Targeted Advertising
Advertising chosen for a person based on data about their behaviour or characteristics.
Targeted advertising means showing a person ads picked because of what a business knows about their behaviour, interests or traits. The DPDP Act bans it when directed at children, and asks for proper consent for adults.
Meaning of Targeted Advertising
The Act bars targeted advertising directed at children. For adults, it is allowed within the purposes in the notice, and optional personalisation should rest on consent that can be refused without losing the core service.
Targeted advertising is the practice of choosing which advertisement a particular person sees based on data about them: purchases, browsing, location, app usage, inferred interests, age band or income range. It differs from contextual advertising, where an ad appears simply because of the page being viewed, such as a cricket-bat ad on a sports article, without reference to who is reading. The DPDP Act does not define the term, so the ordinary marketing meaning applies.
Section 9(3) is the anchor provision for children. It says a Data Fiduciary shall not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children, and a child under Section 2(f) is anyone below eighteen. Like the ban on monitoring, this is a prohibition rather than a consent-based option: a parent's verifiable consent does not unlock it. Rule 12 and the Fourth Schedule can exempt limited classes or purposes, but nothing there is aimed at commercial advertising.
For adults, the Act does not prohibit targeted advertising, but it controls how the data behind it is used. Marketing is a purpose that must be stated in the notice under Section 5 and Rule 3, and because there is no general legitimate-interest ground in the Act, personalised advertising generally depends on consent under Section 6. That consent must be free, specific and unconditional, which means a service should not refuse to work just because a user declines personalised ads.
Two practical points often catch teams. First, the ban concerns ads directed at children, so the focus is on the audience your targeting logic reaches, not only on whether your service says it is for children. A general-audience app with many teenage users still needs a way of excluding them. Second, sharing data with an advertising partner is itself processing, so the fiduciary stays accountable under Section 8(1) for what the ad network does with it.
Examples of Targeted Advertising
A grocery app shows baby-product ads to a user based on her purchase history. For an adult this needs a clear notice and consent. For a child account it is not allowed.
A shopping site wants to show offers based on a customer's browsing history. It places a separate, unticked choice for personalised offers in its consent screen. Customers who decline still see the normal catalogue and generic banners, and can buy as before.
A game popular with 10 to 15 year olds used to show ads chosen by play behaviour. After reviewing Section 9(3), the studio removes behavioural targeting for all users flagged as under 18 and switches to fixed, non-personalised sponsor banners that appear for everyone.
A regional news site builds reader segments from articles read. It asks logged-in adults for consent, shows contextual ads to everyone else, and keeps its ad partners to written instructions so a withdrawal from a reader is passed on and acted on.
Why Targeted Advertising matters
Advertising revenue is the main business model of many Indian apps, which makes this one of the provisions with the most commercial effect. An ad system that cannot tell adults from minors, or that keeps feeding behavioural data to partners after a user withdraws consent, exposes the fiduciary to penalties of up to ₹200 crore for breach of children's obligations and up to ₹50 crore for other breaches under the Schedule to the Act.
There is a trust angle as well. Users increasingly notice when an ad seems to know too much, and an organisation that explains its advertising choices plainly and respects a refusal builds a more loyal audience. Brands that buy advertising are also starting to ask publishers how they handle consent and children, so clean practice becomes a selling point rather than only a cost.
How it works in practice
- 1List each advertising purpose separately in your notice, such as personalised offers, lookalike audiences and measurement, so that consent can be given or refused for each rather than bundled together.
- 2Build an age signal into the ad pipeline. Accounts known or likely to belong to children should be excluded from audience segments, custom lists, retargeting and any real-time bidding that passes identifiers outward.
- 3Offer a clear opt-out and a way to withdraw consent that is as easy as giving it, as Section 6 expects, and make sure the withdrawal actually reaches the ad partners that hold the data.
- 4Keep contextual advertising as the fallback. Showing ads based on content rather than the person lets you earn revenue from users who refuse personalisation, and from child accounts if any advertising is shown at all.
- 5Review contracts with ad networks and measurement vendors so they only use data for the instructions you give, delete it when asked, and help you honour erasure and withdrawal.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Burying ad personalisation in a single "I agree to everything" checkbox. Consent must be specific, so personalised advertising needs its own clear choice.
Treating contextual and targeted advertising as the same thing. Contextual ads do not need a profile of the individual, which is why they are the safer fallback.
Assuming the ban only applies to child-oriented apps. The question is whether the ads are directed at a child user, so general apps with young users need exclusion controls too.
Forgetting the partners. If an ad network keeps profiles after a user withdraws consent, the fiduciary remains responsible.
Compliance tips
Separate marketing consent from service consent in your product design so that refusing ads never blocks core features.
Run a quarterly test from a child account and an adult account and compare the ad calls each sends to third parties.
Keep a consent record showing what the person saw, when they agreed and to which advertising purpose, so you can show the choice was real.
Prefer contextual placements for any audience where age is uncertain; the revenue is lower per impression but the legal risk is much lower.
Common questions about Targeted Advertising
Is targeted advertising illegal under the DPDP Act?
No, not for adults. It is lawful if it fits a stated purpose, rests on valid consent, and meets security and notice duties. It is prohibited when directed at children under Section 9(3), subject to narrow exemptions in the Rules.
Do I need consent for personalised ads?
In practice yes. The Act has no general legitimate-interest ground, and Section 7 lists only specific [legitimate uses](term/legitimate-uses) that do not cover commercial advertising. So personalised advertising to adults normally needs consent under Section 6, which must be specific and withdrawable.
Does contextual advertising fall under the ban?
Contextual advertising that depends only on the content being viewed, and not on data about the person, is not the kind of targeting the provision describes. If a contextual system also uses personal identifiers or behaviour history, it moves closer to targeted advertising and should be assessed.