India's platform regulation has entered a delicate phase. The Digital Personal Data Protection Act, 2023 sits in operational limbo nearly three years after Parliament passed it. The Competition Commission of India is advancing an ex-ante digital competition framework that would impose Europe-style obligations on a new class of "Systemically Significant Digital Enterprises." The long-promised Digital India Act, intended to replace the two-decade-old Information Technology Act, 2000, remains in consultation. Each thread, taken alone, raises legitimate policy questions. Taken together, they risk producing a regulatory stack that is more confusing than coherent.
The DPDP Implementation Gap
The DPDP Act was a milestone — India's first horizontal privacy law, designed in the wake of the Supreme Court's 2017 Puttaswamy judgment recognising privacy as a fundamental right. Yet more than a year after the Ministry of Electronics and Information Technology (MeitY) released draft Rules in January 2025, the Act's notice, consent, and grievance machinery is not fully operational. The Data Protection Board exists in skeletal form; cross-border transfer mechanics under Section 16 remain unspecified; and obligations on "Significant Data Fiduciaries" are still being scoped through executive notification.
For platforms, this gap is not academic. A startup processing pediatric health data does not know with certainty when verifiable parental consent obligations bite, what constitutes "reasonable security safeguards," or how cross-border transfers to a US-headquartered cloud provider will be treated when the transfer rules are finalised. This uncertainty disproportionately burdens smaller firms, which cannot absorb compliance ambiguity the way well-resourced incumbents can.
The Ex-Ante Competition Question
The Committee on Digital Competition Law's draft Digital Competition Bill, released for public consultation in March 2024, would designate a small number of platforms as Systemically Significant Digital Enterprises based on quantitative turnover and user thresholds, and impose ex-ante obligations modelled loosely on the EU Digital Markets Act. These include prohibitions on self-preferencing, restrictions on cross-service combination of personal data, and mandatory interoperability duties.
The intent is defensible: India's digital economy has seen genuine concentration in app distribution, payments, and ad-tech. But the EU's own DMA experience offers a cautionary lesson. Two years after compliance obligations took effect in March 2024, multiple designated gatekeepers face open non-compliance proceedings, and independent assessments — including from the Centre on Regulation in Europe (CERRE) — have flagged measurable product friction on sideloading and default-search flows, with mixed evidence of pro-competitive benefit. India should adopt the DMA's diagnostic energy without inheriting its prescriptiveness.
The most defensible regulatory architecture is one that intervenes where market failure is demonstrable, not one that presumes the failure and asks platforms to disprove it.
Lessons from the IT Rules Litigation
India's recent regulatory record shows what happens when proportionality is set aside. The 2023 amendment to the Information Technology (Intermediary Guidelines) Rules, which created a government-empanelled Fact Check Unit empowered to flag content about the central government as "fake," was struck down by the Bombay High Court in Kunal Kamra v. Union of India in September 2024 as violating Articles 14 and 19(1)(a) of the Constitution. The traceability requirement under Rule 4(2) of the IT Rules 2021, challenged by WhatsApp before the Karnataka and Delhi High Courts, remains in extended litigation precisely because it asks intermediaries to break end-to-end encryption in service of a duty whose necessity and proportionality have not been established on the record.
These outcomes are not anti-regulation; they are pro-rule-of-law. They suggest that platform rules drafted without adequate consultation, or that bypass the standards laid down in Shreya Singhal v. Union of India (2015) for content restriction, will be unwound — at significant cost to both regulatory credibility and to platforms that invested in compliance.
What a Pro-Innovation Path Looks Like
A proportionate platform regime for India would do four things differently:
- Sequence over stacking. Operationalise DPDP fully — Rules, Board, transfer regime — before layering a Digital India Act and a Digital Competition Bill on top. Compliance bandwidth, especially for Indian SaaS and consumer startups, is finite.
- Tiered obligations by demonstrable risk. Use objective thresholds to distinguish a 50-person fintech from a vertically integrated platform with hundreds of millions of users. The DPDP framework's "Significant Data Fiduciary" designation is the right instinct; it should be applied consistently across statutes.
- Default to ex-post enforcement. The Competition Act, 2002 already empowers the CCI to address abuse of dominance. Ex-ante rules should be reserved for harms that ex-post remedies provably cannot reach.
- Codify procedural safeguards on takedowns. Section 69A blocking orders should require reasoned, written, and publishable rationales, consistent with the Supreme Court's directions in Shreya Singhal. Transparency is not a constraint on enforcement; it is what makes enforcement legitimate.
The Stakes
India's digital sector accounts for roughly a tenth of national GDP and is on a trajectory toward a fifth by the end of the decade, according to NASSCOM. The country has added more unicorns in the last five years than any geography outside the United States and China. Platform regulation that miscalibrates proportionality will not halt this growth — but it will redirect it, advantaging incumbents who can absorb compliance overhead and pushing the next generation of founders toward jurisdictions with clearer rules. The next twelve months — DPDP Rules finalisation, the Competition Bill's progress through Parliament, and the Digital India Act draft — will decide which India platform regulation chooses.