Marketing is where most DPDP risk hides, because it runs on exactly the data the Act protects — identifiers, behaviour, contact details. Getting marketing compliant is one of the highest-impact things a business can do.
Consent for tracking and messaging
Analytics, retargeting pixels and ad audiences need consent for non-essential cookies. Promotional email, SMS and WhatsApp need a lawful basis and an easy opt-out — see marketing under DPDP.
No dark patterns
Consent must be a free, clear affirmative action. Pre-ticked boxes, 'accept all' with a buried reject, confusing toggles and consent walls undermine validity — and attract scrutiny.
Profiling and children
You may not track or run targeted advertising at children (under 18). If children can reach your service, your ad targeting needs guardrails.
Audiences, lookalikes and data sharing
Uploading customer lists to ad platforms, building lookalikes and sharing data with partners are processing activities that need a basis and a matching notice — not an afterthought.
A marketing checklist
- Compliant consent banner; trackers off until opt-in.
- Separate, specific marketing consent; easy withdrawal.
- No targeting of children.
- Document audiences, list uploads and partner sharing.
How DPDP Bridge helps
DPDP Bridge helps marketing teams keep growth compliant — consent, cookies, messaging and audience governance that stand up to scrutiny. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.