DPDP Act Marketing Content Compliance in India

India's Digital Personal Data Protection Act, 2023 (DPDP Act) represents a landmark shift in how businesses handle personal data in India. Enacted in August 2023 and with rules being finalised by the Ministry of Electronics and Information Technology (MeitY), the DPDP Act establishes comprehensive requirements for consent, data processing, and individual rights that directly impact marketing practices.

For marketing teams operating in India — the world's largest digital consumer market — the DPDP Act reshapes data collection on websites and apps, consent mechanisms for marketing communications, customer profiling and targeting practices, cross-border data transfers for global campaigns, and the handling of children's data in marketing. Penalties under the DPDP Act can reach up to INR 250 crore (approximately USD 30 million), making compliance a board-level priority.

The DPDP Act Framework for Marketing

Key Concepts

Consent Requirements

The DPDP Act establishes a consent-first framework for marketing:

• Free, specific, informed, unconditional, and unambiguous — consent must be clearly given for a specific purpose
• Clear and plain language — consent requests must be understandable in English or any of the 22 scheduled languages
• Itemised consent — each purpose of processing must have separate consent
• Withdrawable — individuals must be able to withdraw consent as easily as they gave it
• No bundling — marketing consent must not be bundled with service consent
• No dark patterns — consent mechanisms must not use deceptive design to obtain consent

Legitimate Uses (Without Consent)

The DPDP Act allows processing without consent in limited circumstances:

• Performance of a contract — processing necessary to fulfil a contractual obligation (e.g., order fulfilment)
• State functions — government services
• Medical emergencies — health data in emergencies
• Employment purposes — employer-employee data processing
• Publicly available data — data made publicly available by the individual

Marketing communications are not included in legitimate use exemptions — consent is required.

Impact on Marketing Content and Practices

Website and App Data Collection

Every data collection point must comply with DPDP Act requirements:

Consent notices must include:

• Identity and contact details of the Data Fiduciary
• Specific purpose for which data is being collected
• Itemised description of personal data being collected
• How to withdraw consent
• How to file a complaint with the Data Protection Board

Cookie consent:

• Tracking cookies for marketing purposes require explicit consent
• Consent must be granular — analytics, marketing, and functional cookies should have separate consent options
• Pre-selected or implied consent for marketing cookies is not compliant

Email and SMS Marketing

• Consent must be obtained before sending marketing communications
• Each marketing channel (email, SMS, WhatsApp, push notifications) may require separate consent
• Every marketing communication must include an easy opt-out mechanism
• Opt-out requests must be processed promptly
• Consent records must be maintained as evidence

Customer Profiling and Targeted Advertising

• Profiling for targeted advertising requires specific consent
• The purpose of profiling must be disclosed at the time of consent
• Behavioural targeting using browsing data, purchase history, or app usage requires consent for that specific purpose
• Third-party data sharing for advertising (e.g., with social media platforms) requires consent and disclosure

Children's Data

The DPDP Act has stringent provisions for children's data (persons under 18):

• Verifiable parental consent is required before processing children's data
• No behavioural monitoring or targeted advertising directed at children
• No tracking of children's online behaviour for marketing purposes
• No data processing that is likely to cause harm to children

Common Marketing DPDP Compliance Failures

1. Consent Mechanism Deficiencies

• Pre-checked consent boxes for marketing communications
• Bundling marketing consent with terms of service acceptance
• Cookie consent banners that default to "Accept All" without genuine choice
• Dark patterns that make it harder to decline consent than to accept
• Consent notices not available in local languages

2. Data Collection Transparency Gaps

• Not disclosing the specific purposes of data collection
• Generic "we may use your data for marketing" statements without specifics
• Not disclosing third-party data sharing for advertising
• Missing Data Fiduciary identity and contact information
• No information about how to withdraw consent

3. Cross-Border Transfer Issues

• Transferring Indian customer data to global marketing platforms without compliance
• Using international email marketing services without assessing data protection
• Sharing customer data with overseas advertising partners without disclosure
• No assessment of whether destination country provides adequate data protection

