The rapid growth of digital advertising as a key component of the digital economy has intensified concerns over the protection of personal data and privacy rights. The primary legal problem addressed in this research is the inability of Indonesia’s current data protection framework to adequately regulate data-driven digital advertising practices and prevent unlawful identification of individuals, particularly when compared to South Korea’s more advanced regulatory regime. This study aims to comparatively analyze the legal frameworks governing personal data and privacy protection in digital advertising in Indonesia and South Korea and to propose a legal development model for Indonesia. This research employs a normative legal research method using a comparative statutory approach, focusing on Indonesia’s Law on Personal Data Protection and South Korea’s Personal Information Protection Act, along with its enforcement regulations. Legal norms are examined through statutory provisions and supported by relevant legal and academic literature. The findings demonstrate substantial regulatory disparities between the two countries. South Korea has established a comprehensive and technologically responsive legal framework, incorporating detailed data classification, recognition of pseudonymized data, strict profiling limitations, and strong institutional enforcement. In contrast, Indonesia’s legal framework remains structurally limited, relies heavily on undelivered implementing regulations, and insufficiently addresses indirect identification and advanced data-processing practices in digital advertising. This study proposes targeted legal reforms for Indonesia, including the integration of pseudonymization, enhanced data classification, criminalization of unlawful identification, and mandatory tracking notifications to strengthen privacy protection in the digital advertising ecosystem.