Consent in the Age of Algorithms: The Digital Personal Data Protection Act, 2023 and the Future of AI-Driven Personalized Marketing in India

Abstract

Abstract: AI has really revolutionized marketing, moving away from a mass-communications focus to a field of individually tailored, constantly evolving persuasions that rely on granular behavioral data gathered across devices and platforms. This paper examines how India's Digital Personal Data Protection Act, 2023 (DPDP Act), together with the Digital Personal Data Protection Rules, 2025 notified on 13 November 2025, reshapes the legal basis on which such personalization may lawfully occur. It analyses the Act's consent-centric architecture its definitions of data fiduciary and data principal, its notice and consent requirements, its narrower "legitimate uses" exceptions, its treatment of children's data and its cross-border transfer mechanism; against the operational logic of AI-driven marketing techniques such as behavioral profiling, lookalike-audience modeling and programmatic retargeting. The paper situates this analysis within the staggered implementation timeline running through May 2027 and the continuing interim application of the Information Technology Act's Section 43A regime. It concludes that although the DPDP framework is ‘consent-centric’ as compared to a ‘harm-centric’ approach, marketing and ad-tech companies will need to dramatically realign their methods of obtaining consent, purpose limitation and children's-data practices prior to the DPDP provisions actually being fully in effect.