How India’s DPDP Act could change digital campaigns

The draft rules under India’s Digital Personal Data Protection (DPDP) Act have set the stage for an era in advertising and marketing that prioritizes privacy, especially for campaigns targeting children and minors. These proposed regulations, currently open for public consultation, highlight user rights, brand obligations, and frameworks for safeguarding personal information. 

The draft provisions state that organisations collecting data (Data Fiduciaries) must provide clear notices outlining the data collected, its purpose, and users’ rights. It also simplifies consent withdrawal and enables data deletion upon user request. Platforms need to notify users 48 hours before erasing data and allow them to retain it if required, keeping unwanted communications to a minimum. The Act mandates the creation of a Data Protection Board (DPB) to oversee compliance, investigate breaches, and impose fines. Additionally, explicit government permission is required for cross-border data transfers. 

Another guideline notes that minors under 18 years of age will require parental consent to access social media platforms. Additionally, data fiduciaries need to obtain verifiable consent from a parent or legal guardian before processing the personal data of children and persons with disabilities. This move aligns with India’s broader push toward data privacy and takes a measured approach compared to stricter international regulations, like Australia’s social media ban for minors.

Amongst India’s digital population of over an estimated 800 million users, approximately 134 million are estimated to be minors. According to a recent survey, parents of young children are concerned about inappropriate advertisements being shown during programs which are marked as age-appropriate for all. Amongst those surveyed, 88% of parents believe the government should impose heavy penalties on platforms that fail to regulate advertisements. This is a sentiment that the DPDP Act seeks to act upon. If Data Fiduciaries fail to follow the rules, it could lead to fines of up to Rs 250 crore.

Could this potentially change the way how digital advertising campaigns work? 

Brands need to build trust and transparency

By requiring verifiable consent from parents, the act could compel brands to rethink their strategies. Shrenik Gandhi, Co-founder and CEO of White Rivers Media, views this as an opportunity rather than a challenge.

“The DPDP Act unlocks pathways for innovation while prioritising transparency and trust. Enhanced consent mechanisms and stricter data retention policies aren’t challenges—they are opportunities to build deeper consumer connections through accountability.”

Gandhi notes that this shift is steering the industry towards contextual advertising and authentic storytelling that resonates with the audiences. 

Echoing this sentiment, Ayush Nambiar, Chief Strategist & Director at Flags Communications, adds that requiring verifiable parental or guardian consent for collecting and using data introduces an important layer of responsibility. 

“But it also means rethinking how we connect with younger audiences. Marketers will need to rely less on detailed data and more on creativity and messaging that resonates with both children and their parents.”

According to him, this regulation will push agencies to focus on trust-building and create campaigns that are transparent about their intentions and engage with the audience responsibly.

While the stricter consent rules may initially feel restrictive, Nambiar states that they also open doors for creating stronger, more meaningful connections with audiences.

Going back to the basics of advertising 

With traditional behavioural tracking off the table for minors, agencies will need to shift focus toward universal messaging and contextual advertising to build meaningful connections. 

Nazneen Joshi, Senior Vice President at RepIndia, emphasises that agencies need to craft campaigns that resonate universally rather than relying heavily on hyper-personalisation. 

“Strategies like gamification, story-driven narratives, and value-based messaging can engage young audiences without breaching privacy boundaries.” 

To help with this, Joshi believes that AI and privacy-first analytics will play a pivotal role, enabling data processing and campaign optimisation within the confines of compliance. 

“These technologies can help maintain campaign effectiveness while ensuring data privacy by identifying patterns without exposing individual identities.”

Such innovations will ensure that brands can still create impactful campaigns while respecting the boundaries set by the DPDP Act. 

Harshil Karia, MD & Founder of Schbang, agrees, and mentions, “We’ll need to focus more on first-party data collection strategies that prioritise transparency and parental consent. This will impact our creative processes by requiring more thoughtful targeting and personalised messaging that respects privacy.”

