BEHAVIOURAL ANALYTICS FOR

TARGETED ADVERTISING IN THE LIGHT

OF INDIAN LAWS
Madhushree N
SASTRA deemed to be University, Thanjavur

ABSTRACT

In the digital era, data is the new oil. And when it comes to business, there are almost no
companies which would say ‘no’ to having access to as much personal data as possible, since
in a perfect market economy, all sellers have complete knowledge of the products they are
selling and the target consumers. Similarly, users respond better to targeted advertisements –
advertisements that reaffirm their wants or convince them to swing. But with the advent of
digital era, there also arise new digital problems. It is now possible, not only to make targeted
ads that manipulate the behaviour of users after having closely studied them after obtaining
their personal data, but it is also possible to have all kinds of personal data of a person and
sell it to other entities without the consent of the concerned person. This research paper aims
to study the actors involved, State interference, current ethical challenges in behavioural
analytics and targeted advertising and whether the new Digital Personal Data Protection Bill
is able to compensate for the preexisting lacunae in the same areas.
Keywords: Data, Advertising, Profiling, State, Privacy

Introduction
Behavioural Analytics involves the collection and analysis of data related to user behaviour.
This can include tracking how users interact with websites, apps and other digital platforms.
The objective is to gain insights into user preferences, patterns and habits. In India, data
protection laws require that organizations obtain explicit consent from uses before collecting
and processing their personal data.
Targeted Advertising leverages the insights gained from Behavioural Analytics to deliver
personalized advertisements to specific audiences. Advertisers use this approach to increase
the relevance of their ads, improving the chances of engagement and conversion. For
instance, if one uses the Meta apps on phone, one may notice that after googling a certain
item, say a blue umbrella and checking out the prices of available blue umbrellas under
Google Shopping, one begins to see ads about umbrellas and raincoats on every other site
they visit on phone or on Instagram, which is another Meta app.
Behavioural analytics and targeted advertising have become integral components of digital
marketing strategies, allowing businesses to deliver personalized content to users based on
their online behaviour.

Factors involved in targeted advertising:

1) Data, of which there are three types in this regard –

 Volunteered Data: Data which has been obtained through direct actions of
users such as publishing blogs, creating accounts, etc.

 Observed data: Data that is acquired when data collectors particularly record
and capture individual activities of users.

 Derived data: Data that can be arrived at by computing or processing the

above two kinds of data.

2) There are marketers who present offers to potential consumers and they include
political parties, retailers, device makers, telecom, travel, financial services,
hospitality industry, etc.

3) The publishers publish the content online in the form of apps, games, services, news,
etc. on online platforms which comprise:

 App stores
 E – commerce market places
 Comparison shopping and user review tools
 Search engines
 Smartphone sellers and app developers
 Social media and content sharing platforms
4) Advertising networks work in connecting publishers with specific marketers. They
give access to specific audience by aggregating relevant inventories and facilitate the
process for advertisers. Then there are platforms called advertising exchanges that
conduct automated micro auctions to sell their aggregated inventory of spaces. A pay-
per-click (PPC) pricing model offers Google services.1 Recently however, this model

1
‘Analyzing targeted advertisement in light of Indian Data Privacy Laws’(iPleaders, 21 November, 2021)
https://blog.ipleaders.in/analyzing-targeted-advertisement-in-light-of-indian-data-privacy-laws/ accessed 20th
October, 2023
 has been replaced by the real-time bidding (RTB) method where price is determined
by competitive bidding.
5) Meanwhile users end up playing the double role of being both the consumers or
targets for whose attention the marketers vie and the data subjects whose data is
mined by the marketers to nudge them towards making choices, commercial or
otherwise, in favour of, or against something.

The role of data analytics begins here where market research companies harvest and process
personal data and give the output to advertisers or other parties with an interest on the online
market, after filtering it as per the needs of advertisers so that certain people are targeted on
media or devices such as an app, Instagram, etc. Besides, they can even exhibit this in the
form of discounts or offers to people that they know are most likely to fall for such an appeal.
Konodrac, for example, is a company that provides services such as customer segmentation, e
– commerce, digital marketing and personalized recommendations.

The real challenge of the current times lies in ensuring ethical target advertising and
behavioural analytics. The advent of Machine Learning technology has blurred the ethical
lines in many cases.

Most Common types of unethical target marketing

Religious target advertising
Pandering to a person’s religious/political interests most often has the widest ramifications
due to the delicate nature of social interactions. There are scams abound, who without any
true scientific or medical merit, promise better health and often give misleading solutions to
diseases under the guise of ‘quick fix’ cures that may even endanger the life/health of the
person. These ads are looking to make money without any reward for your efforts.

