DPDP Act Authority Guide: Adtech Consent Chains and Fiduciary Allocation for E-Commerce

Executive summary

E-commerce and direct-to-consumer enterprises face strict liability under the Digital Personal Data Protection Act, 2023 regarding their programmatic ad supply chains. General Counsel need to evaluate how marketing teams collect and share customer identifiers. The Act invalidates bundled consent. It requires explicit, itemised opt-ins for specific processing activities. Fiduciaries remain liable for the actions of their downstream processors. Legal leaders require immediate visibility into vendor data flows to mitigate penalty ceilings reaching up to 250 crore rupees.

Statutory framework

Section 4 of the DPDP Act, 2023 states that personal data may only be processed for a lawful purpose. Consent forms the primary basis for processing, except where Section 7 legitimate uses apply. Relying on implied consent or pre-checked boxes for adtech tracking is legally indefensible. Section 8 directs that a Data Fiduciary remains accountable for all processing undertaken on its behalf by a Data Processor. This liability applies irrespective of any agreement to the contrary. Enterprises need to set up valid contracts with every vendor in their adtech stack.

Section 9 strictly prohibits targeted advertising directed at children. The law also bars behavioural monitoring of minors. E-commerce platforms with mixed audiences have to deploy verifiable age-gating mechanisms. This stops the processing of prohibited data. The statute provides no exceptions for marketing convenience. General Counsel should direct product teams to halt automated profiling of minors immediately.

Rules 2025 operational layer

The Rules, 2025 set strict parameters for notice and consent collection. E-commerce platforms can no longer bundle shipping data requirements with marketing communications. Rule 3 requires giving Data Principals the option to view the notice in English or any of the 22 languages listed in the Eighth Schedule of the Constitution. Offering these translation options shifts operational burdens onto legal and marketing teams.

The Rules specify an itemised notice detailing exactly what data is collected and the specific purpose for each data point. Marketing departments need to maintain a verifiable audit trail of every consent transaction. This record defends against regulatory scrutiny. General Counsel verify that consent logs capture the exact version of the notice presented to the user at collection.

Enforcement and DPBI

The Data Protection Board of India has authority to initiate inquiries based on complaints or data breaches. E-commerce platforms risk heavy scrutiny if tracking pixels or programmatic tags leak customer data to unauthorized third parties. Section 8 liability means a brand cannot blame its ad agency for a breach. The Board will request the Data Fiduciary to produce vendor contracts, consent logs, and processor audit reports.

General Counsel secure strong limitation of liability and indemnity clauses from adtech vendors. Preparing a defensible record of processing activities limits exposure to statutory penalties. Legal teams can schedule privileged reviews of all marketing data supply chains to identify uncontracted third-party tags.

Comparative context

The DPDP Act takes a narrower approach to consent and vendor allocation compared to European frameworks. Indian law explicitly bans behavioural tracking of children without the age-based gradations seen in foreign statutes. Businesses cannot apply the concept of legitimate interest to justify programmatic advertising or tracking cookies under the DPDP Act.

Cross-border transfers of identifiers to global ad servers are generally permitted unless the Central Government restricts transfer to notified countries. General Counsel evaluate data residency requirements for ad-serving infrastructure separately from consent obligations. Relying on foreign compliance frameworks does not satisfy the specific rules of the DPDP Act.

Decision matrix

Legal teams use this matrix to allocate adtech compliance tasks across the enterprise.

Scenario: A customer purchases a product on an e-commerce site. Obligation: Process address data exclusively for fulfillment under a specific notice. Owner: Logistics operations. Artifact: Transactional consent record.

Scenario: Re-targeting site visitors through third-party ad networks. Obligation: Get explicit, unbundled consent before sharing identifiers. Owner: Chief Marketing Officer. Artifact: Itemised marketing consent log.

Scenario: Deploying a programmatic advertising tag. Obligation: Execute a valid Data Processor contract under Section 8. Owner: General Counsel. Artifact: Signed processor agreement and security schedule.

Scenario: Operating an online storefront accessible to minors. Obligation: Halt targeted advertising directed at children under Section 9. Owner: Product Engineering. Artifact: Age-gating mechanism and verifiable parental consent record.

What to ask any provider

Legal and procurement teams evaluate compliance technology using specific diligence questions.

1. Does the platform physically separate transactional data consent from marketing consent in its data model.

2. Can the system support the option to view consent notices in the 22 Eighth Schedule languages without manual legal review.

3. How does the tool export consent logs and processor audit trails for submission to the Data Protection Board.

4. Does the vendor accept primary liability if their platform fails to record an opt-out request.

5. How quickly can the solution map third-party programmatic trackers currently active on our e-commerce storefront.

Implementation roadmap

Days 1 to 30 require the General Counsel to map all programmatic trackers, marketing agencies, and ad networks receiving customer data. The legal team reviews existing terms of service to identify bundled consent clauses. Procurement freezes new marketing vendor onboarding until Section 8 templates are finalized.

Days 31 to 60 focus on drafting DPDP-compliant processor contracts. The procurement team renegotiates indemnities with external marketing vendors. Legal teams define the exact data fields permitted for transfer to each ad network.

Days 61 to 90 involve setting up a consent unbundling solution across digital touchpoints. The engineering team integrates the multi-language notice options and establishes a central repository for Data Protection Board inquiries. Marketing tests the commercial impact of explicit opt-ins on campaign reach.

Further reading

Review our resources on securing valid data processor agreements under Section 8 of the DPDP Act. Legal teams can also read our breakdown of the technical requirements for managing language translations under Rule 3. Evaluate your programmatic supply chain against the notified rules by running the free scan at https://www.complydp.com/audit-preview today.