The One Carve-Out Written For You.
Social media intermediaries are a named Third Schedule class. They are also the beneficiary of the Act's most consequential exclusion - and its illustration is about a blogger posting to social media.
Covers: social networks, content platforms, community apps, creator platforms.
Why this sector is treated differently
Section 3 sets the Act's territorial and material scope, and clause (c)(ii) takes out of it personal data that a Data Principal makes publicly available herself. The illustration is unusually direct: X, an individual, while blogging her views, has publicly made available her personal data on social media; in such case the provisions of the Act shall not apply.
This matters enormously and it is routinely over-read. What falls outside the Act is the personal data the Data Principal herself made public. It is not a general exemption for platforms, and it does not reach the account data, the device and behavioural data, the private messages, or the inferences the platform derives - none of which the user published. A platform's obligations under Chapters II and III are largely untouched. What the carve-out does resolve is the awkward question of whether a public post is itself regulated personal data, and the answer is no.
Alongside that sits the Third Schedule, which names social media intermediaries at two crore registered users in India with the same three-year erasure clock as e-commerce, and section 9, which prohibits behavioural monitoring of and targeted advertising to anyone under eighteen. For a platform whose ranking and advertising systems are built on behavioural signal, section 9(3) is the provision with real product consequences.
What you actually process
One row per activity, not per data type. Lawful basis and erasure attach to a purpose, so the same phone number can sit in three rows below with three different answers.
| Activity | Lawful basis | When it must go |
|---|---|---|
| Publish what a user postsPost text and media, Profile shown alongside it, Audience setting | § 3Section 3(c)(ii) puts personal data the Data Principal makes publicly available herself outside the Act entirely. The illustration is a blogger posting to social media. It is narrow: it covers what she published, not what you observed about her. | § 3The published content is outside the Act. Everything around it follows section 8(7) as normal. |
| Rank the feedDwell time, Taps and scrolls, Follow graph, Inferred interests | § 9(3)Ranking on engagement is behavioural monitoring by any ordinary reading. For anyone under eighteen the Act prohibits it outright rather than gating it behind consent. | § 8(7)Behavioural signals serve a purpose that ends; set a period against that purpose. |
| Serve advertisingInferred interests, Advertising identifiers, Engagement history | § 9(3)Targeted advertising directed at children is prohibited. For adults, consent under section 6 applies and must be specific enough to cover the profiling involved. | § 8(7)Erase on withdrawal and cause processors and downstream bidders to do the same. |
| Hold a lapsed accountProfile, Posts, Message history, Behavioural history | § 8(7)Once no purpose is served there is no basis to keep holding it. The Third Schedule adds a three-year clock at two crore registered users. | Third ScheduleThree years after last approach or exercise of a right, at two crore or more registered users in India. |
The data flow, and where it breaks
Each lane follows one activity through the actors and systems that touch the data. The failure mode sits on the hop where it happens, rather than in a list somewhere else on the page.
Publish what a user posts
Show the user's own content to the audience she chose
- ComposerTakes the post and its audience setting§ 3Fails when: Public and private posts handled by one code path, so the carve-out is applied to both
- Content storeHolds the post§ 3Fails when: The whole record treated as out of scope because part of it was published
- DistributionServes it to the chosen audienceFails when: Audience setting changed later without the earlier distribution being reconsidered
Rank the feed
Decide what each user sees and in what order
- ClientEmits engagement signals§ 9(3)Fails when: The same signals emitted whether the account belongs to an adult or a fifteen-year-old
- Ranking serviceBuilds a per-user behavioural profile§ 9(3)Fails when: For a child this is behavioural monitoring, and no consent makes it lawful
- Model trainingLearns from aggregated behaviourFails when: Child behaviour already inside a trained model, which is far harder to unwind than a database row
Serve advertising
Monetise attention
- Ad targetingSelects an audience segment§ 9(3)Fails when: A segment that a child's account can fall into
- Ad exchangeAuctions the impression§ 8(2)Fails when: Data shared with bidders under no processing contract
- MeasurementAttributes the outcome back to the userFails when: Attribution rebuilding the behavioural profile the ranking controls were meant to prevent
Hold a lapsed account
None, once the user stops returning
- Account storeRetains indefinitely by defaultThird ScheduleFails when: Passive impressions counted as approach, so the clock never starts
- Erasure jobComputes the due date and erasesrule 8(1)Fails when: Published content and observed data erased together, or neither
- Notice jobWarns before the period completesrule 8(2)Fails when: Sent to an email the user abandoned with the account
The provisions that apply
Data the user made public herself
The Act does not apply to personal data that the Data Principal makes publicly available herself, or that another person is under a legal obligation to make public. The illustration is a blogger publishing her views on social media. The exclusion is about the act of publication by the Data Principal - not about the platform, and not about everything the platform holds on her.
