AdTech is built on identity, tracking and profiling, the activities the Act most directly reins in.
In short
Consent, purpose limitation and children protections define what you can and cannot do. Penalties reach ₹250 crore, and ₹200 crore where children are targeted.
What changes for this sub-sector.
Cookies, device IDs and graphs identify people; processing them needs consent.
Targeted advertising needs clear, informed consent, not inferred permission.
Targeted advertising directed at children is prohibited outright.
SSPs, DSPs and data brokers are all in scope; contracts and disclosure matter.
Data collected for one purpose cannot be repurposed for ad targeting without a basis.
Support access and erasure across the identity graph.
Fix consent capture and children exclusions first.
The readiness check flags consent, sharing and children-targeting gaps.
Take the readiness check →