DPDP for Social Media Intermediaries

Does a large social media platform have to delete my data if I stop using it?

If it has at least two crore registered users in India, yes. It has to delete three years after whichever came last: your last interaction, the last time you exercised a right, or the day the Rules commenced. Anything a law requires it to keep still stays, and keeping your account reachable, or a stored token, is carved out.

ACT + RULES · Section 8(7); Rule 8(1), Third Schedule item 3.

Can a social media platform show me targeted ads if I am a child?

No. Advertising aimed at children is banned outright, and so is tracking or behavioural monitoring of them. The narrow exceptions in the Rules cover things like education, health and safety. Ordinary advertising is not one of them.

ACT + RULES · Section 9(3); Fourth Schedule.

Can the platform keep my posts, messages and profile after I delete the account?

The test is whether the reason for holding it is still being served. Deleting the account is strong evidence that it is not, though it is not the legal test by itself.

Keeping it after that works only while a law requires it, or while some other stated reason genuinely remains.

ACT · Section 8(7).

Can they use my data to target ads to my contacts or look alike audiences?

Using your information to reach other people, or to build an audience that resembles you, is a further purpose. It needs its own reason, and normally that means you agreeing to it specifically.

ACT · Section 6.

Can the platform share my data with advertisers or third party apps?

Only with a reason of its own. Having an account does not authorise handing your details to advertisers, data brokers or outside apps for their purposes. Where a company is working for the platform instead, the platform needs a proper contract with it.

You also have a way to find out rather than guess. You can ask the platform to tell you every other company it has shared your personal data with, and what it shared.

ACT · Sections 6, 8(2) and 11(1)(b).

A friend posted my photo without asking. Can I use this law against them?

Against your friend, no. This law does not apply to a person handling personal data for a purely personal or domestic purpose, and an individual posting on their own account is normally exactly that.

The platform is a different matter, because it is running a service rather than acting personally. In practice your route is the platform's own reporting and grievance process, and other laws deal with content that is unlawful in itself.

It is a real limit of this Act, and worth knowing before somebody tells you otherwise.

ACT · Section 3(c)(i).

I made my profile public myself. Is that information still protected?

Largely not, and this surprises people. The law does not apply to personal data that you yourself made, or caused to be made, publicly available.

So what you chose to publish sits outside it. That is a deliberate choice in the drafting rather than an oversight.

What you did not publish is unaffected. Your messages, what the platform works out about you, and everything it collects behind the scenes are all still inside the law.

ACT · Section 3(c)(ii)(A).

Your profile is public, so the Act does not apply to you.

The Act steps back only from what you yourself made publicly available. It does not step back from everything else the platform holds about you: your contact details, how you behave on the service, what it works out about you, and your private messages are all still inside the law.

You agreed to our terms, so you agreed to look alike and third party ad targeting.

Agreement has to be specific. Using your information to build audiences, or to reach other people, is a further purpose and it needs its own reason.

If a teenager says she is an adult, targeted ads are her responsibility.

The duty sits on the platform, not on the teenager. The Rules contemplate the platform actually checking that a user is not a child, with real diligence behind it, which only makes sense if the checking happens.