Designing consent for next-gen data-driven economy

As the DPDPA reshapes India's data economy, consent design must shift from dark patterns to transparent, user-first experiences that build trust.

- BY AKSHAYY S NANDA

As India enters a new era of data protection with the Digital Personal Data Protection Act, 2023 (DPDPA), both businesses and users stand at a critical juncture. The law requires a profound shift—not only in backend compliance but also in the everyday experiences users have with websites and apps. Central to this evolution is the concept of consent: what it means, how it is collected, and how its misuse through “deceptive patterns” endangers both user rights and organisational trust.

The DPDPA establishes consent as one of the primary legal bases for processing personal data. For consent to be valid, it must satisfy five distinct requirements.

Free: The consent must be given without coercion, pressure, or being bundled with other services. Organisations cannot tie the provision of services to consent for processing that is not necessary for the service's performance. If refusing consent leads to denial of service for nonessential processing, it cannot be considered freely given.

Specific: Consent must be granular and purpose-specific. Individuals must understand precisely what data is being processed and for what specific purpose. Blanket consent for multiple purposes is invalid.

Informed: Data principals must receive clear information about the processing through proper notice. This includes an itemised description of the personal data being processed and the specific purposes for which it will be used in English and 22 regional languages.

Unconditional: Consent cannot be bundled with acceptance of terms and conditions or tied to other agreements. It must be separate and distinct from other contractual obligations.

Affirmative Action: Consent must be demonstrated through a positive action. Pre-ticked boxes, inactivity, or silence cannot constitute consent. The individual user must take deliberate action to signify agreement.