Can privacy-safe data really power Indian adtech?

The adtech (and larger) world loves an acronym, and one doing frequent rounds of late is CRC aka Clean Room Collaborations. Not the surgical kind, but the privacy-safe digital vaults where advertisers and publishers can share and analyse data without handing over the crown jewels. With India’s Digital Personal Data Protection (DPDP) Act now law and festive budgets looming, the question is whether these virtual vaults are hype, hope, or finally hitting scale.

India’s digital advertising market is expected to cross ₹728 billion in 2025, accounting for nearly half of total AdEx according to the latest Dentsu-e4m report. That kind of money comes with scrutiny, and data privacy is suddenly centre stage. The DPDP Act, which demands explicit consent, purpose limitation and stronger oversight on cross-border transfers, means brands can no longer treat consumer data as an endless buffet. It must be handled with care, or not at all.

The DPDP Act mandates explicit user consent and limits cross-border data transfers, intensifying scrutiny on digital platforms. In response, brands are adopting data clean rooms for safe audience modelling, balancing personalization with compliance and consumer trust.

Read e4m report on Ashwini Vaishnaw’s take on DPDP Act

But how real is the adoption curve? Gandharv Sachdeva, Country Head for Hybrid, admits we’re still in the early innings. “For most Indian brands and publishers, clean rooms are still new. Right now, we mostly see trials and small experiments rather than large-scale use. But things are changing quickly, there’s more focus on privacy and responsible use of data,” he says.

The optimism is that as proof points emerge, these tools will move “from testing to wider adoption in the next couple of years.” In other words: don’t rip out your Excel sheets yet.

It’s a tale of two markets. On one hand, the big boys (think Amazon Marketing Cloud, Flipkart Ads, or retail media networks from Reliance and Tata) are already operating their own walled-garden clean rooms at scale.

Read e4m story on Amazon’s exit from Google Ads

“Large platforms and retailers are already using them at scale because they sit on rich first-party data and have the resources to operationalise it,” says Vinay Tamboli, CEO of DataQuark at LS Digital. “Retail media networks are enabling brands to securely match campaign exposure with purchase data, and that’s not a pilot anymore, it’s happening live.”

On the other hand, mid-sized advertisers and publishers are still stuck in pilot purgatory. “The challenge isn’t whether the technology works — it does — but whether they have the people, processes, and budgets to make it business-as-usual,” Tamboli notes. With the DPDP Act hanging over everyone’s heads, he believes modular clean-room models “won’t be optional, they will become a must-have.”

Read e4m story on Google joining hands with Criteo

Epsilon, one of the global giants in the data space, agrees that India is at an inflection point. Lakshmana Gnanapragasam, SVP Analytics at Epsilon India, points out that clean rooms are new but powerful. “They deliver privacy-compliant, pseudonymous ID-based data that could be used for planning, activation, and measurement for paid media campaigns. They also deliver a safe space to match data provided by first-party, second-party, and third-party data partners.”

The catch? Walled-garden clean rooms limit what can be done outside their ecosystems, while independent software clean rooms are “empty containers” that brands need to populate themselves. In short, neither is a plug-and-play solution.

According to PwC’s "Voice of the Consumer 2025", 76% of Indian consumers are concerned about privacy, while 82% prioritize data protection for trusting brands, and just 16% understand the still relatively new DPDP Act’s implications. With a new GST rates-powered Indian festive season coming right on the heels of the report, and greater macro-economic factors, the need for immediacy and importance of impregnable data safeguards have never been more vital.  

Read e4m Deep Dive on DPDP Act

For Nikhil Kumar, Chief Growth Officer at mediasmart by Affle, the shift is overdue. “Advertising in India, much like the rest of the world, is moving decisively toward a privacy-compliant future,” he says.

“With consumers becoming more aware of how their data is used, and regulators strengthening frameworks around digital privacy, the industry has a collective responsibility to evolve. Privacy-safe data collaboration through clean rooms is no longer just a theoretical construct; it is a critical enabler for brands and publishers to responsibly unlock the value of their first-party data,” adds Kumar.

The roadblock is not just tech, it’s economics. Industry estimates peg the cost of setting up a functioning clean room at ₹1-4 crore depending on scale, with timelines of 6-12 months before ROI becomes visible. That’s hardly feasible for a mid-sized D2C brand struggling to justify every ad rupee. Which is why collaboration (the “C” in CRC) is essential. As Tamboli puts it, “The more meaningful the partnerships, the stronger the reach and ROI.”

ROI, of course, is the elephant in the clean room. Do these privacy-safe setups actually deliver business outcomes? Gnanapragasam insists they can. “A majority of standout and exceptional brands approach their data as an asset that can be leveraged to not only improve their marketing outcomes but also overall business outcomes,” he says. 

He argues the real test isn’t just reach but iROAS, or incremental return on ad spend. That means measuring whether campaigns are reaching the right audiences at the right frequency, and whether revenues generated are truly incremental. It’s the kind of boring-but-critical metric CFOs care about, and clean rooms are supposed to enable it.

Still, there’s no escaping the gravitational pull of the walled gardens. As Tamboli bluntly puts it, “Walled gardens will always give unmatched reach, and they’ll remain central to media strategies. What privacy-safe data collaborations bring is accountability.” In practice, clean rooms are unlikely to topple Google and Meta from their perch, but they may at least keep them honest.

Examples are starting to trickle in. L’Oréal India is experimenting with retailer and e-commerce data partnerships. FMCG companies are using clean rooms to plan promotions more precisely. Even influencer platforms are bracing for DPDP scrutiny. All roads lead to cleaner, safer data, whether brands like it or not.

That accountability matters because the DPDP Act has teeth. It empowers the Data Protection Board to fine companies up to ₹250 crore for non-compliance. It also requires companies to delete user data once the purpose is met, a nightmare for marketers used to hoarding. “Privacy-safe ways of working together give advertisers more options beyond [walled gardens],” says Sachdeva. “They help brands connect with people in a safe way, build trust, and make campaigns more meaningful.”

So where does that leave the Indian adtech ecosystem? Somewhere between hope and hype. Clean rooms aren’t yet the default plumbing, but they’re no longer science projects either. The DPDP Act has effectively turned them from optional add-ons into necessary infrastructure. Big players are racing ahead, mid-sized ones are tinkering, and everyone is trying to figure out how to pay for it.

The irony, of course, is that while clean rooms are designed to protect consumer privacy, the average Indian internet user may never know they exist. What they will notice is whether their data stops being misused, whether irrelevant ads stop following them around, and whether trust in digital advertising inches up from rock bottom. If clean rooms can deliver that, they’ll have earned their buzzword status. If not, they’ll just be another acronym in the adtech alphabet soup.