When journalism meets adtech: Where does DPDP Act draw the line?

When a journalist investigates allegations of corporate misconduct, the last person they are likely to approach for permission is the person being investigated. When a publisher collects a reader's browsing history to serve personalised advertisements, however, asking permission is rather the point.

Both activities involve processing personal data. But should both be governed by the same consent requirements?

That distinction is emerging as a central question in the debate over India's Digital Personal Data Protection (DPDP) Act, 2023, as news publishers seek clarity on whether the legislation adequately separates journalistic activity from commercial data collection, including advertising, subscription management and audience profiling.

How AI search is eating into publishers’ revenue? Read more

The debate has reached the Supreme Court, where the Digital News Publishers Association (DNPA), representing 21 news organisations, has challenged provisions of the Act and its accompanying rules. On October 27, the Court issued notice to the Centre, with the matter scheduled for further hearing on November 17.

The government maintains that the legislation does not impinge on press freedom. Publishers, however, argue that the absence of an explicit journalistic exemption creates uncertainty around investigative reporting, confidential sources and information obtained without consent.

Google redraws another line between personal context and ads. Read on

For digital publishers, the implications extend beyond newsrooms. They are also businesses that collect subscriber information, analyse audiences and monetise attention through advertising. The challenge is determining where journalism ends and commercial data processing begins.

The exemption that disappeared

Suvarna Mandal, Partner at Saikrishna & Associates, points to a significant change in the legislation's evolution.

The Personal Data Protection Bill, 2019, contemplated an exemption for processing personal data for journalistic purposes, subject to specified ethical codes. That provision did not survive into the DPDP Act enacted in 2023.

“The DPDP Act does not expressly distinguish between personal data processed for journalistic purposes and data processed by a news publisher for commercial purposes such as subscriptions, advertising or audience profiling,” Mandal says.

What the global PHP security crisis means for digital advertising. Read here

Under the current framework, personal data processing generally requires consent or must qualify under legitimate uses specified in Section 7. The Act excludes certain publicly available personal data and provides exemptions under Section 17, but neither establishes a general exemption for journalism.

This creates uncertainty for investigative reporting involving information that is not publicly available, particularly where seeking consent could compromise an investigation.

Hardeep Sachdeva, Senior Partner at AZB & Partners, argues that the law insufficiently distinguishes commercial exploitation from legitimate public-interest processing.

Investigative journalism frequently involves obtaining information without the knowledge of individuals under scrutiny, particularly in investigations concerning corporate governance, corruption, regulatory failures and conflicts of interest.

“The absence of an express statutory safeguard for bona fide journalistic activities undertaken in the public interest creates considerable legal uncertainty and risks impeding legitimate investigative reporting,” Sachdeva says.

A publisher's dilemma

For Girish Mallya, COO of Next Gen Publishing and Editor & Publisher of T3 India, distinguishing editorial and commercial activities is fundamental.

Mallya supports the DNPA's challenge, although he accepts the government's stated intention that the legislation primarily addresses commercial data processing rather than journalism. “I would take the government at face value that they don't intend to curb the editorial side of it and it's more towards the commercial side,” he says.

Nevertheless, he believes the law should explicitly protect journalistic activities, particularly given the potential difficulties surrounding whistleblowers and confidential sources. “When laws are being drafted, it needs to have specific exemption for journalistic work,” Mallya says.

His position on commercial data processing, however, is considerably less accommodating.

Drawing on his experience as a digital editor and consumer advocate, Mallya opposes tracking individuals across platforms to build behavioural profiles for targeted advertising. Users, he argues, should provide specific consent, withdraw it conveniently and request the erasure of their information.

“I personally do not like tracking, I disable all tracking; and I would want everybody to have the same courtesy,” he says.

Next Gen Publishing, according to Mallya, does not undertake commercial tracking of user activity. Its outreach is largely confined to existing subscribers and former customers. His publications also focus on product reviews and opinions rather than investigative journalism.

Nevertheless, he believes publishers should already distinguish editorial information from commercial data. Additional expenditure required to establish that separation would be justified.

“It needs to be done. It should have been done already. If there are certain costs, which are to be incurred, it is justified,” he says.

His argument highlights an important distinction: protecting journalism from potentially restrictive interpretations need not mean exempting publishers from commercial data-protection obligations.

Protecting journalism, not every publisher activity

That distinction also informs the legal solutions being proposed.

Mandal suggests a narrowly defined exemption covering the gathering, verification, preparation and publication of news, particularly reporting undertaken in the public interest.

Such a provision could provide targeted relief from consent and notice requirements where compliance would interfere with legitimate journalism, while retaining safeguards for data security and responsible handling.

“The important distinction is therefore the purpose for which personal data is processed, rather than merely the nature of the organisation undertaking such processing,” Mandal says.

A publisher could consequently receive protection when investigating corporate wrongdoing without automatically gaining an exemption for subscriber management, targeted advertising or audience profiling.

Arya Tripathy, Partner at Cyril Amarchand Mangaldas, similarly acknowledges that the absence of a journalistic exemption leaves regulatory expectations and compliance pathways uncertain, potentially increasing the burden on publishers to demonstrate lawful processing.

However, she emphasises that privacy protections cannot simply be displaced by invoking journalism.

Any exemption, Tripathy argues, should follow constitutional principles of necessity and proportionality, incorporating safeguards around data minimisation, accuracy, purpose limitation and retention.

The question is not merely whether journalism serves a public interest, but whether the potential privacy harm from processing information without consent is justified by that interest.

Tripathy also points to international cases involving outdated or inaccurate historical publications, illustrating the risks of treating journalistic records as permanently exempt from scrutiny.

Finding the middle ground

International frameworks offer possible models. Article 85 of the European Union's General Data Protection Regulation requires member states to reconcile data protection with freedom of expression, including journalism. The UK's Data Protection Act provides qualified protections for journalistic activities, while Singapore's Personal Data Protection Act permits qualifying news organisations to process personal data without consent for specified news activities.

How new e-commerce rules could reshape online advertising strategies? Read on

These are not blanket exemptions. They distinguish journalism's public-interest function from other forms of data processing.

For India, the issue is becoming more immediate, with substantive data-processing, consent and individual-rights provisions scheduled to take effect on May 13, 2027.

The Supreme Court's consideration of the DNPA challenge could help determine whether the framework provides sufficient protection or requires an explicit legislative safeguard.

For publishers, the outcome could shape both newsroom practices and commercial data governance, from handling confidential sources to managing audience information used for monetisation.

As Sachdeva puts it, “Privacy cannot become a shield for secrecy, just as press freedom cannot become a licence for indiscriminate disclosure.”

Ultimately, the question is not whether publishers should be subject to data protection laws. It is whether those laws can distinguish between investigating someone in the public interest and tracking someone in the interests of advertising revenue.