How Does India's DPDP Act Affect Meta Ads?

Two documents matter here, and neither joins the dots for you. A Government of India backgrounder describes the Digital Personal Data Protection (DPDP) Act, 2023 and the 2025 Rules, and does not mention advertising. Meta’s business tools page tells advertisers to have a lawful basis and any necessary consent before sharing customer data, and does not name India. This is as checked on 2 Oct 2026. It is not legal advice.

What does the DPDP Act cover?

The backgrounder says Parliament enacted the Act on 11 August 2023, as a framework for protecting digital personal data. It defines a data fiduciary as an entity that decides why and how personal data is processed, and a data processor as one that processes data on a fiduciary’s behalf. It lists seven principles, including consent and transparency, purpose limitation, data minimisation and accountability. A Data Protection Board of India oversees compliance. Ask a qualified adviser whether your business counts as a fiduciary.

What did the 2025 Rules add?

The backgrounder says the Rules were notified on 14 November 2025 and give full effect to the Act. It lists these points:

• An eighteen-month period for phased compliance.
• A separate, clear consent notice from every data fiduciary, explaining the specific purpose of collection and use.
• Plain-language breach notices to affected individuals, with contact details for help.
• Clear contact information for questions about personal data.
• Requests to access, correct, update or erase data answered within ninety days.
• Verifiable parent or guardian consent for a child’s data, unless the processing relates to essential services such as healthcare, education or real-time safety.

Because phasing applies, read the full Rules to see which duties apply from when.

What do the penalties say?

The backgrounder says the highest penalty, up to 250 crore rupees, applies to failing to keep reasonable security safeguards. It says failing to notify the Board or affected individuals of a breach, and violating obligations about children, can each attract up to 200 crore rupees. Any other violation can attract up to 50 crore rupees. These are the page’s statements about the Act, not a forecast for any advertiser.

What does Meta say about sharing customer data?

Meta’s page covers its business tools, such as the Meta pixel and the Conversions API. It says you must have a lawful basis and the necessary rights and permissions, including any necessary consents, before you share information with a third party such as Meta. Where consent is required, it says to set tools so no data is shared until the person has consented. It also says not to share prohibited information, including health and financial information and categories that applicable laws define as sensitive. You remain responsible for what you share.

Meta also asks you to tell people what data you collect, who you share it with and why, and how they can control it.

What do these pages leave out?

The backgrounder does not mention advertising, Meta or tracking tools. Meta’s page names the European Union as an example of a jurisdiction that requires informed consent for storing and accessing information on a device, and does not name India or the DPDP Act. So neither says how the Act applies to a specific Meta campaign. You can read the full Act and Rules, which the backgrounder lists, compare your consent banner and tool setup with Meta’s page, and ask a qualified adviser.

What does not change in India?

Meta’s page says its requirements apply to all Meta business tools, browser-side and server-side, and it sets no separate rule for India. The steps it lists are the same for every advertiser: take an inventory of your data, set tools to respect consent choices where required, and remove prohibited information.

FAQ

Does the DPDP Act mention Meta ads?

The Government of India backgrounder, as checked on 2 Oct 2026, does not mention advertising or Meta. It describes the Act’s definitions, principles, Rules and penalties. Read the full Act and Rules, which it links, and ask a qualified adviser how they apply to your campaigns.

Do I need consent before sending customer data to Meta?

Meta’s page says you need a lawful basis and any necessary consents before sharing data with it, and to set tools so nothing is shared before consent where required. The backgrounder says data fiduciaries must give a separate consent notice stating the purpose. Ask an adviser what applies to you.

When do the DPDP Rules apply?

The backgrounder says the Rules were notified on 14 November 2025 and include an eighteen-month period for phased compliance. It does not set out which duty starts when. Read the full Rules, and confirm the current timing with a qualified adviser before you rely on it.