Marketing Compliance Basics for Indian Businesses

Advertising rules in India come from three separate sources, and most businesses only know one of them. The Advertising Standards Council of India (ASCI) polices ad content and influencer disclosures through a voluntary code. The Central Consumer Protection Authority (CCPA) can fine you up to ₹50 lakh under the Consumer Protection Act, 2019 for misleading claims. The Digital Personal Data Protection Act, 2023 (DPDP Act) governs how you collect and use customer data for marketing, and its penalties can run into hundreds of crores. None of these three bodies talk to each other. Getting compliant means checking your ads, your data practices, and your influencer contracts against three different rulebooks, not one.

Which law or body actually governs your ad?

Indian advertising compliance isn’t one law with one regulator. It’s a stack. ASCI reviews ad content voluntarily but functions as a real gatekeeper because most major media owners require ASCI clearance before they’ll run your creative. The CCPA, created under the Consumer Protection Act, 2019, has actual statutory teeth and can fine you directly. The DPDP Act, 2023 sits on top of both and governs something neither of them touches: how you’re allowed to collect and use a customer’s personal data for marketing in the first place. Then there’s GST, which is less about what you say in an ad and more about whether you’re taxing and invoicing the spend behind it correctly.

Founders usually discover this the hard way, one law at a time. A business gets its ad copy checked for accuracy, feels compliant, and then gets pulled up months later for how it collected phone numbers for its WhatsApp list, which is a completely different rulebook. Treating compliance as a single checkbox is the mistake. It’s four separate, unrelated checkboxes that happen to apply to the same campaign.

What the Consumer Protection Act actually fines businesses for

The CCPA issued its Guidelines for Prevention of Misleading Advertisements in June 2022, and they’re specific about what counts as a violation. Bait advertising is one: promoting a deal or stock you don’t actually have available, to pull people in and upsell them once they arrive. Surrogate advertising is another, most commonly seen with alcohol brands marketing “soda” or “music CDs” under the same brand name to sidestep restrictions. Ads that hide material conditions in fine print, and ads that make unverifiable claims like “best in the market” without data behind them, fall under the same rules.

This isn’t theoretical enforcement. In 2025, the CCPA imposed a ₹15 lakh penalty on a coaching institute for misleading advertisements about results, according to a press release from the Press Information Bureau. Ride-hailing platform Rapido was fined ₹10 lakh over deceptive advertising offers. These aren’t small or unknown players getting made an example of; they’re mainstream businesses whose marketing teams presumably assumed their claims were defensible.

The guidelines are also specific about advertising aimed at children, disclaimers, and free claims. A disclaimer can’t contradict or materially alter the main claim in an ad, and it has to be legible, not a font size nobody can actually read. “Free” claims can’t come with hidden conditions that make the offer meaningless in practice. None of this is complicated law. It’s mostly common sense written into a statute with a fine attached, which is exactly why ignorance of it tends to be an expensive excuse.

Data privacy: the DPDP Act’s new rules for your marketing list

Most small businesses treat their WhatsApp broadcast list and email database as assets they own outright. Under the DPDP Act, 2023, that’s no longer accurate. Consent for using someone’s personal data now has to be free, specific, informed, unconditional, and revocable. A pre-ticked signup box doesn’t count. A single “I agree to marketing communications” checkbox bundled with your terms of service doesn’t count either, because consent has to be purpose-specific rather than bundled into one blanket agreement.

The Act is also the first Indian law to explicitly restrict telemarketing without consent, which matters for any business still running cold outbound calls or SMS blasts. Penalties scale with the size of the breach and can reach ₹250 crore, which is a different order of magnitude from anything ASCI or the CCPA can impose. For a full breakdown of what the DPDP Act changes for marketing lists specifically, see our guide to the DPDP Act and marketing consent.

Influencer marketing: ASCI’s disclosure rules

If you’re paying, gifting, or otherwise compensating someone to talk about your product on social media, ASCI’s guidelines apply whether or not you think of it as “advertising.” The core requirement is a visible #Ad, #Sponsored, or #Promotion label on the actual content, not tucked away in a bio that most viewers never open.

