DPDP for Marketing Teams: Can You Still Run Personalised Ads in 2026?

With the Digital Personal Data Protection (DPDP) Act now live and enforceable, marketing teams across India are asking one critical question: Can we still run personalised ads in 2026?

The answer isn’t a simple yes or no. Under DPDP, it’s not about if you can advertise it’s about how you do it.

Let’s break down what the new data protection regime means for performance marketing, remarketing, and customer segmentation and what you must change to stay compliant.

What Does “Personalised Advertising” Mean Under DPDP?

Personalised or targeted advertising typically involves:

• Collecting browsing data via cookies or SDKs

• Using behaviour, location, or profile data to segment users

• Serving ads based on interests or past actions

• Syncing data with ad networks like Meta, Google, or LinkedIn

Under the DPDP Act 2023, all of these actions fall under “processing of personal data” and require valid consent unless the data is anonymised.

Key DPDP Rules That Impact Marketers

Rule 3: Specific Purpose and Informed Consent

You must clearly explain what personal data is collected and why (e.g., “to show you relevant offers”).

Rule 5: Notice Requirements

Consent must follow an accessible, clear, and simple privacy notice format. The user must understand their rights before agreeing.

Rule 9: Consent Withdrawal

If a user revokes consent, their personal data must no longer be used for marketing—immediately.

Rule 20: Cross-border Transfers

Sending personal data to foreign ad networks is only allowed if the country is not on the blocked list and the user has been informed.

Where Most Marketing Teams Go Wrong

• Running retargeting ads before asking for consent

• Using default “Accept All” cookie banners that don’t offer “Reject All” or category-level toggles

• Not updating privacy notices to reflect marketing purposes

• Failing to stop processing when consent is revoked

• Sharing data with global ad networks without clear disclosure

These are not just bad practices—they're non-compliance triggers under DPDP.

What Marketing Teams Can Still Do (Legally)

1. Use Consent-Based Targeting

• Deploy DPDP-compliant cookie banners with purpose-level options

• Track only those who opt in for “Marketing” or “Analytics”

2. Create Segments Based on Declared Data

• If a user explicitly fills out a form and ticks “Send me offers,” that’s valid consent

• Use that declared data in CRM systems for email and SMS campaigns

3. Switch to Contextual Ads

Ads based on page content rather than user data are outside DPDP’s scope

4. Offer a “Manage Preferences” Option

Let users update ad preferences or opt out any time (Rule 9)

5. Use Privacy-Safe Analytics Tools

Consider solutions that offer anonymised insights without personal identifiers

The Risk of Non-Compliance

Violation of consent norms in personalised advertising can lead to:

• Penalties of up to ₹250 crore per breach (Section 33)

• Legal complaints by Data Principals (users)

• Audits by the Data Protection Board of India

• Reputational damage from user distrust or media coverage

How Blutic Helps

Blutic’s Consent Manager for Marketers ensures:

• Ads run only after valid consent

• Real-time sync between cookie preferences and tag managers

• Country-wise support for cross-border data rules

• Custom privacy notices with auto-updates for Rule changes

• Consent logs to protect you in case of audits or disputes

Yes, you can still run personalised ads in 2026. But not the same way.

The DPDP Act doesn’t ban advertising it redefines the rules of trust. Marketing teams that adapt early will avoid penalties and build brand credibility in the consent economy.