Navigating Consent-Only Data Processing: A Framework for Entities Relying on Targeted Advertising and User Preferences

[Jatin is a student at Hidayatullah National Law University.]

With the enactment of the Digital Personal Data Protection Act 2023 (DPDPA), India has institutionalized a consent-based regime as the bedrock of personal data protection. This has direct implications for entities such as over-the-top (OTT) platforms, which depend on behavioral data to provide personalized content and advertisements. The challenge to these platforms is two-fold: re-engineering their operations to comply with the rigorous standards of legal consent under the DPDPA and, at the same time, ensuring that the essence of their services—personalization and user interaction—is not affected. This article examines how such entities can structure their processes to uphold the principles of the DPDPA by creating a legally sound, user-focused, and operationally optimized consent model. 

Legal Basis for Consent under DPDPA  

DPDA defines personal data as “any data about an individual who is identifiable by or in relation to such data”. Under Section 4, processing of such data is allowed only with the consent of the Data Principal (the person to whom the data pertains), except where such processing is under the limited categories of deemed consent listed in Section 7. Notably, personalization and targeted advertising are not included in these exceptions and thus need express and informed consent. Section 6 expounds on the character of valid consent by asserting that it should be free, specific, informed, and clear. It should be followed by a notice that is in clear and understandable language, conveying the purpose and extent of processing in simple and clear terms. In addition, the said section requires that the withdrawal of consent should be as easy as granting consent. DPDPA thus establishes a rigid and clearly delineated benchmark for the gathering and utilization of personal data, which entities such as OTT platforms now have to internalize within their business processes.

From Onboarding to Opt-Out: Navigating Consent Management

To incorporate the legal requirements prescribed under the DPDPA, the relevant entities must create a transparent and granular consent management framework. This framework must begin at the onboarding stage, when a user first interacts with the platform, whether by signing up, installing the app, or browsing as a guest. During the onboarding stage, the relevant entities must issue privacy notices that clearly set out the nature of the data to be harvested, e.g., user viewing history, device metadata, and search behavior. These notices need to be issued in English or in one of the languages listed in the Eighth Schedule of the Indian Constitution to facilitate accessibility and understanding across a variety of user groups. 

Most importantly, consent needs to be granular and not bundled. Users need to be provided with the option to opt in or out of various kinds of processing separately. Netflix India, for example, provides privacy settings that allow users to manage their personalization preferences. Such detail supports the principle of purpose limitation in Section 5 and makes certain that individuals are really in command of the utilization of their information. They can do so by integrating their consent mechanisms with consent managers - a centralized, independent entity authorized by the Data Protection Board - to streamline user interactions, simplify consent management, and enhance transparency. 

Consent management does not stop at the onboarding stage. Entities should also give users control on an ongoing basis through a specific privacy or consent dashboard. The dashboard should allow users to view their consent settings and withdraw consent at any time, in accordance with Section 6(3) of the DPDPA. Withdrawal should be immediate and should not result in a diminished user experience. For instance, if a user has chosen to avoid personalized recommendations, the service must provide alternatives that are non-personalized, such as trending content or browsing by genre. This ensures conformity with the intent of the law while preserving the utility and appeal of the service.

Preserving Product Functionality without Violating Consent Norms

One of the foremost challenges for entities in a consent-only regime is the disruption to personalized service where consent is withheld or withdrawn. Personalized recommendation engines and advertisement systems are fundamental to user engagement and monetization. To mitigate this,  the concerned entities must develop a dual-track system— one for consenting users and another for non-consenting users. 

Fig. 1: Dual Track System

For consenting users, information like watch history and user behavior can continue to drive advanced personalization. For non-consenting users, the platform can use contextual methods from non-personal data. Such methods include genre filtering, editorially curated content,  and trending titles based on overall geographic or national patterns. In this way, platforms can maintain functionality and user satisfaction without contravening the consent requirement.

In a consent-centric regime, targeted advertising must give way to contextual advertising when user consent is unavailable. Behavioral advertising relies on user profiling, which is impermissible under the DPDPA without explicit consent. Contextual advertising, by contrast, does not rely on personal data. Instead, it delivers ads based on the nature of the content being consumed. An example of this would be placing sport-themed advertisements on a sports documentary without collecting personal data and thereby staying out of the regulatory pitfalls. Though contextual advertising can generate lower revenue returns than behavioral targeting, it enables platforms to keep monetization streams in a privacy-compliant manner. 

Regulatory Expectations and Compliance Standards

The introduction of the DPDPA has prompted a paradigm shift in the manner in which businesses conduct their marketing strategies. Conventional practices based on indiscriminate data collection and the use of third-party data sources are no longer tenable under the new regulatory framework. The relevant entities must now reorient their marketing strategies to incorporate the following components:

Component	Explanation
Clear Consent Mechanism	As elaborated above, the concerned entities must incorporate a transparent and granular consent mechanism in compliance with Sections 4, 5 and 7 of the DPDPA.
First-Party Data Collection Tools	Reliance on third-party data to effectively target potential customers is deemed non - compliant under DPDPA. Therefore, entities must secure first party data through engagement and value-driven interactions.
Regular Data Audits	The new framework should account for regular data audit to ensure compliance with DPDPA.
Enhanced Data Security Measures	The concerned entity as a data fiduciary must take reasonable, technical and organizational measures such as encryption of data at rest and in transit, role-based access controls, pseudonymization or anonymization of personal identifiers, and regular security audits and vulnerability assessments.

Fig.2: Key Components to be considered to ensure compliance with DPDPA

Conclusion       

The introduction of DPDPA necessitates significant changes in the marketing strategies employed by entities relying on personalization and targeted advertisement. For such entities, this represents a fundamental change that requires careful adjustments to their data ecosystems, product design, and legal compliance strategies. By integrating consent into the user experience, providing alternatives to data-driven personalization, and ensuring transparency and accountability in all interactions, platforms can not only be compliant with the letter of the law but also create a foundation of trust and loyalty among users. In an age where data is power, respecting consent is not just a regulatory necessity—it is a business imperative.