#e4mXplains:  DPDP Act: Indian advertising bids goodbye to the Wild West

It has often been said that digital advertising in India resembles the Wild West of the American frontier. A place where everything was allowed because nothing had been defined yet. That was the charm and the dysfunction of it: no rules, no maps, no real authority. Just a lot of ambition, a lot of noise, and a lot of people pretending the chaos was a strategy. 

The Wild West was an ecosystem built on improvisation, stitched together by hacks and workarounds that somehow passed for innovation. It shouldn’t have worked, but it did, only because nobody was powerful enough to demand that it work properly.

Also read: DPDP Act 2025: Penalties for violations can reach Rs 250 crore

MeitY activates India’s first data protection law with release of final DPDP rules

Then came the railways. And everything changed.

The railways have just come to Indian advertising. And even before the tracks are laid, the conductors are already being appointed. That’s the part people forget. Infrastructure doesn’t start with steel; it starts with the people trusted to run it. Remember that. 

When a system moves from chaos to order, the first signs are never the regulations themselves but the faces placed in charge of interpreting them. Once those faces are picked, the map starts to redraw itself long before the first sleeper hits the ground.

Which brings us to the real question. Who laid the railways in the first place? Who actually could? And why that matters now.

India’s Digital Personal Data Protection (DPDP) Act arrives with the right language. It talks about user rights, consent, transparency, grievance redressal, and accountability. On the surface, it reads like a long overdue clean-up. And maybe some of it is. People should have more control over their data. Companies should be forced to behave. Platforms should stop treating privacy as a design flaw. 

But laws are never defined by the lines in the statute. They are defined by the incentives that outlive the statute. Every right the user gains can be neutralised with a single exemption. Every compliance expectation can be interpreted in more than one way. Every enforcement action depends on who is making the decision and why.

This is not about good intentions or bad ones. It is about structure.

DPDP, intentionally or not, raises the cost of existing on the open internet. It demands consent that is verifiable, revocable and traceable. It demands deletion processes that actually work. It demands data hygiene, documentation, audits, breach protocols and grievance handling that can withstand scrutiny. 

All of this sounds sensible when you’re writing a policy note. It becomes something else when you try to implement it with a small engineering team and a burn rate measured in weeks. 

Big Tech can do it. Jio can do it. Amazon can do it. Google will do it before breakfast. A mid-sized DSP in Bengaluru cannot. A retargeting startup running on wafer-thin margins cannot. A measurement company that relies on third-party signals cannot. Compliance is not a principle. It is an expense. And like most expenses, it sorts the giants from the hopefuls.

None of this requires malice. It only requires gravity. When you introduce heavy infrastructure into a system built on cheap interoperability, you tilt the floor. The players who were already large enough to stand upright barely notice the shift. Everyone else slides to the margins. 

The open web was already struggling in a mobile first world dominated by walled gardens and logged-in identity. DPDP doesn’t kill it outright. It just asks it to carry a weight it was never designed to bear. And once the weight becomes part of the terrain, you don’t have to outlaw smaller players. They quietly age out of the market on their own.

This is where the robber barons enter the story.

In the American West, nobody set out to build oligarchs. They set out to build railways. But railways require capital, coordination and political blessing. Only a handful of men could afford the steel, the land rights, the labour, the locomotives and the operating networks. Once the tracks were built, the same men became indispensable. The state needed them more than they needed the state. 

That is the whole point. 

Infrastructure produces dependence, and dependence produces power. That power is rarely loud. It doesn’t need to be. It sits quietly in the background, deciding which towns get connected and which wither into footnotes.

India isn’t repeating the American frontier, because we will name no names here. But the underlying mechanics are uncannily similar. The Wild West phase of Indian advertising is closing. The rails are being laid through compliance, consent frameworks, identity systems, first-party dominance, retail media empires and a regulator whose interpretations will matter far more than the text of the law. 

And the question is not whether the regulator is good or bad. It is who the regulator answers to. Appointments decide enforcement. Enforcement decides incentives. Incentives decide the market. Everything downstream follows from that.

This is where the weariness sets in. Not the dramatic kind. Just the quiet understanding that systems behave in predictable ways once the right pressures are applied. 

DPDP gives users rights. That is good. DPDP creates order. That is necessary. DPDP also makes the cost of staying competitive high enough that only companies with vast infrastructure and identity ecosystems can truly thrive. 

That part is inevitable. Google, Meta, Amazon and Jio are not villains in this story. They are simply the only entities with pockets deep enough to play by the new rules. When compliance becomes the moat, capital becomes the oxygen. And the companies that have both tend to win by default.

There’s a strange comfort in structural inevitability. You stop looking for heroes and villains. You stop expecting fairness. You start paying attention to who can lay track and who can’t. The advertising ecosystem that emerges from DPDP will be cleaner, more compliant, maybe even more respectful of user rights. But it will also be narrower. 

And if you work in adtech, you will feel that narrowing long before the public does. The big players will absorb the shocks and carry on. Smaller companies will fold, pivot or consolidate. Publishers who once relied on programmatic will drift closer to walled gardens. Retail media will tighten its grip. The open internet will feel a little less open with every quarter.

None of this is necessarily good or bad. It is simply where the rails lead.

We can debate whether this is what policymakers intended. We can debate whether the trade-off is worth it. But the Wild West is gone. The frontier is closed. The tracks are coming. And once they’re here, the people who can afford to run the trains will decide where the rest of us get to go.

That is the story.
Everything else is detail.