Social media companies are voicing strong concerns over India’s Digital Personal Data Protection (DPDP) Act, with global players like Meta warning that some of its provisions could disrupt business operations, especially those involving minors and international data flows.
One of the key sticking points for companies is the Act’s restriction on tracking and profiling individuals under the age of 18. While intended to safeguard children’s privacy, platforms argue that this could hinder their ability to offer tailored content, a feature that’s become central to user engagement on apps like Instagram and Facebook.
Meta’s Vice President for Policy, Rob Sherman, emphasised the value of personalised digital experiences for younger users. Speaking to The Economic Times, Sherman pointed out that while protections for minors are essential, outright bans on personalisation may limit the usefulness and appeal of these platforms. “The news feed you see and the one I see are different because they’re based on our interests. That’s part of what makes social media valuable,” he noted.
Another concern lies in the potential limitations on cross-border data transfers. Sherman warned that overly restrictive rules on international data movement could have serious implications for how Indian businesses and users connect with the global digital economy. He added that although the current government stance appears balanced, any sweeping prohibitions on data sharing could disrupt communication and commerce.
Meanwhile, the Ministry of Electronics and Information Technology (MeitY) has confirmed that the final rules under the DPDP Act are in the pipeline. Secretary S Krishnan stated that the government is currently reviewing feedback from the public consultation phase, which concluded in early March. A fresh round of internal discussions may follow, with final rules expected in six to eight weeks.
Krishnan also underlined the government’s intention to curb personal data leaks and is exploring the local storage of AI models as an additional safeguard to prevent unauthorized data transfers abroad.