciary. Selling or licensing segments is disclosure to other fiduciaries. Each person needs to have consented to that, with the recipients named or described in the notice.
• Marketing or media agency: when you run campaigns with a client’s customer data, you are the client’s processor and must act only on its instructions under a valid contract (section 8(2)). If you pool data across clients, build your own audiences from client data, or keep it after the engagement, you become a fiduciary and are likely in breach of your contract. For your own prospect lists and newsletters, you are a fiduciary.
• Lead-generation and affiliate business: you collect leads through forms, calls and comparison pages, so you are a fiduciary for them. Selling or passing a lead to a lender, insurer, builder or school is a disclosure, and each buyer becomes a fiduciary in its own right that must be able to prove consent.
• Bulk SMS, WhatsApp or email provider: when you send for a brand using the brand’s list, you are the brand’s processor. Under TRAI’s rules, the brand is the principal entity and you are a registered telemarketer. If you also sell “databases” or let one client’s list be used for another, you are a fiduciary, and that use is very hard to justify.
• Brand advertiser: you are a fiduciary for your customer data. Uploading it to a platform for custom or lookalike audiences is a disclosure that needs consent for that purpose.

The data you hold

Data category	Where it usually lives	Typical purpose	Sensitivity	Typical retention
Subscriber accounts: name, email, mobile, payment	Publisher or OTT identity and billing systems	Subscriptions, access	Medium	While active, plus tax and accounting minimums
Viewing, reading and listening history	OTT and publisher analytics, recommendation systems	Recommendations, analytics	Medium to high (can reveal politics, religion, sexuality, health)	Aggregate quickly; set short raw-data limits
Kids’ profiles on OTT and content apps	Profile service	Age-appropriate content	High	As long as the profile; no behavioural data
Cookies, advertising IDs, IP, user-agent	Ad servers, SSPs, DSPs, analytics	Ad delivery, frequency capping, measurement	Medium to high in aggregate	Short limits; logs for at least one year
Hashed emails and phone numbers	CDPs, clean rooms, ad platforms	Audience matching	Medium to high (re-identifiable)	Until the campaign ends or withdrawal
Audience segments and inferred interests	DMPs, DSPs, CDPs	Targeting, lookalikes	High where sensitive	Recompute often; expire unused segments
Bid-request and impression logs	Ad tech platforms	Delivery, billing, fraud detection	Medium	Short; aggregate for billing
Lead forms: name, mobile, email, city, income, loan or course interest	Lead-gen platform, CRM, buyer systems	Passing leads to buyers	Medium to high (financial and health interest)	Short; erase unsold and stale leads
Purchased or rented contact lists	Spreadsheets, campaign tools	Prospecting	High risk (no basis)	Do not hold without proof of consent
SMS, WhatsApp and email send logs and opt-ins	Messaging platform, DLT records	Delivery, consent proof, complaints	Medium	As TRAI rules and rule 8(3) require
Call recordings and telemarketing notes	Dialler, call-centre vendor	Sales, quality	Medium to high	6–12 months unless a dispute is open
Comments, letters, contest entries, UGC	CMS, contest tools	Publishing, prizes	Medium	As long as published; erase contest data after results
Research panels and audience-measurement data	Panel systems, meters	Audience research	Medium to high	As the panel agreement states
Influencer and creator contracts and payouts	Agency CRM, finance	Campaigns, payments	Medium	Contract and tax minimums