• Video content on YouTube or Instagram Reels needs a verbal disclosure within the first 10 seconds, plus a text overlay for the whole clip.
• Stories and other ephemeral content need the disclosure label visible for the entire time the content is live, not just the first frame.
• Podcasts and other audio content need a verbal disclosure at the start of the segment discussing the brand.
• As of a 2026 update (Addendum 2), influencers giving advice in health, nutrition, or finance categories must hold and disclose relevant qualifications when they make technical claims.

None of this requires a lawyer to implement. It requires a line in your influencer brief that says “disclosure format X, placed here” and someone checking the final post before it goes live. Most violations happen because nobody checked, not because the rule was unclear.

Where compliance risk actually concentrates by channel

Not every marketing channel carries the same exposure. Paid ads and influencer content sit squarely inside ASCI and CCPA territory because they’re explicit, visible promotional claims. Organic content, including most SEO-driven blog and landing page copy, carries lower ad-specific risk but still has to clear the same bar on factual accuracy, because misleading claims don’t stop being misleading just because you didn’t pay to promote them. If you’re mapping out where your marketing budget actually goes and which channels need the tightest review, our overview of digital marketing channels breaks down where each one sits in a typical funnel.

GST on your marketing and ad spend

Compliance isn’t only about what you say in an ad. It’s also about whether the money behind it is taxed and invoiced correctly. Agency fees, ad platform spend, and influencer payments are all subject to GST, and getting the invoicing wrong creates its own penalty exposure that has nothing to do with ASCI or the CCPA. We’ve covered the mechanics of this separately in our guide to GST on marketing services, since it’s detailed enough to need its own space.

A practical compliance checklist

Most founders don’t need a compliance department. They need a five-minute check before anything goes live.

1. Every factual or comparative claim (“India’s fastest,” “clinically proven,” “best-rated”) has a source you could produce if challenged.
2. Discount and offer claims match what’s actually available in stock, not an aspirational number.
3. Influencer content carries a visible, format-appropriate disclosure, checked before publishing, not assumed.
4. Marketing consent is captured separately from other terms, with a working opt-out.
5. Personal data collected for one purpose (say, order updates) isn’t silently reused for marketing without fresh consent.
6. Ad spend and agency invoices are GST-compliant, not just paid.

Skipping this list doesn’t usually cause problems immediately. It causes problems eighteen months later, when a competitor files an ASCI complaint or a customer complaint escalates to the CCPA, and by then the ad has already run for a year and the fix costs more than the original review would have. Building the check into your existing content approval process, the same one you already use before anything ships, costs almost nothing. Retrofitting it after a notice arrives costs a lot more, in legal time if nothing else.

If you want your ad copy, landing pages, and consent flows reviewed against these frameworks before you spend budget behind them, that falls under our marketing services.

Frequently asked questions

Is ASCI a legal requirement in India?

No. ASCI is a voluntary self-regulatory body, not a statutory authority. But most major TV channels, print publications, and several digital ad networks require ASCI clearance before running creative, so in practice it acts as a real gate even without legal force behind it.

What’s the penalty for a misleading advertisement in India?

Under the Consumer Protection Act, 2019, the CCPA can fine advertisers, manufacturers, and endorsers up to ₹10 lakh for a first violation and up to ₹50 lakh for repeat violations, and can bar an endorser from future advertising for up to three years on repeat offences.

Does the DPDP Act apply to small businesses?

Yes. The DPDP Act, 2023 applies to any business processing the personal data of people in India, regardless of size. It doesn’t carve out an exemption for small or early-stage companies, though enforcement priorities in practice tend to focus on scale and severity of breach.

Do I need to disclose paid partnerships on Instagram in India?

Yes. ASCI’s influencer guidelines require a visible #Ad or #Sponsored label on any paid or gifted promotional content, placed on the post itself, not only in the influencer’s bio. Video content needs a spoken disclosure within the first 10 seconds as well.

Is GST charged on Google Ads or Meta Ads spend?

Yes, advertising services bought from platforms and agencies attract GST, and getting the invoicing and input tax credit treatment right is a separate compliance task from the content rules covered by ASCI or the CCPA. See our dedicated guide on GST for marketing services for the specifics.

What should I do first if I think one of my past ads was non-compliant?

Pull it down or revise the claim before anyone files a complaint. Both ASCI and the CCPA respond far more leniently to a business that self-corrects than one that keeps a flagged claim live after being notified. A quick internal audit against the checklist above is a reasonable starting point.