Despite the widespread use of targeted advertising, there are significant ethical concerns surrounding the collection, analysis, and sharing of user data. Many users may not fully understand how much of their personal information is being used for targeted advertising purposes. Moreover, there are apprehensions regarding unauthorized access to this data by third-party data brokers. These concerns highlight the importance of addressing privacy and security issues within the targeted advertising ecosystem to safeguard user privacy.

The term “liberty” as articulated in Article 21 of the Indian Constitution encompasses an individual’s right to exercise control over all aspects of their life and to enjoy personal space without undue interference. The landmark judgment in Maneka Gandhi v. Union of India expanded the scope of liberty, emphasizing the need for any restrictions on liberty to be backed by a legislative procedure that is free from arbitrariness and upholds principles of justice, fairness, and reasonableness.

In the case of K.S. Puttaswamy v. Union of India, the Supreme Court of India further solidified the right to privacy as an integral component of the right to life and personal liberty. This ruling underscored the significance of protecting individuals’ privacy rights in the digital age, emphasizing the need for robust legal frameworks to regulate the collection, storage, and utilization of personal data, particularly in contexts such as targeted advertising.

Furthermore, the recent ruling by the Court of Justice of the European Union (CJEU) regarding the Meta Group’s handling of personal data for targeted advertising under the General Data Protection Regulation (GDPR) has significant implications for the AdTech Industry, including social media companies, e-commerce platforms, and search engines. Similarly, India’s forthcoming Digital Personal Data Protection Act, 2023 (DPDP Act) will require companies engaged in targeted advertising to reassess their policies to ensure compliance with the law.

While there are differences between the DPDP Act and GDPR, they both adhere to similar principles. The CJEU’s ruling provides valuable guidance on processing personal data for targeted advertising, which will be beneficial for companies navigating this issue in India. However, the DPDP Act imposes stricter regulations on data processing compared to the GDPR, requiring companies to undergo a more rigorous evaluation process.

Unlike the GDPR, the DPDP Act does not recognize contractual necessity as a lawful ground for data processing. Consequently, platforms like Meta will need to review and update their user agreements and terms of usage in India. Additionally, while legitimate interests can justify data processing under certain circumstances in the GDPR, this ground is not permissible under the DPDP Act, necessitating companies to revise their policies and agreements accordingly.

Social media platforms and other ad-supported companies will need to modify their contracts, terms and conditions, privacy policies, and user agreements to align with the requirements of the DPDP Act. The CJEU’s ruling provides guidance for companies in India to differentiate between cases requiring explicit consent and those where consent may be implied. However, given the limited options for lawful data processing under the DPDP Act, companies will need to carefully evaluate their processing activities and prioritize obtaining explicit consent from users.

To conclude, the extensive utilization of personal data for targeted advertising purposes raises significant ethical concerns, particularly regarding the breach of individuals’ privacy rights. Instances where users receive targeted ads related to private conversations highlight the potential intrusion into users’ personal lives and the exploitation of their sensitive information for commercial gain. In light of this, it is essential to uphold the principles outlined in the KS Puttaswamy judgment, which recognizes the right to privacy as a fundamental right under Article 21 of the Indian Constitution. Additionally, the enactment of the Personal Data Protection Act, of 2023, signifies a crucial step toward safeguarding individuals’ personal data privacy in the digital age. However, ensuring effective implementation and enforcement of these legal frameworks is paramount to addressing the ethical challenges posed by targeted advertising and upholding individuals’ rights to privacy and data protection. By prioritizing transparency, user consent, and accountability in data collection and usage practices, stakeholders can mitigate the risks associated with targeted advertising while fostering trust and confidence among users in the digital ecosystem.