Risk hotspots

1. Purchased and rented lists. Lists bought from “data vendors”, scraped directories and old event registrations have no consent that covers you. Section 7(a) does not help, because the person never gave their data to you. Failure: every message to the list is processing without a ground, and every complaint lands on you. Control: stop using lists you cannot trace to consent naming you or your category for this purpose. Ask any list seller for its consent records, and assume you will not get them.
2. Lead resale. A single lead is often sold to five lenders or ten colleges. Failure: the consent named one buyer, or none; buyers cannot prove consent (section 6(10)); people are flooded with calls. Control: a consent screen that names each buyer or a narrow category, a record of exactly which buyer received each lead, a cap on how many buyers get it, and a contract requiring buyers to stop when the person withdraws.
3. Cookies, pixels and device IDs. Advertising IDs, cookies and IP addresses are personal data when they can be linked to a person, which is their purpose. Failure: trackers firing before any choice, and data leaking to partners nobody listed. Control: a tracker register, consent before non-essential trackers, server-side tagging with field allow-lists, and contracts with every recipient.
4. Custom and lookalike audiences. Uploading hashed customer lists to ad platforms is disclosure. A hash can be matched back to a person, which is the point. Control: upload only people who consented to that purpose, refresh audiences at least weekly so withdrawals take effect, and remove the lists when the campaign ends.
5. The agency that keeps the data. Agencies collect client data in their own tools, keep it after the contract ends and sometimes reuse it for the next client. Failure: the client remains responsible (section 8(1)), and the agency becomes an unauthorised fiduciary. Control: data processing terms in every agency contract, separate workspaces per client, and certified deletion at the end of each engagement.
6. Targeted ads that reach children. Section 9(3) bars targeted advertising directed at children, meaning anyone under 18. Failure: behavioural campaigns for snacks, games, courses or fashion reaching teens; kids’ profiles on OTT running personalised ads. Penalties for section 9 breaches can reach ₹200 crore. Control: contextual ads only on kids’ content and profiles, age signals passed to every ad partner, exclusion of under-18 segments, and no lookalikes seeded with children.
7. Sensitive segments. Segments such as “diabetic”, “pregnant”, “debt-stressed” or by religion are profiling of the most sensitive kind. Control: ban sensitive segments unless the person explicitly consented to that use, and review every segment before it goes live.
8. Bulk SMS and WhatsApp without layered consent. TRAI rules require consent and registration for promotional messages; DPDP requires consent for the processing. Failure: a person withdraws with the brand but keeps receiving messages through the vendor, or the reverse. Control: one consent record that drives both DLT preferences and your send lists, a one-tap stop in every promotional message, and processors that confirm withdrawals.
9. Viewing and reading histories. What someone watches or reads can reveal politics, religion, sexuality or health. Control: short retention of raw history, no sharing with ad partners without consent, and a way for users to clear history.
10. Contest and campaign micro-sites. One-off sites built by agencies collect data on forms that nobody maintains. Control: every campaign site goes through privacy review, uses the brand’s consent system, and has a shutdown and deletion date.

Legal basis, purpose by purpose

Purpose	Basis	Notes
Subscriptions, access and billing for a publisher or OTT service	7(a): the subscriber voluntarily provided data for the service	Keep the data set minimal.
Recommendations within the service	7(a) where the notice describes it as part of the service, otherwise consent	Offer a way to clear history; not for kids’ profiles.
Invoices, GST and accounting records	Retention required by law	Keep the minimum; restrict access.
Essential cookies (login, security, load balancing)	7(a) where strictly necessary for the service the user asked for	Keep them few and documented.
Analytics cookies and audience measurement	Consent, unless strictly necessary and aggregated	Prefer aggregated, pseudonymous measurement.
Behavioural advertising, retargeting, cross-site profiles	Consent	Never for children (section 9(3)).
Sharing data with ad partners, DMPs and exchanges	Consent, naming the recipients or categories	Access requests include who received the data (section 11(1)(b)).
Custom and lookalike audience uploads	Consent for that purpose	Refresh audiences so withdrawals take effect.
Running a client’s campaign on the client’s data	The client’s basis; you act as processor under a valid contract (section 8(2))	Use the data only for that client.
Collecting leads for a specific enquiry	7(a) for answering that enquiry yourself; consent to pass it to named buyers	Each buyer must be able to prove consent.
Promotional SMS, calls, WhatsApp and email	Consent, per channel	Also follow TRAI TCCCPR for SMS and calls.
Contextual ads that use no personal data	Outside DPDP if no personal data is processed	Check that ad partners are not collecting identifiers anyway.
Ad fraud and invalid-traffic detection	Section 17(1)(c) where it prevents offences, otherwise consent	Do not reuse fraud signals for targeting. Relying on 17(1)(c) for private fraud checks is a common reading, not settled; confirm with counsel.
Research panels and audience meters	Consent in the panel agreement	Panel members include whole households, including children.

