Advertising in a category where compliance comes first

This is an illustrative scenario, not a customer account.
Nothing here is legal advice, and anyone operating in a regulated category should take
professional advice on their own facts.

The situation

An advertiser in a regulated sector wants to run digital campaigns. Their legal team’s first
question is not about creative approval. It is about what data will be collected about the people
who see the advertising, where it will be stored, and who else will have access to it.

In a conventional programmatic setup, the honest answer involves a list of intermediaries, a
set of data processing agreements, and a degree of uncertainty about downstream use that makes
compliance officers uncomfortable — reasonably.

Why India’s position sharpens this

The Digital Personal Data Protection Rules were notified on 14 November 2025 with an
eighteen-month phased compliance period. They require standalone consent notices setting out
specific purposes, prompt breach notification, and responses to access, correction and erasure
requests within ninety days. Significant data fiduciaries carry additional audit and impact
assessment obligations.

Each intermediary holding viewer data is a surface across which those obligations have to be
satisfied and demonstrated.

How we would approach it

The structural answer is to not create the surface. Because the creative is composited locally
before broadcast, there is no ad call from the viewer’s device — no tag, no pixel, no cookie, no
identifier. There is no viewer personal data to hold, to transfer, to breach or to produce on
request, because none was collected.

Targeting is contextual: the advertiser selects whose audience, never which individuals.

Being accurate about the claim

We hold personal data about creators and publishers — identity, tax status and bank details —
and we are a data fiduciary for it with all the obligations that carries. The claim is
specifically that we hold no viewer personal data. A broader claim would be untrue, and
in a regulated category an untrue privacy claim is a worse problem than the one it was meant to
solve.