Currently, social media platforms and brands alike are observing our consumption behaviours based on our algorithms and usage. This might make young users feel a lack of control over their data. Reports suggest that many teenagers feel they have little control over the information social media companies collect about them. 60% of teens believe they lack control, with 40% saying they have very little control and 20% feeling they have no control at all.

The DPDP Act aims to make it easier for individuals to withdraw consent or request data deletion. One of the guidelines notes that if a data fiduciary doesn’t engage with an individual over a specified period, they are required to delete the user’s personal data unless needed for legal reasons. They need to delete the personal data after three years. 

Deepti Bhadauria, Chief Strategy Officer at HiveMinds, notes that in the current scenario, digital platforms actively focus on not targeting minors with advertisements. 

Campaigns for products or services designed for children are targeted at parents or via content interactions in specific platforms or shows tailored to minors, such as cartoon channels on TV or OTT platforms.

She notes that when it comes to first-party data collection for minors, the data being collected is that of their parents. As a result, there won’t be significant changes in this area.

“However, for brands (eg. schools, Stationery or FMCG or Sports brands running a contest in the School) that might collect sensitive user data—such as delivery addresses or school names—there will be a need to implement robust consent mechanisms. This may involve obtaining explicit parental consent during key touchpoints, such as when updating addresses or personal details.”

Prioritising data privacy and ethical marketing practices will mark a return to the core principles of storytelling. Neelesh Pednekar, Co-founder of Social Pill, sees this return to marketing fundamentals as refreshing. 

“With less personal data available, we’re focusing more on universal appeal and strong storytelling. It’s actually quite refreshing – we’re going back to the basics of what makes great marketing: compelling narratives that connect with people.”

However, he notes that advertisers need to make data practices crystal clear; not only because the law demands it, but because it’s the right thing to do. Pednekar notes, “Parents should know exactly what data we’re collecting and why.”

Bhadauria also shares that with stricter data privacy rules, content marketing and influencer collaborations will play a larger role in engaging audiences under 18. Moreover, family-viewing content involving the whole household will be utilised to create content integrations for Child-friendly products and brands. 

Embracing technology for ethical advertising

As brands navigate these changes, leaders highlight that technologies like AI and privacy-first analytics are going to prove indispensable. Shrenik Gandhi touches upon their dual role. AI and privacy-first analytics help uncover insights and trends while safeguarding individual privacy, creating a future where technology and ethics work hand in hand as per him.

Nazneen Joshi elaborates on AI-powered privacy tools’ potential. 

“These technologies can help maintain campaign effectiveness while ensuring data privacy by identifying patterns without exposing individual identities.”

Additionally, Deepti Bhadauria of HiveMinds mentions that AI could be utilised in storytelling at scale, bringing brand-safe and child-safe imagery into narratives and augmented reality applications. 

This can potentially enhance engagement while respecting privacy.

Shifting metrics from clicks to connections

With the DPDP Act’s terms on data collection and erasure, measuring the success of a campaign could also change. Neelesh Pednekar comments, “We’re moving away from pure numbers to more meaningful metrics – engagement quality, brand trust, and long-term relationship building.”

Ayush Nambiar also observes, “Measuring success will go beyond clicks and conversions. Metrics will evolve to focus on long-term brand loyalty and trust.”

Deepti Bhadauria sees this as an opportunity to optimise the consumer experience. She shares, “ROI will undoubtedly feel the impact of stricter data privacy tools and analytics, which are likely to increase CPMs across platforms for specific consumer cohorts. To counterbalance this inflation, we’ll need to focus on optimizing every aspect of the conversion funnel—from UI and UX to overall product appeal—to ensure a seamless and engaging customer experience.”

This will drive a stronger emphasis on personalisation and could reshape digital strategies, especially on offers and pricing strategies. 

The DPDP Act, while a step forward for India, pales in comparison to Australia’s social media ban for minors. However, it represents a privacy-focused digital system. By pushing brands to innovate responsibly and prioritize transparency, these regulations could reshape not just how minors are targeted, but how the advertising industry evolves in the future.

This provides an opportunity for India’s digital advertisers to be responsible, build trust, and explore more innovative solutions while ensuring compliance.