OTT platforms brace for compliance overhaul under data protection rules
OTT platforms brace for compliance overhaul under data protection rules
The draft Digital Personal Data Protection Rules, 2025 (DPDP Rules) could raise operational costs for OTT companies, short-form apps, and other entertainment platforms frequently accessed by children, restricting their monetization efforts and requiring them to put in place a more robust compliance and privacy protocol.
According to lawyers and entertainment industry experts, these platforms must comply with strict obligations for processing children’s data, including obtaining verifiable parental consent, restricting behavioural tracking and targeted advertising, and implementing robust security measures such as encryption and access controls. While a lot of this could prove to be an additional burden for both platforms and parents who may lack digital literacy, curbs on targeted advertising could hinder monetization.
On 3 January, the government released the draft Digital Personal Data Protection Rules, 2025, setting the stage for implementation of the Digital Personal Data Protection Act, 2023.
“The Digital Personal Data Protection Rules, 2025 would require OTT platforms, short-form apps, and other entertainment platforms to implement significant changes in compliance and policies, particularly concerning children’s data. They would need to adopt robust age-verification mechanisms to identify users under 18 and secure verifiable parental consent before processing their data,” Gaurav Sahay, practice head - technology and general corporate, Fox Mandal & Associates LLP, said.
Necessitating updates
This could necessitate updates to user onboarding processes, privacy policies, and backend systems to ensure compliance, Sahay added. For platforms, these changes could increase operational costs, as they would need to enhance security measures, restrict certain practices like targeted advertising for children, and create age-appropriate content categorization.
Global platforms operating in India may face additional burdens from data localization requirements and restrictions on cross-border data transfers, further complicating compliance.
A senior executive at a streaming platform said that from a parental perspective, these obligations may mean introducing extra steps, such as providing and verifying consent for their child’s access to digital platforms. “This could be seen as a burden, especially in scenarios requiring repeated approvals or where parents lack digital literacy,” the executive added.
To be sure, some of these changes could hinder user engagement, as friction in the onboarding process might deter teens and parents from accessing these platforms. Monetization strategies reliant on behavioural tracking and targeted advertising would take a hit, forcing platforms to explore alternatives like subscriptions, which could alienate price-sensitive users. Meanwhile, smaller platforms may struggle with compliance costs.
“The overall compliance costs may increase, limiting targeted ads and data-driven monetization models. Engagement strategies may shift towards child-friendly content and subscription models to offset advertising losses. There could be a possibility of having a new operational model - a separate platform for children or children’s subscription-based model,” said Vikas Bansal, partner, IT risk advisory and assurance, BDO India, a global professional services organization offering tax, accounting, assurance, and advisory services.
Dependent on user data
Platforms often depend on user data for personalized content recommendations, targeted advertising, and user engagement strategies. The new rules may require them to limit the collection of personal data from children, including tracking their online activities, preferences, and behaviour, according to Zubin Morris, partner, Little & Co. This could adversely affect their ability to deliver personalized experiences, a critical aspect of their business model. Restrictions on data collection could lead to less personalized experiences, impacting user engagement, Morris added.
Further, the platforms may have to re-evaluate their content strategies to ensure compliance with the rules. This could involve creating more child-friendly content or implementing stricter content moderation policies. “Business models that rely heavily on targeted advertising to children may need to be adjusted. Platforms may need to explore alternative monetization strategies, such as subscriptions or non-personalized advertising,” said Anupam Shukla, partner, Pioneer Legal.
The Digital Personal Data Protection Act, 2023 and the draft rules made thereunder could significantly disrupt the operations, engagement strategies, and revenue models of OTT platforms and entertainment apps, agreed Akshayy S. Nanda, partner at Saraf and Partners.
“Platforms would be required to reconfigure their systems and segregate personal data of children and ensure it is processed in compliance with the DPDPA and the rules. The impact is likely to be profound as children form a significant audience base for many entertainment platforms, especially those offering animated content, games, and interactive experiences. Failing to comply with these requirements could result in severe penalties under the DPDPA,” Nanda said.