IAB Tech Lab launches working group to revamp global advertising standards in light of India's DPDPA

On August 11, 2023, India implemented the Digital Personal Data Protection Act (DPDPA), ushering in a new era of data protection. The law is expected to have a significant impact on digital advertising. While brands and agencies work together to understand how they need to comply with the new legislation, the IAB Legal Affairs Council is set to launch a dedicated working group under the Cross Jurisdiction Privacy Project (CJPP) – India to update the DPDPA 2023-specific details. 

The India chapter will comprise IAB, IAB Tech Lab, and IAB Southeast Asia and India teams. In February, it commences a collaborative process, seeking unanimous consent before final publication. It has invited all members, particularly policy teams, for collaborative input on understanding and interpreting Indian law for the Global Privacy Platform (GPP). 

Shailley Singh, executive vice president, product and chief operating officer, IAB Tech Lab, says, the formation of an Indian chapter has become necessary with the change in the Indian digital laws. 

“This chapter will address the impact on the framework, creating specific elements for India to be integrated into the GPP, ensuring uniform functionality worldwide. The challenge is to align the consent management framework with the global standard,” says Singh.

The GPP is also an outcome of this, ensuring global players operate seamlessly across different regulatory landscapes, incorporating rules from the General Data Protection Regulation (GDPR) and other sources. 

IAB Tech Lab’s global members, including industry giants like Google and The Trade Desk (TTD), automatically become part of this technical and policy working group. However, its goal is to encourage participation from India-specific companies, including brands and indigenous ad tech providers like ESPs or those with proprietary ad stacks, such as The Times of India. 

“Our approach involves active engagement with our member community and not isolated decision-making. This process ensures a thorough collaboration, incorporating diverse perspectives and legal interpretations. We invite all entities in the advertising realm—publishers, agencies, brands, and Indian ad tech companies—to actively engage in this initiative,” says Singh.

CJPP serves as a concise summary of digital advertising laws in various jurisdictions, such as Europe, Brazil, and the US. It has been created after a detailed policy analysis based on local laws, like India's DPDPA, in collaboration with local IABs in Europe and the US and now the collaboration will extend to IAB Southeast Asia.

The forthcoming CJPP – India chapter is expected to provide global enterprises and local professionals with insights into the application of India's new privacy law within the digital advertising sector. Its primary objectives include the creation of an updated CJPP – India chapter and the provision of legal inputs to enhance the IAB Tech Lab’s Global Privacy Platform (GPP) technical specification, incorporating a dedicated section addressing the implications of the DPDPA. 

Michael Hahn, EVP & general counsel, IAB Tech Lab, says the legal changes necessitate a revision of our chapter in the CJPP compendium, aligning it with the current law. 

“Collaborating with IAB Southeast Asia and India, our objective is to offer the market an initial understanding of how the new Privacy Law applies to the digital ad industry. Drawing on our expertise in understanding data flows, we aim to provide an in-depth analysis, building on our prior work in 11 jurisdictions. Given the timing, this analysis stands as one of the earliest post-law implementation publications,” he says.

Michael Hahn, EVP & general counsel, IAB Tech LabThe DPDPA elevates privacy standards in the jurisdiction, emphasising the need to rethink communication of consumer privacy preferences in the digital ad ecosystem. To establish accountability, it intends to enhance the legal inputs for the GPP technical specification. This will facilitate seamless connectivity among publishers, ad tech intermediaries, and advertisers, ensuring the passage of consumer privacy preferences in accordance with local law.

“Previously, we adhered to an international framework, but now, with the need to adapt to India's laws, adjustments are required. The GPP includes a general header for ad origin and consent details, with specific sections for each jurisdiction. A dedicated section for India will be added, ensuring accurate decoding of user permissions from the numerical string when impressions are served in India,” Singh adds.

The legal inputs for the India segment of the IAB Tech Lab’s GPP technical specification are expected to empower industry participants to transmit signals regarding the lawful handling of consumer personal information. This information can then be employed to integrate assurances and guarantees related to these signals into contractual agreements. Ultimately, this process is expected to lay the groundwork for a technical framework that ensures compliance within the market.

Following CJPP and policy formulation, IAB Tech Lab will encode the outcomes into a transparency and consent string. This string encapsulates user permissions, such as data selling or behavioural advertising. Users select their allowed purposes, and this encoded string is sent with the ad request, informing responders of permissible advertising and data usage.

For Hahn, the CJPP has been one of his most significant endeavours. He says the project is aimed at streamlining legal understanding and communication in the complex landscape of global digital advertising. 

“The genesis was a practical problem - the disconnect between Chief Privacy Officers of global companies based in the US and local lawyers engaged overseas. It aimed to bridge this gap by analysing privacy laws within the digital ad use case, addressing concerns around identity, personal information, and data storage. Establishing working groups over a year, we navigated complexities across 11 global jurisdictions,” he says. 

IAB Tech Lab’s role is to serve as the inclusive hub in the digital ad industry, representing both large and small inventory sellers, publishers, advertisers, agencies, and various adTech intermediaries.