India’s Digital Personal Data Protection Act, 2023 (No. 22 of 2023) received Presidential assent on 11 August 2023. The DPDP Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)). The Data Protection Board of India was established the same day. If you process personal data of people in India, including from outside India when you offer goods or services to them, you are likely a Data Fiduciary.
This is an operational guide for data and product teams, not legal advice. Confirm obligations with counsel. Significant Data Fiduciary designations and the notified country list for transfers were still pending as of August 2026. Full operational compliance has been discussed on a 2026–2027 runway. Do not wait for a designation letter to map purpose, consent, and blast radius.
Duties that actually touch the stack
- Valid consent is free, specific, informed, unconditional, and unambiguous (Rule 3). Pre-ticked boxes and dark patterns fail.
- Notice before collection: what data, what purpose, how to withdraw. Available in Eighth Schedule languages on request.
- Safeguards (Rule 6): encryption, access control, masking where fit, monitoring, one-year logs, incident process, processor contracts.
- Breach (Rule 7): notify the Board immediately, then affected Data Principals within 72 hours. Failure to notify can draw penalties up to ₹200 crore. A personal data breach itself can draw up to ₹250 crore.
- Erasure when the purpose is over, consent is withdrawn, or the sector retention clock in the Third Schedule runs out. Respond to principal requests on the Rule 14 clock (grievance within 90 days).
- Children (Section 9): verifiable parental consent under 18. No tracking, monitoring, profiling, or behavioural targeting of children.
OTT is not one principal and one checkbox. It is a household, five profiles, a live ad pod, an offline download, and a subscriber who cancels after the cricket final. The rest of this piece is how those workflows actually break DPDP, and what to put on Customer Brain so they do not.
The family account identity crisis
Most Indian streaming households are one paid subscription and several profiles. Mom, Dad, an 8-year-old, a 15-year-old. The billing holder is the adult Data Principal who paid. The 15-year-old is still a child under Section 9 (anyone under 18). If that teen switches to the Dad profile to watch a mature title, the platform is now building watch history, skip patterns, and recs against an adult identity for a minor.
A kids-profile label at signup is not enough. Customer Brain has to treat profile age and session actor as objects, not UI chrome.
- Verifiable parental consent (Rule 10, including DigiLocker-backed paths) before any child profile exists.
- Profile-level age gates. The session carries the profile’s age band, not only the account’s billing age.
- Switching from a child profile to an adult profile should require a PIN or re-verification when the account is known to have minors. Silent profile hopping is how Section 9 gets bypassed.
- CX and Company Brain chat inherit the session profile. An agent must not “help” a child session by walking the adult graph.
Recommendations vs tracking
Section 9(3) is blunt. A Data Fiduciary shall not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children. Parental consent does not buy you a lookalike model. The line product teams argue about is first-party curation versus behavioural profiling.
Usually defensible on a kids profile: static or metadata-driven recs. “Because this title is tagged preschool + Hindi + comedy, here are other titles with the same tags.” Editorial rails. Season next-episode. No cross-profile graph walk. No ads graph. No “people like you.”
Usually not: building a psychological or commercial profile of the child. Lookalikes. “Users who watched X then bought Y.” Feeding that profile into an ads auction. Using the child’s session to train an adult recs model, or the reverse.
Customer Brain should expose a recs mode on the profile: metadata_only for children, behavioural only where the principal is 18+ and the purpose was consented. If a job cannot see that flag, it does not get the watch events.
Live ads and the SSAI blast radius
AVOD and hybrid plans send user signals into programmatic pipes in milliseconds. Server-side ad insertion (SSAI) and exchanges (Google Ad Manager, SpotX, and the rest) receive device, location, content, and often a demographic token so the mid-roll can clear. That hop is processing, and those partners are processors. The fiduciary still owns the purpose.
Withdrawal of targeted-ads consent is not a warehouse delete at 2am. The next ad break on a live stream will fire before your nightly job. Customer Brain has to revoke the live token the SSAI path uses: no telemetry leaves the platform for that session, and the pod falls back to contextual or house inventory.
- Purpose split: fulfil the stream vs personalise ads. Bundled “I agree to the app” is not specific consent.
- Processor contracts that require equivalent safeguards and honour revocation (Rule 6).
- Blast radius: which SSAI endpoints, which CDNs, which warehouse tables still hold the principal after withdrawal.
- Children: no targeted ads. Full stop. Contextual house ads only, if you advertise on that profile at all.
Offline downloads and edge data
Passengers download a season, fly, skip, pause, abandon. The app logs playback on device. When it reconnects, that bundle should not land in the analytics pipeline on yesterday’s consent. Consent can be withdrawn in the air, or a parent can lock the kids profile while the device is offline.
Treat the reconnect as an ingest gate. Customer Brain filters the edge bundle against current consent and current profile age before events are allowed into the warehouse, the recs store, or the ads graph. Events collected under a kids session stay in metadata-only mode even if the account later looks adult.
Retention clocks for churned streamers
OTT churn is seasonal. A user pays for a tournament or a season, cancels, and does not open the app for months. Cancelled is not deleted. Logged out is not erased.
The Third Schedule 3-year clock for specified large social-media-class entities is measured from last login or last transaction. Large streaming platforms should model the same discipline even if they sit in a neighbouring schedule row: last meaningful engagement, not last invoice. Advise product and data to separate three states on the account object.
- Active paid or active free. Purpose still running. Normal grants.
- Cancelled, account kept. Fulfilment purpose for billing history may continue under a named legal basis. Recs and ads purposes should stop unless consent is still specific and current. Start an inactivity clock from last login, not from cancel day if they keep watching free or logged-in AVOD.
- Deleted or dormant past policy. Automated erasure that reaches warehouse, recs, SSAI tokens, CX, and processors. Send the notice the Rules require before you wipe (large e-commerce-class entities already have a 48-hour pre-erasure notice pattern; copy the discipline).
If you cannot answer “when does the clock start for a user who cancelled after IPL and never came back?”, you do not have a retention policy. You have a hope.
Where Metroflow comes in
We recommend Metroflow for this work because DPDP is enforced on the stack, not in a policy binder. Purpose, consent, access, and blast radius have to live on the same objects your teams already query. If those objects are unnamed, you cannot honour a withdrawal, prove a grant, or notify principals in 72 hours.
On a streaming stack that means Customer Brain holds profile age, session, consent, and title rights as first-class objects. A kids session cannot borrow an adult recs graph. An ads withdrawal kills the SSAI token before the next mid-roll, not after the warehouse job. Offline playback that syncs later is filtered against current consent before it lands in analytics.
- Why it fits. A metadata-only graph. Named owners. The same RBAC on humans and agents. Lineage you can export for the Board and for counsel.
- How it helps. Tag purpose on the metric and the identity. Walk erasure to warehouse models and downstream packs. Open breach blast radius from one query. Keep the warehouse, dbt, and BI you already run.
Continue on the Media & OTT use cases page, or try the live demo.