Notices and consent: getting the screens right

Channel	Do	Don’t
Publisher website	Show a consent screen before non-essential trackers, with separate choices for analytics, personalised ads and partner sharing, and a “reject all” as easy as “accept all”.	Fire pixels before the choice, or hide “reject” behind settings.
OTT and content apps	Ask for ad personalisation and partner sharing as separate unticked toggles. Make kids’ profiles ad-personalisation-free by design.	Run the same ad stack on kids’ profiles.
Lead forms and comparison pages	Name the buyers or a narrow category on the form, next to the submit button, with a separate unticked box for each kind of sharing.	Use “our partners” with a link to a list of 300 companies.
Call centre and telemarketing	Read a short notice at the start of the call; record the opt-in or refusal; respect withdrawal on the call.	Call people from purchased lists or ignore a “do not call” request.
SMS and WhatsApp	Record the opt-in source, time and notice version. Put a one-tap stop in every promotional message.	Message people whose only “consent” is that a vendor sold you their number.
Email newsletters	Use confirmed sign-up and an unsubscribe link in every email.	Add event or contest entrants to the newsletter without asking.
Campaign micro-sites and contests	Use the brand’s notice and consent system, and set a deletion date.	Let the agency run its own forms and keep the data.
Field activations and events	Use QR codes to a consent page, or paper forms with a short notice, digitised only for the stated purpose.	Collect visiting cards in a bowl and add everyone to campaigns.
Existing subscribers and contacts	Send a section 5(2) notice with links to manage choices; drop contacts you cannot trace to consent.	Assume old blanket consent covers new purposes or new recipients.

Each notice must stand on its own, itemise the data and the purposes, describe the service, and link to withdrawal, rights and complaints to the Board (rule 3). Withdrawal must be as easy as giving consent, which rules out a one-click opt-in paired with a five-step opt-out. Offer the notice in English and the Eighth Schedule languages (section 5(3)); a regional publisher should start with its own languages.

Other laws you must line up with

• TRAI Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR), as amended: registration of principal entities, headers and templates on the DLT platform, digital consent acquisition, customer preferences and complaint handling for commercial SMS and calls. The regulations have been tightened since they were first issued. Confirm the current requirement with counsel.
• Telecommunications Act, 2023: includes powers to protect users from unsolicited commercial communications and rules made under it may add duties. Confirm the current requirement with counsel.
• IT Act, 2000 and IT Rules, 2021, Part III (digital media ethics code): publishers of news and of online curated content (OTT) must follow the code, including age classification and parental controls for OTT content.
• Cable Television Networks (Regulation) Act, 1995 and TRAI broadcasting regulations: subscriber management and ad codes for broadcasters and distributors.
• Consumer Protection Act, 2019, the guidelines on misleading advertisements and the dark-patterns guidelines: disguised ads, false urgency, nagging and forced consent can breach consumer law and section 6.
• ASCI code and influencer guidelines: self-regulatory, but widely followed, including disclosure of paid content and rules on ads aimed at children.
• CERT-In Directions (2022): reporting cyber incidents on a much shorter clock than the DPDP 72 hours. Confirm the current requirement with counsel.
• RBI, IRDAI and SEBI rules on outsourcing and lead sourcing: lenders, insurers and brokers that buy leads have their own rules on direct selling agents, telemarketing and data shared with them. Expect buyers to push these into your contract.
• Income-tax and GST law: subscription invoices, influencer payments and agency billing records.
• Foreign laws, including the GDPR: global ad tech platforms and publishers with readers in the EU or UK must follow those laws alongside DPDP.
• No journalism exemption in DPDP: the Act has no specific exemption for journalistic purposes. News organisations should get advice on reporting that involves personal data. Confirm the current requirement with counsel.

