By Aniket Ghosh

Introduction: Why Telecom and OTT Platforms Sit at the Heart of India’s Privacy Debate

Few sectors process personal data as continuously, invisibly and unavoidably as telecom operators and OTT platforms making them among the most susceptible to data privacy risks. Every phone call, message, stream, click, pause and recommendation generates layers of metadata, often more revealing than the underlying content itself.

Telecom service providers (TSPs), internet service providers (ISPs), OTT messaging apps, video streaming platforms, social media services and content aggregators today process:

For most users, participation in modern digital life is impossible without submitting to this data collection.

With the enactment of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), India has placed legally enforceable limits on how such data may be collected, used, shared and retained. For telecom and OTT businesses, the new framework creates a complex compliance matrix, intersecting:

Applicability of the DPDP Act to Telecom and OTT Platforms

Entities Covered

The DPDP Act applies to all entities processing digital personal data, including:

Both Indian and foreign platforms offering services to individuals in India fall within scope.

Telecom and OTT Platforms as Data Fiduciaries

Most telecom operators and OTT platforms qualify as data fiduciaries, as they determine:

Third parties such as cloud providers, analytics vendors and ad-tech platforms act as data processors, but primary liability remains with the platform. Given their scale and systemic importance, major telecom operators and OTT platforms are strong candidates for Significant Data Fiduciary (SDF) designation.

Metadata as Personal Data: The Hidden Compliance Risk

What Is Metadata?

Metadata includes:

Even without content, metadata can reveal intimate aspects of a person’s life, including habits, relationships, beliefs and vulnerabilities. Under the DPDP Act, such metadata constitutes personal data where it relates to an identifiable individual.

Continuous and Passive Collection

Unlike many industries, telecom and OTT platforms collect data continuously, automatically and often without active user interaction. This creates heightened scrutiny around necessity, proportionality and transparency.

Consent and Notice: Structural Challenges in Telecom and OTT

Consent as the Default Legal Basis

Under the DPDP Act, consent must be:

However, telecom and OTT services often operate on “service-essential” data processing, where refusal of consent effectively prevents service use.

Such asymmetry creates legal risk if consent is bundled across multiple purposes, users cannot meaningfully opt out and if processing exceeds operational necessity

DPDP Rules: Enhanced Notice Obligations

The DPDP Rules require platforms to clearly disclose:

Generic, global privacy policies that obscure metadata processing are unlikely to satisfy Indian regulators.

Purpose Limitation and Profiling in OTT Platforms

Content Delivery vs Behavioural Profiling

OTT platforms collect data to deliver content and improve quality of service. However, this data is frequently repurposed for:

Under the DPDP Act, such secondary use requires explicit disclosure and valid consent.

Recommendation Algorithms and Transparency

While algorithmic transparency is not explicitly mandated, opaque profiling practices increase:

Platforms must be able to demonstrate purpose limitation and proportionality.

Children’s Data on OTT and Content Platforms

Children as a Protected Category

Any user below 18 years is a child under the DPDP Act. This is particularly relevant for video streaming platforms, gaming-adjacent OTT services and educational and infotainment content.

Parental Consent and Profiling Restrictions

Processing children’s data requires verifiable parental consent and restrictions on tracking and targeted advertising. Many OTT platforms currently rely on self-declared age and generic “kids mode” toggles. These measures may be insufficient under the DPDP framework.

Telecom KYC, Retention and Surveillance

Subscriber KYC Data

Telecom operators collect extensive KYC data, often under statutory mandate. However, the DPDP Act still requires purpose-limited use, secure storage and justified retention periods. Indefinite retention “because regulations require it” may not always be defensible without clear legal backing.

Lawful Interception and Government Access

Telecom and OTT platforms operate under multiple laws permitting government access to data. While the DPDP Act contains exemptions for state functions, over-broad or poorly documented access requests can still expose platforms to:

Platforms must maintain robust internal governance around government data requests.

Third-Party Sharing and Ad-Tech Risk

OTT platforms commonly integrate advertising networks and measurement and attribution tools and content partners. Under the DPDP Act:

Data Breaches and National-Scale Impact

Mandatory Breach Notification

Under the DPDP Act and Rules, telecom and OTT platforms must notify the Data Protection Board of India and the affected users. Given the scale of user bases, breaches can rapidly become national-level incidents.

Systemic Risk and Public Trust

Breaches involving telecom metadata or OTT usage data can:

Penalties and Enforcement Exposure

Monetary Penalties

The DPDP Act empowers penalties up to INR 250 crore per contravention, assessed based on:

Telecom and OTT platforms face systemic exposure due to volume and continuity of processing.

Regulatory and Commercial Consequences

Beyond penalties, platforms may face:

Compliance Roadmap for Telecom and OTT Platforms

Conclusion: Privacy as the Price of Digital Trust

Telecom and OTT platforms are the infrastructure of modern digital life. With that role comes heightened responsibility. The DPDP Act and Rules signal that scale and indispensability do not justify unchecked data exploitation.

Platforms that embed privacy-by-design, limit profiling excesses and maintain transparent governance will be best positioned to retain user trust and regulatory confidence in India’s evolving digital ecosystem.