4. Children's Data Violations

• Marketing apps or services to children without parental consent
• Targeting advertisements to users under 18
• Using gamification or rewards to collect children's data for marketing
• Not implementing age verification mechanisms

Building DPDP-Compliant Marketing Content

Data Collection Checklist

Consent mechanism:

• Consent is free, specific, informed, and unambiguous
• Consent boxes are not pre-selected
• Marketing consent is separate from service consent
• Each processing purpose has separate consent
• No dark patterns in consent design
• Consent notice available in English and local languages
• Withdrawal of consent is as easy as giving consent

Consent notice content:

• Data Fiduciary identity and contact details provided
• Specific purpose of data collection clearly stated
• Types of personal data being collected listed
• Third-party data sharing disclosed
• Withdrawal mechanism explained
• Complaint procedure (Data Protection Board) mentioned

Marketing Communication Checklist

• Recipient has given specific consent for this marketing channel
• Sender identity clearly stated
• Opt-out mechanism included and functional
• Opt-out as easy as opt-in
• Content matches the purpose for which consent was given
• Consent records maintained with timestamp and method

Children's Data Compliance

• Age verification mechanism implemented
• Verifiable parental consent obtained for users under 18
• No behavioural monitoring or targeted advertising for children
• No tracking of children's online behaviour for marketing
• No data processing likely to cause harm to children

Review Schedule

Using AI for DPDP Marketing Compliance Review

What AI Can Assess

• Consent mechanism compliance — check that consent is unbundled, unambiguous, and not pre-selected
• Consent notice completeness — verify all required elements (fiduciary identity, purpose, data types, withdrawal, complaints)
• Dark pattern detection — flag consent flows that appear to manipulate user choice
• Opt-out mechanism presence — confirm that marketing communications include withdrawal options
• Language accessibility — check if consent notices are available in plain, understandable language
• Children's data indicators — flag content or data collection that may involve persons under 18

What Requires Human Review

• Verification that consent records exist and are properly maintained
• Assessment of whether specific data processing meets legitimate use criteria
• Legal interpretation of cross-border transfer requirements for specific destinations
• Evaluation of age verification mechanism effectiveness
• Assessment of whether specific consent notice language meets DPDP Act standards

TeamBench Configuration Example

Reviewer name: DPDP Act Marketing Compliance Reviewer

System prompt:

You are a marketing content compliance reviewer for India. Review websites, consent mechanisms, marketing communications, and data collection practices against the Digital Personal Data Protection Act 2023. Check for: consent mechanism compliance (free, specific, informed, unambiguous, no bundling, no dark patterns), consent notice completeness (fiduciary identity, purpose, data types, withdrawal, complaints), opt-out mechanisms in marketing communications, children's data protection (parental consent, no behavioural monitoring), cross-border transfer disclosures, and language accessibility. Flag pre-selected consent, bundled consent, dark patterns, missing opt-out mechanisms, and children's data violations. Use Indian English.

Evaluation criteria:

• Consent Mechanism Compliance (weight: 3)
• Notice Completeness (weight: 3)
• Children's Data Protection (weight: 2)
• Opt-out and Withdrawal Mechanisms (weight: 2)

Quality gate: Minimum score: 85.

Key Takeaways

• The DPDP Act requires explicit, unbundled consent for marketing — pre-checked boxes, bundled consent, and dark patterns are non-compliant.
• Consent notices must include fiduciary identity, specific purpose, data types, withdrawal instructions, and complaint procedures.
• Marketing consent is not covered by legitimate use exemptions — consent is always required for marketing communications.
• Children's data has the strictest protections — no behavioural monitoring, no targeted advertising, and verifiable parental consent required for persons under 18.
• Penalties can reach INR 250 crore — making DPDP compliance a significant business risk.
• AI-assisted review can check consent mechanisms, notice completeness, and dark patterns, but consent record verification and legal interpretations require human expertise.

---

This article provides general information about DPDP Act marketing compliance in India and is not legal advice. Always consult MeitY for current requirements and seek qualified legal advice for your specific situation.