Vulnerable populations
There are ethical concerns about targeting vulnerable populations, such as those with limited
digital literacy or understanding of how their data is being used. This can lead to exploitation
for financial or political gains.

Young Impressionable teens

It is estimated that teenagers spend approximately nine hours per day in front of screens,
much of which is on social media where ads are prominent.2 Teenagers are estimated to
spend. The current niche is pornography, CBD advertising and online gambling, while
smoking is encouraged amongst underage teens by tobacco industry.

2
‘Ethical Target Advertising: Where Should Marketing Draw The Line?’ (Blue Laser Digital, 3 September,
2021) https://www.bluelaserdigital.com/ethical-target-advertising/ accessed 15th October, 2023
Persons with eating disorders
Just like the misleading ‘quick fix’ ads targeting users with medical illnesses, the ads for
these products display unrealistic beauty standards as achievable – such as a flat stomach,
ripped arms, etc. and when users purchase the supplements and realize they are useless, it can
lead to eating disorders such as anorexia or bulimia.

Elderly users
The digital divide is more apparent between the young and old users. They are more gullible
than other users, since they are usually not as up to date with the nuances of electronic
transactions, and usually fall prey to fraud or phishing mails. They may also be more anxious
to make bad purchasing decisions if they think their health is at risk for not taking action. The
COVID – 19 pandemic saw an increase in such instances.

Ethnic and Racial profiling

Ethnic and racial profiling is just another form of discrimination. Meta no longer allows ads
targeting users based on the interests of their social networking activities in sensitive topics
that include race and ethnicity, health, religion, sexual orientation and political affiliation.

Political target advertising

One can’t discuss the far-reaching effects of political target advertising without mentioning
the Cambridge Analytica scandal. A British consulting firm called Cambridge Analytica
harvested the data of millions of Facebook users without their consent and used it to provide
assistance to Donald Trump and Ted Cruz in 2016 presidential elections. An informed
consent process for research was arranged in which thousands of Facebook users were told
that they would be completing a survey on payment in an app called ‘This is your digital life’
that would only be used for academic use. But what resulted was Cambridge Analytica
collecting data from not just the participants of survey but also their Facebook friends, since
Facebook allowed the app to collect this data as well.

State interference
Regarding the privacy concerns against non – State actors, the Supreme Court held,

‘The capacity of non-State actors to invade the home and privacy has also been enhanced,
technological development has facilitated journalism that is more intrusive than ever before.
Further, in this digital age, individuals are constantly generating valuable data which can be
used by non-State actors to track their moves, choices and preferences. Data is generated not
just by active sharing of information but also passively with every click on the ‘world wide
web’. (Para 587 and 588)
‘These digital footprints and extensive data can be analysed computationally to reveal
patterns, trends, and associations, especially relating to human behaviour and interactions
and hence is valuable information, this is the age of ‘Big Data’. A large number of people
would like to keep such search history private but it rarely remains private, and is collected,
sold and analysed for purposes such as targeted advertising.

‘Knowledge about a person gives power over that person. The personal data collected dis
capable of effecting representations, influence decision making processes and shaping
behaviour. It can be used as a tool to exercise control over us like the ‘Big Brother’3 state
exercised. This can have a stultifying effect on expression of dissent and difference of
opinion, which no democracy can afford.’4

The Honourable court also mentioned that the right to be forgotten must be available to all
netizens. The right to oblivion, equally called the right to be forgotten, is the right for natural
persons to have information about them deleted after a certain period of time. 5 Although not
all aspects of earlier existence can be erased, if a similar right is to be recognised, the
individual who does not want their personal data processed or stored should still have the
option to be able to delete it from the system where the personal data is irrelevant,
unnecessary, incorrect or serves no legitimate interest. Because the court also held in the
same breath that this right cannot be enforced where the data becomes absolutely necessary
for legal compliance, task carried out in public interest, scientific or historical research
purposes, etc.

Legal Position

The first case made out in favour of advertisers is the Tata Press Lt v Mahanagar Telephone
Nigam Ltd (1995)6 . The judgment was in favour of advertisers, that their freedoms were
protected under Article 19(1)(a) of the Indian Constitution and restricted only on grounds
mentioned in Article 19(2) of the Constitution. The reason was to deny the creation of a
monopoly in favour of the Government. But this only enhanced the rights of the marketers to
exploit the rights of users to listen, read and receive more freely.

Section 67 of the Information Technology Act, 2000 was inserted with the intention of
protecting users insofar as ‘lascivious’ material is concerned. But it is unclear as to what
would constitute an offence under this provision and it must be repealed for the same reason
that section 66A was repealed in Shreya Singhal v Union of India7 - for being vague and
leaving scope for misuse by police to subject innocent people to persecution by giving their
own whimsical interpretation to the provision.