Retention and erasure

1. When the purpose ends (section 8(7)): a campaign ends, a lead is sold or goes stale, a contest closes, a subscription lapses or consent is withdrawn. Stop using the data and erase it, unless a law requires you to keep it. Unsold and stale leads should go within weeks, not years.
2. The one-year minimum (rule 8(3)): keep the personal data, traffic data and logs of each processing activity for at least one year from the date of processing, for the purposes in the Seventh Schedule. For ad tech, that includes delivery and bid logs; keep them secured and separate from targeting systems. After that, erase unless another law requires longer.
3. Legal holds and consent records: keep proof of consent for as long as you rely on it and for any period TRAI rules or a dispute requires. Keep invoices and payment records as tax law requires. Record each hold with the law behind it, the data it covers and the end date.
4. The Third Schedule: the three-year inactivity rule applies to large e-commerce entities, online gaming intermediaries and social media intermediaries. Most publishers, agencies and ad tech companies are none of these, but a content platform that hosts user posts may be a social media intermediary. Check where you stand, and see the guides for social media and e-commerce.
5. Audiences and segments: expire segments that are not used, delete uploaded audiences when the campaign ends, and remove withdrawn people from every platform audience.
6. Processors and partners: make agencies, messaging vendors, CDPs and clean rooms erase too, and get confirmation. Send withdrawals and erasure requests to lead buyers and ad partners that received data.
7. Backups: document how long backups keep data and make sure a restore replays erasures.

Rights requests and grievances

• Channels: a privacy page, a form, an email address, and the stop or unsubscribe route in every message. Publish them with the identifier you need: the email or mobile you hold, or for cookie-based data, a way to identify the browser or device (rule 14(1)).
• Identity: use an OTP to the email or mobile you already hold. For cookie or device-ID data, let people make requests from that browser or device. Do not ask for ID documents you do not already hold.
• Access (section 11): give a summary of the data you hold, the segments the person is in and the campaigns they were part of. List the other fiduciaries and processors you shared data with: lead buyers, ad partners, DMPs, agencies and messaging vendors. For lead-gen firms, “which companies got my number” is the question most people ask, so keep a per-lead record of buyers.
• Correction (section 12(2)): correct records and pass the corrections to buyers and partners that received the data (section 8(3)).
• Erasure (section 12(3)): erase the person from lists, segments, audiences and lead records, and tell buyers and partners. Keep only what a law requires, such as tax records or consent proof under legal hold, and tell the person what you kept and why.
• Grievances: acknowledge quickly. Publish a response period well inside the 90-day ceiling in rule 14(3); 15–30 days is good practice. Name the DPO or contact person in every reply (rule 9).
• Nomination (section 14): let subscribers nominate someone, which matters for paid subscriptions and accounts with stored credits.

Breach readiness

Likely scenarios:

• a lead database or campaign spreadsheet shared by link or leaked by a vendor
• a campaign micro-site with an open database of entrants
• a messaging platform compromised and used to send scam messages to your list
• an ad tech partner collecting more than you configured, or a tag hijacked to skim form data
• an OTT subscriber database exposed, with viewing histories
• an agency employee taking client data to a new employer

Run-book:

1. Contain within hours: revoke links and keys, take the micro-site or bucket offline, disable the tag or partner, and suspend the vendor’s access.
2. Assess: which data, how many people, whose clients, and the consequences (scam calls and messages, embarrassment from viewing histories, fraud from payment data).
3. Notify affected people without delay through their registered contact, covering every point in rule 7(1): what happened and when, the likely consequences for them, what you are doing, what they can do (for example, ignore messages claiming to be from you and report spam), and a contact. Where you are a processor, tell the client at once so that it can notify.
4. Notify the Board without delay, then send the detailed report within 72 hours (rule 7(2)): updated facts, the circumstances and reasons, mitigation, findings about who caused it, steps to prevent a repeat, and a report on the notices sent to people. A processor supports its client’s report.
5. Report to CERT-In where its directions apply, and tell telecom operators or messaging platforms if your sender IDs or templates were abused.
6. Learn: fix the root cause, remove the partner or tool, and update contracts.

The checklist

Phase 1: discover (days 0–30)

• [Leadership] Appoint a DPDP owner and a working group (product, ad operations, data, client services, marketing, legal, security).
• [Legal] For each product and each client, record whether you act as fiduciary or processor.
• [Marketing] List every contact list you use and its source; flag purchased, rented, scraped and inherited lists.
• [Eng] Inventory every cookie, pixel, SDK and device ID you set or receive, and what each sends to whom.
• [Ad ops] List every ad partner, exchange, DMP and clean room that receives data from you, and what they receive.
• [Ad ops] List every audience uploaded to ad platforms and every segment you build, flagging sensitive ones.
• [Ops] For lead-gen, map each form to the buyers who receive its leads and how many buyers each lead goes to.
• [Marketing] Map your DLT registrations, headers, templates and consent records under TRAI rules.
• [Product] Find where children may be present: kids’ profiles, youth content, school campaigns, contests.
• [Client services] List all live and past client engagements where you still hold client data.
• [Legal] Collect contracts with clients, agencies, vendors, lead buyers and ad partners.

