Personal Data and Persuasion: Legal Safeguards for Privacy and Consumer Protection in Targeted Advertising under the DPDP Act, 2023

In the digital economy, advertising has shifted from broad messaging to hyper-personalised persuasion, with targeted advertising now standing at the centre of modern marketing. While this data-driven model delivers precision for businesses and convenience for consumers, it also erodes privacy, distorts consent, and exposes individuals to manipulative profiling. In India, this tension has intensified as digital adoption has outpaced the evolution of legal safeguards, leaving consumers vulnerable to data misuse, opaque algorithms, and exploitative practices. The Digital Personal Data Protection (DPDP) Act, 2023 represents a landmark attempt to regulate personal data processing, embedding principles of consent, purpose limitation, accountability, and grievance redress. This paper undertakes a comprehensive legal analysis of targeted advertising under the DPDP Act, examining its provisions against global benchmarks like the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). It identifies critical gaps; such as weak algorithmic accountability, inadequate duties for ad-tech intermediaries, and limited remedies for aggrieved consumers; that dilute the Act’s capacity to curb privacy-invasive advertising. To ground this analysis, the study incorporates an empirical component evaluating consumer awareness of data rights and the degree of business compliance with the DPDP framework. The findings reveal low public understanding of data rights and inconsistent adherence by businesses, highlighting the urgent need for stronger enforcement, mandatory transparency standards, and public legal literacy initiatives. By proposing targeted reforms, this paper argues that the DPDP Act can evolve from a narrow privacy statute into a robust legal instrument safeguarding consumer autonomy and ethical advertising in India’s data-driven marketplace.