Two crore registered users
Rule 8(1) names social media intermediaries alongside e-commerce entities at two crore or more registered users in India. Personal data must be erased three years after the Data Principal last approached the platform or exercised a right, with forty-eight hours' notice beforehand, unless retention is required by law.
No behavioural monitoring of minors
Tracking, behavioural monitoring of children and targeted advertising directed at children are prohibited outright, with no consent override. Under the Act a child is anyone under eighteen. A feed ranked on engagement telemetry is doing behavioural monitoring, whatever it is called internally.
You are a likely Significant Data Fiduciary
The Central Government may notify a Data Fiduciary as Significant having regard to the volume and sensitivity of personal data processed and the risk to Data Principals' rights, among other factors. A platform at Third Schedule scale is squarely within the profile, which brings a Data Protection Officer in India, independent audit and Data Protection Impact Assessments.
What to do about it
Draw the line around the carve-out precisely
Classify what a user published herself and treat only that as out of scope. Account metadata, engagement telemetry, device signals, private messages and derived inferences stay in scope. A blanket "public platform, therefore exempt" reading is the failure mode here, and it is not what section 3(c)(ii) says.
Test whether your ranking counts as behavioural monitoring
For under-eighteens the question is not consent, it is permissibility. Establish what signals a minor's session may generate at all, and confirm your recommendation and advertising systems can operate without them rather than assuming a flag downstream will do.
Prepare for the Significant Data Fiduciary designation
The DPO, the independent auditor and the DPIA cadence take months to stand up and cannot be produced on notification. Building them before designation also produces the evidence that the designation was handled competently.
Instrument last approach for the erasure clock
Three years from last approach or exercise of a right is computable only if you record those events. Passive impressions are not an approach; establish which interactions reset the clock and log them deliberately.
Sequence the work
The same controls as above, in the order they are worth doing. Each names the evidence you would put in front of an auditor, because a control you cannot evidence is a control you cannot prove you had.
Build the foundation
Get the lawful basis and the roles right. Everything else assumes these are settled.
- Publish what a user postsClassify the published content separately from everything else you hold. Account metadata, engagement signals, private messages and inferences stay fully in scope.Evidence: A data map that draws the line explicitly, and shows which stores sit on which side of it.
Operationalise it
Turn the basis into systems that run without anyone remembering to run them.
- Rank the feedEstablish what a minor's session may emit at all, and confirm the ranking and recommendation systems still function without it rather than assuming a downstream flag is sufficient.Evidence: A signal inventory per age band, and evidence that child sessions are excluded from behavioural model training.
- Serve advertisingContextual-only inventory for under-eighteen accounts, enforced at the exchange boundary rather than in your own stack alone.Evidence: Exchange configuration per age band, and a bid-request sample showing no behavioural attributes for child accounts.
- Hold a lapsed accountDefine which interactions count as approach and log them deliberately. A passive impression is not the user approaching you.Evidence: The definition of approach under version control, plus erasure job logs.
Section and Schedule references above point at the statute itself. Read them in context in the full text of the Act, or against the MeitY publication. This is an educational summary, not legal advice for your organisation.
Social media: common questions
Does the DPDP Act apply to public posts?
Not to the personal data the Data Principal made public herself - section 3(c)(ii) excludes it, and the illustration is a blogger posting to social media. It is a narrow exclusion. Everything else the platform holds about that user, including data about how she behaves on the service, remains fully in scope.
Is a social media intermediary automatically a Significant Data Fiduciary?
No. The designation is made by the Central Government under section 10, having regard to factors including the volume and sensitivity of personal data processed and the risk to the rights of Data Principals. Scale makes it likely, not automatic, and the obligations attach on notification.
How does the Act interact with the IT Rules for intermediaries?
Section 38(1) provides that the Act is in addition to and not in derogation of any other law in force. Intermediary obligations under the Information Technology Act and its rules continue to apply on their own terms. Where both bite, you satisfy both; the DPDP Act does not displace them.
Know this well enough to prove it
The certification is a free, graded 15-question exam covering the Act end to end, not just this sector. Pass mark is 70%.
DPDP Academy Editorial: Legal education and implementation guidance. DPDP Academy Source Review: Primary-source verification against Gazette and MeitY publications; last checked 9 August 2026 against Social media implementation guide. Educational information, not legal advice.