Phase 2: design and build (days 31–90)

• [Legal] Assign a legal basis to each purpose (use the table above) and stop purposes without one.
• [Marketing] Stop using lists you cannot trace to consent that covers you and this purpose; delete them.
• [Legal] Write itemised notices for websites, apps, lead forms, telemarketing, newsletters and contests.
• [Product] Translate the notices into Hindi and your audience’s languages; make all 22 available on request.
• [Product] Rebuild website and app consent screens: separate choices, nothing pre-ticked, reject as easy as accept.
• [Eng] Load non-essential trackers only after consent; move to server-side tagging with field allow-lists.
• [Eng] Check consent before every send, audience upload, segment sale and partner share.
• [Eng] Feed withdrawals in real time to CRM, messaging tools, DLT preferences, ad audiences and lead buyers.
• [Product] Rebuild lead forms to name buyers or narrow categories, with a separate unticked box per kind of sharing.
• [Ops] Cap the number of buyers per lead and keep a per-lead record of who received it.
• [Legal] Require lead buyers to stop on withdrawal, erase on request, and not resell.
• [Ad ops] Switch kids’ content and profiles to contextual ads only; pass age signals to every ad partner.
• [Ad ops] Exclude under-18 segments from targeting, and never seed lookalikes with children’s data.
• [Ad ops] Remove sensitive segments unless the person explicitly consented to that use.
• [Marketing] Set audience refresh to at least weekly and delete audiences when campaigns end.
• [Legal] Put data processing terms in every client contract where you are a processor: instructions only, no pooling, breach notice, erasure at the end, sub-processors, audit.
• [Eng] Give each client a separate workspace and certify deletion at the end of each engagement.
• [Legal] Add DPDP clauses to your own processor contracts: security, breach notice, erasure on instruction, one-year logs, sub-processors.
• [Marketing] Put a one-tap stop in every promotional SMS and WhatsApp message, and an unsubscribe link in every email.
• [Product] Route every campaign micro-site and contest through privacy review, with a shutdown and deletion date.
• [Eng] Encrypt lead and subscriber data at rest; tokenise payments through the gateway.
• [Security] Add MFA to ad accounts, CDPs, messaging platforms and lead portals.
• [Eng] Keep access and processing logs for at least one year.
• [Eng] Build retention jobs: erase stale and unsold leads, expire unused segments, delete contest data after results.
• [Product] Publish the privacy page: contact person, request channels, identifier needed and grievance timeline.
• [CX] Set up the rights and grievance workflow with OTP verification, owners and deadlines.
• [Marketing] Send the section 5(2) notice to existing subscribers and contacts with a link to manage choices.

Phase 3: operate (ongoing)

• [DPO] Review new campaigns, partners, segments, tags and lead buyers before launch.
• [Eng] Re-scan sites and apps for tags every month; remove any nobody owns.
• [Ad ops] Review segments every quarter for sensitive or child-related targeting.
• [Ops] Audit a sample of leads every month: consent screen, buyers, delivery and withdrawals.
• [Marketing] Reconcile DLT preferences and your consent records every month.
• [Security] Run a penetration test every year on sites, apps, lead portals and APIs.
• [Security] Run a breach tabletop drill every year (for example, a leaked lead file) against the 72-hour clock.
• [CX] Review rights and grievance timelines every month; investigate overdue cases.
• [Legal] Review client, vendor and buyer contracts and renewal dates every quarter.
• [DPO] Keep evidence: consent records, withdrawal handling, erasure confirmations, training records.
• [Leadership] Re-assess the likelihood of SDF status as your data volumes grow.

