DPDP consent flow — ChatGPT Ads India glossary
A DPDP consent flow is what turns a ChatGPT Ads lead capture from a data-protection liability into a lawful, documented data collection event under India's DPDP Act 2023.
Definition
In plain English: a DPDP consent flow is the moment on a landing page, or inside a form, where a healthcare advertiser tells a user exactly what personal data it's collecting and why, and gets a clear yes before collecting anything. It has to happen before the data is captured, not as a footnote after.
Technically, under the Digital Personal Data Protection Act 2023, any entity processing personal data as a data fiduciary must obtain consent that is free, specific, informed, unconditional, and unambiguous, accompanied by a notice describing the purpose of processing and the categories of data collected. Consent must be as easy to withdraw as it was to give. Health-related data carries no separate "sensitive category" tier under DPDP the way some other jurisdictions define it, but healthcare advertisers still carry heightened practical exposure because the data collected is inherently more identifying and more consequential if mishandled.
Why it matters for Indian healthcare marketers
ChatGPT Ads changes where and how data gets captured, and that changes what a DPDP-compliant consent flow needs to cover. A traditional lead form has clearly bounded fields — name, phone, city — each one an obvious consent point. A ChatGPT Ads conversation can capture the same information implicitly, through what a user types in free text before ever reaching a structured form: "I'm a 34-year-old looking for an IVF consultation in Pune" volunteers age, intent, and location inside a sentence, not a field. A consent flow designed only for form-field capture misses this — the personal data has already been processed the moment the conversation happened, whether or not a form was ever submitted.
This matters more for healthcare than most verticals because the downstream data — appointment intent, condition-adjacent language, treatment-seeking behaviour — is exactly the kind of information a user would reasonably expect to be handled carefully, and DPDP's enforcement mechanism (the Data Protection Board of India) has explicit authority to levy penalties scaled to the severity of a breach, with no cap that makes non-compliance a rounding error for a mid-sized healthcare brand. A citation-linked landing page that collects data without a proper consent notice is a DPDP violation independent of anything that happened inside the ChatGPT conversation itself — the two need separate, coordinated compliance treatment.
Because attribution in ChatGPT Ads runs on conversation-completion events rather than clicks, marketers have a structural incentive to capture as much of the user's stated intent and detail as possible to prove journey completion — which is precisely the incentive DPDP's data-minimisation principle exists to check. Chasing richer attribution data without a matching consent flow is the fastest way to turn a growth channel into a regulatory liability.
How ICG uses/measures/handles it in a live engagement
Every landing page a ChatGPT Ads citation routes to carries a purpose-specific consent notice, placed before any data field and written in plain language naming exactly what is collected, why, and how long it is retained. ICG applies data minimisation to every form and follow-up capture point — collecting only what the stated purpose (booking a consultation, sending a callback) actually requires, not every field a CRM could theoretically use. Consent capture is timestamped and logged separately from the lead record itself, so a withdrawal request can be honoured without deleting the underlying business record improperly.
ICG treats conversational data capture as a distinct consent surface from the landing-page form — for clients where the ChatGPT conversation itself might surface identifying detail before a user reaches a form, the citation and response copy are written to prompt the user toward the consented landing-page flow rather than continuing to volunteer personal detail inside the open conversation. This is reviewed as part of the monthly compliance overlay pass alongside NMC, ASCI, and UCPMP checks.
Consent logs and notice-version history are retained for the DPDP-relevant period and made available to clients on request, so that if the Data Protection Board or an individual data principal raises a query, the client has a documented, timestamped consent trail rather than having to reconstruct one after the fact.
Related terms
Frequently asked questions
What is a DPDP consent flow?
It is the disclosure-then-opt-in sequence used before a healthcare ad or landing page collects personal data — stating what data is collected, why, and for how long, then capturing an explicit, specific, and freely-given consent before any data is stored or processed.
Does DPDP 2023 apply to conversations happening inside ChatGPT Ads?
Yes. Any Indian healthcare advertiser whose ChatGPT Ads landing page or follow-up form collects a name, phone number, or health-related detail is a data fiduciary under DPDP 2023, regardless of the platform the conversation happened on.
Why is DPDP consent harder to manage on a conversational ad format?
Because a conversation can capture personal details implicitly through what a user types, not just through a form field — meaning consent has to be designed for language-based data capture, not only structured input boxes.
How does ICG build DPDP-compliant consent flows for ChatGPT Ads landing pages?
Every landing page a ChatGPT Ads citation routes to carries a purpose-specific consent notice before any data field, uses data minimisation to collect only what the stated purpose requires, and logs consent capture with a timestamp for the DPDP-mandated retention period.
Build a DPDP-clean consent flow for your ChatGPT Ads leads.
ICG designs purpose-specific consent notices for every ChatGPT Ads landing page before launch.
