Generative AI in Ads: India's Regulatory Gap
Updated: 07 Jul 2026 · For: AI and infrastructure founders shipping in India
What changed
The increasing use of generative AI in advertising has reached a watershed moment, with significant stakes for founders, DPOs, and GCs. The lack of clear regulations in India has created a gap that needs to be addressed to ensure compliance with global standards. This piece explores the regulatory gap in generative AI advertising in India, highlighting the need for practical actions to be taken by AI and infrastructure founders shipping in India. It will examine the current state of regulations, the potential risks and consequences of non-compliance, and provide guidance on best practices to adopt.
What the law is (plain English)
The Digital Personal Data Protection Act, 2023 (DPDP Act) is the primary legislation governing data protection in India. While the Act provides a framework for data protection, it does not specifically address the use of generative AI in advertising. The Indian Contract Act, 1872 may also be relevant in cases where contracts are entered into for the use of generative AI in advertising. The DPDP Act emphasizes the importance of obtaining valid consent from individuals before collecting, processing, or sharing their personal data. However, the Act does not provide clear guidance on how to obtain consent for the use of generative AI in advertising. As a result, founders, DPOs, and GCs must navigate this regulatory gap to ensure compliance with the Act and avoid potential penalties. The lack of clear regulations on generative AI in advertising also raises questions about the application of the DPDP Act to this specific use case. Further guidance from regulatory authorities is needed to provide clarity on the requirements for compliance.
What it means in practice
The use of generative AI in advertising in India is a rapidly evolving area that requires careful consideration of the regulatory gap and potential risks. By adopting best practices, such as conducting a data inventory, developing a consent framework, and implementing robust security measures, founders, DPOs, and GCs can help ensure compliance with the DPDP Act and avoid potential penalties. Further guidance from regulatory authorities is needed to provide clarity on the requirements for compliance and to support the development of this innovative technology.
What founders should do this week
- **Conduct a Data Inventory**: Identify all personal data collected, processed, or shared through the use of generative AI in advertising
- **Develop a Consent Framework**: Establish a clear and transparent consent process for the collection, processing, and sharing of personal data
- **Implement Robust Security Measures**: Ensure the security and integrity of personal data through the implementation of robust security measures
- **Provide Transparency and Choice**: Provide individuals with transparency and choice regarding the use of their personal data in generative AI advertising
- **Monitor and Update Policies**: Regularly monitor and update policies and procedures to ensure compliance with changing regulations and best practices
What can wait
- Policy rewrites that do not affect live product behaviour
- Board-level strategy shifts until applicability is confirmed
When to call counsel
- The update touches licensing, personal data at scale, or payment flows
- A customer or investor asks for a formal legal opinion on impact
- You have an inspection, transaction, or funding close inside 30 days
Founder FAQ
What is the current state of regulations on generative AI in advertising in India?
The current state of regulations on generative AI in advertising in India is unclear, with a lack of specific guidance on compliance with the DPDP Act.
What are the potential risks and consequences of non-compliance with the DPDP Act?
The potential risks and consequences of non-compliance with the DPDP Act include penalties, reputational damage, and loss of customer trust.
How can founders, DPOs, and GCs ensure compliance with the DPDP Act when using generative AI in advertising?
Founders, DPOs, and GCs can ensure compliance with the DPDP Act by adopting best practices, such as conducting a data inventory, developing a consent framework, and implementing robust security measures.
SB Tech Associates: General information only — not legal advice. Verify the official notification and obtain counsel for your facts before acting.
Source: Official source →
Topics: Generative AI, Advertising Regulations, India's Regulatory Gap, Global Standards, AI and Infrastructure Founders, Digital Personal Data Protection Act
This publication is for general information only and does not constitute legal advice. Regulatory positions evolve; verify current notifications and obtain counsel before acting. © 2026 SB Tech Associates.