DPDP compliance for OTT and streaming platforms
OTT platforms profile viewing behaviour, collect payment data, and may have large populations of minor users. Here is the DPDP compliance picture.
What personal data do OTT platforms process under DPDP?
OTT platforms collect: registration data (name, email, phone, date of birth), payment data (subscription billing, payment method), device data (device ID, operating system, app version), viewing history (content consumed, watch duration, completion rate, search queries), interaction data (ratings, watchlist additions, downloads), and geographic data (for content licensing compliance). Viewing history that reveals interest in content about specific religions, political viewpoints, health conditions, or sexual orientation can constitute sensitive inference.
Does viewing history require special protection under DPDP?
Viewing history itself is personal data — it is linked to an individual subscriber's account and reveals preferences. If your content library includes material with religious, political, or health themes, and your recommendation algorithm uses viewing history to make inferences in these sensitive areas, those inferences may approach sensitive personal data territory. The safe approach is to use viewing history for content recommendations within the platform (covered by service consent) but to require explicit consent before using it for any external advertising or data selling.
How does DPDP apply to subscription sharing and family plans?
Family plan subscribers share a primary account across multiple users, some of whom may be minors. The platform must: (a) have a mechanism to identify when a profile is being used by a minor; (b) implement parental consent for minors' profiles; (c) exclude minors' viewing data from personalised advertising and behavioural profiling. Profile creation on a shared account does not transfer the primary subscriber's consent to the sub-profile user — each user's data needs to be handled according to their own age and consent status.
What consent does OTT targeted advertising require?
Advertising on OTT platforms takes two forms: contextual advertising (ads based on what content is being watched, not who is watching) and behavioural advertising (ads based on the subscriber's profile). Contextual advertising that uses no personal data is lower risk. Behavioural advertising — using subscriber profiles, viewing history, and demographic inferences to target ads — requires explicit consent under DPDP. Build consent tiers into your ad-supported plan: allow subscribers to choose contextual-only ads without profiling as a genuine alternative.
Are OTT platforms likely to be Significant Data Fiduciaries?
Large OTT platforms with tens of millions of Indian subscribers are strong SDF candidates. SDF designation requires: an India-resident DPO, periodic DPIAs for high-risk processing (recommendation algorithm, behavioural advertising, children's profiles), and submission to periodic independent audits. Start identifying your DPO candidate and building governance structures now — the government's SDF designation is expected alongside the enforcement timeline approaching May 2027.
How does DPDP apply to OTT content downloads and offline viewing?
Downloads for offline viewing copy content (and potentially user data) to the subscriber's device. Ensure your terms and privacy notice cover offline viewing and device storage of content. Download tracking — knowing which content a subscriber has downloaded and to which device — is personal data that requires the same handling as viewing history. Device-level data tied to downloads should not be used for profiling beyond content availability management.
Frequently asked questions
Can we sell viewing data to advertisers?
Selling subscriber viewing data to advertisers is a processing purpose significantly beyond what subscribers expect from an OTT subscription. It requires explicit, informed consent with a clear description of what data is shared and with whom. A generic 'improve your experience' consent does not cover data sale to third-party advertisers. Given the sensitivity of viewing history, this is a high-risk practice that is likely to attract regulatory scrutiny — build a proper consent framework before any data monetisation activity.
Do we need to delete viewing history when a subscriber cancels?
On cancellation, delete viewing history and other personal data not covered by a statutory retention obligation (billing records for tax purposes, fraud prevention data) within the consent period or the period specified in your privacy notice. Many OTT platforms retain viewing history indefinitely 'to restore your account if you return' — this retention beyond consent is a DPDP risk. Either get explicit consent for long-term retention or delete within 90 days of cancellation.
How do we handle children's profiles under DPDP if parents share the same account?
Where a family plan profile is designated as a children's profile, treat all data from that profile as children's data requiring parental consent. This means: no behavioural advertising on children's profiles, no profiling for cross-sell or recommendations beyond age-appropriate content, no sharing of children's viewing data with third parties, and a clear parental dashboard showing what data is collected on the child's profile. The parental consent given at account creation should specifically cover the children's profile.
Assess your OTT platform DPDP readiness
Niti Bharat's DPDP Maturity Assessment covers OTT platforms — viewing data sensitivity, children's profiles, behavioural advertising consent, SDF readiness, and data processing agreements.
Start OTT DPDP Maturity Assessment