A Project by Meridian Bridge Strategy
📢

DPDP Consulting for Advertising

Learn how DPDP changes pixels, lead forms, ad targeting, retargeting and agency data flows.

38/100 Avg. Score
1 Analyzed
6 Gaps Found

Discuss this page with an LLM

ChatGPT Claude Gemini Perplexity

Now replace the sandwich shop with your Advertising company. Where does personal data enter? Where does it sit? Who else touches it?

Advertising DPDP Self-Check

Start here to understand why DPDP is relevant to Advertising. Before any other task, first understand how personal data moves through the business.

What is Advertising?

In this context, Advertising means the websites, apps, operations, support teams, customer records, employee systems, vendor tools and data workflows that collect or use personal data.

Start the self-check Book a 20-minute clarity call

Children's data

  • Do you collect age, class, school, parent details or learning progress?
  • Can you separate child, parent and guardian data?
  • Do you know which users are under 18?

Consent

  • Can you prove where consent came from?
  • Is consent collected before data is used for the stated purpose?
  • Can consent be withdrawn without breaking the entire account flow?

Tracking and profiling

  • Do you track usage, performance, attention, behavior or drop-offs?
  • Is any of this used for ads, recommendations or nudges?
  • Are analytics tools collecting user identifiers?

Vendors and SDKs

  • Which CRMs, email tools, payment tools, analytics tools and support tools receive personal data?
  • Do contracts say they process data only on your instructions?
  • Can you delete or export data from each vendor?

Retention

  • What happens when the service ends?
  • What happens when a user leaves?
  • What data is kept for certificates, invoices, disputes or regulatory records?

First action

  • Map one user journey from sign-up to completion.
  • Mark where data is collected, stored, shared, used for communication and deleted.

If this self-check exposed more than three unclear answers, the next useful step is a DPDP data journey map.

Book a DPDP clarity call

Advertising Company Analyses

AdTech

InMobi

38

InMobi's global adtech operations entail extensive data processing, but its policy likely struggles with DPDP's strict consent and retention requirements. The reliance on broad terms for data use and cross-border transfers poses significant risks under the new Indian law.

⚠️ Consent often indirect, bundled, not 'freely given' per Section 6
⚠️ Data retention periods are vague, 'as long as necessary' language
+4 more gaps detected
Mar 2026 View Report →

Frequently asked questions

Can we still use "legitimate interest" for tracking?

No. India's DPDP Act does not include a "legitimate interest" clause for private commercial advertising. You must obtain clear, affirmative consent for every tracking and profiling activity.

Do we need a new consent notice for every campaign?

If the purpose of data collection changes—such as moving from a "one-time contest" to a "long-term marketing profile"—you must issue a fresh notice. You cannot use data collected for one campaign for an unrelated product launch later.

Is an IP address considered personal data?

Yes, if the IP address can be used to identify an individual or their household. In the context of targeted advertising and device fingerprinting, assume IP addresses fall under DPDP protections.

Book clarity call