DPDP Act + Rules 2025

India's Digital Personal Data Protection Act, 2023 applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. Consent must be free, specific, informed, unconditional, and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give. For children under 18, a Data Fiduciary needs verifiable parental consent and may not track, behaviorally monitor, or direct targeted advertising at them. The Digital Personal Data Protection Rules, 2025, published in November 2025, phase obligations in: Consent Manager registration after one year, and most substantive duties, including notice and security safeguards, after eighteen months. The Data Protection Board of India can impose penalties of up to ₹250 crore. For any brand with Indian traffic, the ban on tracking minors is the provision that reaches advertising tags directly.