There is an old saying in the world of business — “You don’t know what you’ve got till it’s gone.” For years, India’s advertising and marketing ecosystem operated in a land of plenty. Data flowed freely. Pixels tracked silently. Retargeting campaigns ran on autopilot. Third-party data was cheap, abundant, and rarely questioned. Consent was an afterthought buried in Terms & Conditions that nobody read. That era is not dying — it is already dead. And the question facing every agency, every media planner, every martech vendor, and every brand CMO right now is stark and urgent: are you ready for what comes next?
India’s Digital Personal Data Protection Act — the DPDP Act — is no longer a future concern. The Data Protection Board of India came into existence in November 2025. The consent manager framework goes live in November 2026. Full compliance obligations kick in by May 2027. That sounds like breathing room, but anyone who has watched a large agency or a mid-sized brand try to rebuild its data architecture from scratch knows that eighteen months is not a luxury — it is barely enough. The law now mandates that consent be specific, informed, and granular. Blanket permission buried in onboarding flows will not hold up. Every purpose for which data is used must be disclosed upfront. Every third-party partner must be named. Every user must be able to withdraw consent as easily as they gave it. And here is what makes this particularly sharp for the industry: even device IDs, hashed contact data, and mobile ad IDs now fall within the definition of personal data if they can identify an individual. The long performance marketing playbook — built on opaque data supply chains and assumed permissions — must be rewritten, line by line.
The advertising industry’s relationship with data has always been somewhat transactional. The user was the product; the data was the currency; the brand was the buyer. That triangle is now being legally disrupted. For programmatic ad-tech, the pressure is especially acute. Third-party data platforms must now prove that every data point they process was originally collected with valid, documented consent — not just assumed. The analogy being drawn repeatedly in industry circles is with GDPR’s rollout in Europe, where targeting volumes shrank, consent strings turned out to be invalid, and programmatic demand dropped significantly in the short term before stabilising into a cleaner, more accountable ecosystem. India is about to walk the same road, with its own specific complexity: a vast, multilingual user base, a massive tier-2 and tier-3 digital audience that has never been properly educated on data rights, and an ad-tech market that is, in many parts, still catching up on basic infrastructure. Compliance costs are already estimated to have risen for the industry, and that number will only climb as enforcement draws closer. The brands and platforms sitting on deep, first-party, purchase-linked datasets — think quick commerce apps, major e-commerce players, established OTT platforms — are structurally better positioned. For everyone else, the window to build that foundation is closing.
What the industry needs right now is not panic — it needs a plan. The agencies, consultancies, and martech partners that move decisively in the next six months will not just survive this transition; they will own the next era of Indian advertising. That means auditing data flows today, not in 2026. It means investing in consent management infrastructure, first-party data strategies, data clean rooms, and privacy-safe measurement frameworks. It means having genuine conversations with clients about what responsible targeting looks like in a post-DPDP world. It means training creative, strategy, and media teams to think about privacy not as a legal restriction but as a brand value — because Indian consumers, increasingly aware of their digital rights, will begin to reward brands that treat their data with respect and punish those that do not. The DPDP Act is not the end of effective advertising in India. It is, if approached with honesty and ambition, the beginning of advertising that actually deserves the trust it asks for. The industry built its empire on data. Now it must build its future on consent.
