The advertising industry in India has experienced rapid advancements in advertising technology or adtech. Advertisers can monitor individuals across diverse digital channels and create profiles for personalised advertising. However, this raises privacy considerations in a complex market with intricate data exchanges between players in the data supply chain.

Adtech is not regulated strictly, and the legal framework for data protection is still evolving. Existing data protection law primarily governs the processing of certain sensitive personal data, which requires consent. Other personal information processing is not so controlled. Adtech players have been able to gather vast amounts of personal data without restriction.

Existing law does not differentiate between entities carrying out different data processing roles. However, the new personal data law, the Digital Personal Data Protection Act, 2023 (DPDPA), holds only data fiduciaries liable, while data processors have no statutory obligations. Adtech participants should understand their roles under the DPDPA, as they may be both data fiduciaries and data processors depending on their processing activities.