Section 69(A) of the Information Technology Act, 2000 and section 5(2) of the The Indian
Telegraph Act, 1885 provide State with the power to intercept, monitor and decrypt any

3
Geoge Orwell, 1984 (first published 1949, Secker and Warburg)
4
K.S Puttaswamy v Union of India (2018) SCC OnLine SC 1642
5
Cécile de Terwangne, Internet Privacy and the Right to Be Forgotten/Right to Oblivion [2012] UDN
https://pure.unamur.be/ws/portalfiles/portal/53809058/7064.pdf
6
1995 SCC (5) 139
7
Shreya Singhal v Union of India (2015) SCC OnLine SC 248
information if it is expedient in the interest of the nation to do so, especially for protecting
international relations, sovereignty, maintaining public order, etc.

There are legislations in place but are still violated on almost every other website one can
visit. The Indecent Representation of Women (Prohibition) Act, 1986 and the Drugs and
Magic Remedies (Objectionable Advertisements) Act, 1954 are violated by advertisements
showing indecent representation of women and erotic or violent content in violation of
Young Persons (Harmful Publication) Act. The Representation of people (Amendment) Act
1996 limits advertising by political parties.

The Digital Personal Data Protection Bill

The Indian Government, after its third attempt at enacting a law covering data protection has
enacted the Digital Personal Data Protection Act 2023, which was passed in August 2023.

Data is categorized as under in the bill –

Personal data – data from which an individual can be identified like name, address etc. for
which individual consent will suffice and no data mirroring is required.

Sensitive Personal Data (SPD) – Some types of data such as financial, health, sexual
orientation, biometric, genetic, transgender status, caste, religious belief and more, which is
to be stored only in India and can be processed abroad only under certain conditions
including approval of a Data Protection Agency (DPA).

Critical Personal data – anything that the government may deem critical, such as military or
national security data which must also be stored and processed in India.

Non-Personal Data – Data fiduciaries are mandated to provide the government any non-
personal data when demanded. It is usually anonymized data such as demographic data or
traffic patterns. This is a first, since previously, only companies used this data to fund their
business model. The bill however, dilutes the provisions under the Right to Information (RTI)
Act, which has empowered citizens to access information and holds governments
accountable.

Lacunae in Digital Personal Data Protection Bill

There are however, many gaps in the act that may affect its implementation and effectiveness.
Some of them in the light of Analytics and Advertising are as follows:

1. The RTI Act includes a provision to protect privacy through Section 8(1)(j). In order
to invoke this Section to deny personal information, at least one of the following
grounds has to be proven - the information sought has no relationship to any public
activity or public interest or is such that it would cause unwarranted invasion of
privacy and the Public Information Officer is satisfied that there is no larger public
interest that justifies disclosure. The proposed Bill seeks to amend this
Section to expand its purview and exempt all personal information from the ambit of
the RTI Act.
 2. It is in conflict with the Right to privacy because it empowers the executive to draft
rules on a range of issues, the proposed Bill creates wide discretionary powers for the
Central government and thus fails to safeguard people’s right to privacy. For instance,
under Section 18, it empowers the Central government to exempt any government, or
even private sector entities, from the provisions of the Bill by merely issuing a
notification.
3. The Bill does not ensure autonomy of the Data Protection Board, the institution
responsible for enforcement of provisions of the law. Given that the government is the
biggest data repository, it was imperative that the oversight body set up under the law
be adequately independent to act on violations of the law by government entities.
4. The Bill stipulates that the Data Protection Board shall be ‘digital by design’,
including receipt and disposal of complaints. As per the latest National Family Health
Survey, only 33% of women in India have ever used the Internet. The Bill, therefore,
effectively fails millions of people who do not have meaningful access to the Internet.

Conclusion
The challenge lies in finding an adequate balance between the right to privacy of data
principles and reasonable exceptions, especially where government processing of personal
data is concerned. The DPDP Bill needs to be suitably amended and harmonised with the
provisions and objectives of the RTI Act. The Government’s powers must be more clearly
defined in all places where ‘as may be prescribed’ is inserted in the new bill to prevent
another Shreya Singhal scenario. Nobody desires for anyone else to be scrutinizing their
moods, preferences, personal conversations, psyche, etc. – for commercial exploitation;
processing the data they collect on you, all this just to send you personalized
advertisements. Ever since the pronouncement of the Puttaswamy judgement, one can only
hope not, since the judgment has cemented the base on which all privacy rights lie.