Where myconsentapp comes in

You need to	With myconsentapp	You still own
Ask consent per purpose and per recipient	Define purposes (newsletter, personalised ads, partner sharing, sharing a lead with each buyer category) once. The hosted consent page, widget or SDKs show each as a separate toggle, off by default.	Choosing purposes that are specific enough.
Prove consent for every lead and contact	Every choice is signed and hash-chained against the exact notice version. The person gets a receipt, anyone can check it with the public verifier, and you can download an evidence pack to give a lead buyer.	Sharing evidence with buyers under your contract.
Check consent before sending or uploading	Call the verify API before each send, audience upload or lead delivery; it returns not permitted immediately after a withdrawal.	Wiring it into your campaign and lead-delivery tools.
Spread withdrawals	Signed webhooks with retries tell your systems the moment someone withdraws; acknowledgement deadlines flag anything not handled.	Updating DLT preferences and ad audiences, and passing withdrawals to lead buyers.
Capture consent at events and on calls	QR codes to the hosted page at events, and recording consent captured elsewhere (paper, phone), marked as not verified by the person.	Training field and call-centre staff.
Make processors stop too	A processor registry links each vendor to purposes and data items; vendors confirm withdrawals and erasures, and contract expiry dates are flagged.	Signing contracts and choosing which buyers to work with.
Keep ads away from children	An age gate and guardian verification through DigiLocker; tracking and ad purposes can never be marked child-safe.	Passing age signals to your ad partners.
Offer notices in Indian languages	Notices in English and the 22 Eighth Schedule languages, with machine-translation drafts marked for review.	Reviewing the translations.
Handle access and erasure requests	A rights inbox with SLA timers; erasure closes with a structured proof once processors confirm.	Answering “who got my number” from your lead records.
Show clients what you did	Analytics and MIS reports, an exportable record of processing, and a hash-chained audit log.	Client reporting.
Manage a breach	A breach register with the 72-hour clock, Rule 7 notices to affected people, and Board intimation and report documents.	Detecting and investigating.

Not included: myconsentapp is a proposed Consent Manager, not a cookie-banner or tag scanner, a tag manager, a DLT platform or SMS sender, or a data-discovery tool, and it is not legal advice. Use your tag manager to gate tags, and use myconsentapp’s consent status as the source of truth.

Common mistakes

• Believing a list is “opted in” because the seller said so.
• Selling one lead to many buyers on the strength of “you agree to be contacted by our partners”.
• Treating hashed emails and device IDs as anonymous.
• Firing ad pixels before the user has made a choice.
• Running behavioural campaigns that reach teenagers because no one excluded under-18s.
• Agencies keeping client data after the engagement or reusing it across clients.
• Handling DLT consent and DPDP consent in separate systems that never talk to each other.
• Leaving old campaign micro-sites live with their databases.

Frequently asked questions

Can we keep using a list we bought before DPDP? Only if you can show that each person consented to you, or a category that clearly includes you, processing their data for this purpose. Section 5(2) lets you keep processing data collected with consent before the Act until the person withdraws, and requires you to send them a notice, but it does not cure data that was never consented. In practice, most bought lists should be deleted.

Is a cookie personal data? When it can be linked to an individual, yes. Advertising cookies and device IDs exist to recognise a person across sessions and sites, so treat them as personal data. DPDP has no separate cookie rules; the ordinary rules on notice and consent apply.

We are an agency. Are we a fiduciary or a processor? For a client’s campaign run on the client’s data under its instructions, you are a processor, and the client remains responsible (section 8(1)). For your own prospects and newsletters, or if you reuse client data for your own purposes, you are a fiduciary. Write the role into each contract.

Can we show ads on content watched by children? Contextual ads that use no personal data about the child carry far less risk. Targeted advertising directed at children is prohibited (section 9(3)), so personalised, behavioural or retargeted ads must be switched off for kids’ profiles, kids’ content and anyone known or likely to be under 18.

Does TRAI consent replace DPDP consent? No. TCCCPR consent covers whether you may send commercial communications over telecom networks. DPDP consent covers whether you may process the person’s data for that purpose at all. You need both, and a withdrawal under either should stop the messages.

A lead buyer asks us to prove consent. What should we give them? For each lead: the notice version shown, the exact consent text, the time, the channel, and the buyers or categories named. The buyer needs this because, if challenged, it must prove consent itself (section 6(10)).

Are lookalike audiences allowed? Uploading your customers as a seed list is a disclosure of their data, so you need their consent for that purpose. Never seed lookalikes with children’s data or sensitive segments, and remove withdrawn customers from seed lists.