DPDP for social media and content platforms
Social media and content platforms sit at the intersection of the most sensitive DPDP obligations: children's data, profiling, ad targeting, user-generated content, and SDF risk.
What are the main DPDP compliance risks for social media platforms?
No sector has a higher concentration of DPDP exposure than social media and content platforms. These platforms: have users who span all ages including under-18; build detailed behavioural profiles for advertising; share data extensively with ad networks and analytics vendors; operate recommendation algorithms that significantly affect users; collect sensitive inferences from user behaviour (political views, health interests, religious content, relationship status); and operate at the scale most likely to trigger SDF designation. Each of these is a distinct DPDP risk requiring a distinct compliance response.
How must social media platforms handle under-18 users under the DPDP Act?
Any platform that users under 18 can access — which in practice means any general-audience social or content platform — must implement verifiable parental consent. The consent must be obtained before the minor uses the platform, not after. This requires an age verification mechanism at registration, a parental consent flow for accounts where the user is or may be a minor, and the exclusion of under-18 accounts from behavioural advertising and profiling entirely. Building this retroactively for millions of existing accounts is a significant engineering project — start immediately.
Does targeted advertising on social media require consent under DPDP?
The primary revenue model of most social media platforms — behavioural advertising — requires explicit consent under the DPDP Act. Users must actively consent to their behaviour being tracked, profiled, and used to target them with advertising. A pre-ticked consent box, a consent buried in terms and conditions, or a 'use the platform = consent to ads' structure is insufficient. Platforms must offer a genuine, friction-free opt-out from profiling-based advertising, including for existing users, without degrading the core service experience.
Is user-generated content treated as personal data under the DPDP Act?
Social media platforms hold user-generated content — posts, photos, videos, comments — that is also personal data. Users have the right to delete their own content. The right is somewhat nuanced: content the user posted publicly and which has been engaged with by others creates data about those other users too. But the platform must provide a mechanism for users to delete their own posts, and deletion must actually remove the data — not just hide it from public view while retaining it in the database.
Are social media platforms likely to be designated as Significant Data Fiduciaries?
Large social media platforms with tens of millions of Indian users are near-certain SDF candidates. SDF designation requires: an India-resident DPO reporting to the board; periodic DPIAs for high-risk processing activities (which would include the recommendation algorithm and ad targeting system); submission to periodic audits by an independent data auditor; and registration with the Data Protection Board. Start identifying your DPO candidate — internal or external — now, and build the governance structures the DPO will need to do their job.
How do DPDP cross-border transfer rules affect global social media platforms?
Global social media platforms process Indian user data on servers outside India. When the government publishes its cross-border transfer allowlist, platforms must ensure their primary data centres — or mirror copies for Indian users — are in approved countries. Build data residency controls and regional routing capability into your infrastructure roadmap now, even if the allowlist has not been published, because retrofitting this under a tight deadline is extremely expensive.
Frequently asked questions
If a user deletes their account, do we have to delete all their data?
Account deletion plus the associated consent withdrawal triggers an obligation to erase personal data for which consent was the lawful basis — which includes most user profile data, behavioural data, and content. However, you can retain: data needed to comply with a statutory obligation (law enforcement hold, tax record); data relating to an unresolved dispute or report; and content that is part of another user's interaction (a reply that someone else posted referencing your deleted account — the other user's data does not disappear because you deleted yours). Apply a clear deletion policy and communicate it to users.
Can we train our recommendation algorithm on Indian users' data without additional consent?
Using personal data to train your recommendation algorithm is a specific processing purpose that must be covered in your consent framework. If your consent at registration disclosed that user data would be used to personalise recommendations (and most platform consent flows do include this), you have a basis for using that data in the recommendation system. But using it to train a model for sale, sharing it with third parties, or using it for ad targeting requires the specific consents covering those uses.
Are Indian-language content platforms subject to the same rules as English-language social media?
Yes. The DPDP Act applies to all platforms processing personal data of individuals within India regardless of the language the platform uses. Indian-language platforms — video sharing in regional languages, social networks for regional communities — must comply with the same consent, rights, children's data, and SDF obligations as large English-language platforms. Privacy notices and consent mechanisms should be available in the language the platform uses — ideally also in English — so users can understand what they are consenting to.
Assess your platform's DPDP compliance
Niti Bharat's DPDP Readiness Assessment covers social media and content platforms — children's data, profiling consent, SDF readiness, ad-tech DPAs, and cross-border transfer architecture.
Start Platform DPDP Assessment