Five Requirements For Valid Consent

shall be free

No coercion, manipulation, or deceptive pressure. Consent cannot be forced by making a service dependent on non-essential data.

Any dark pattern or forced choice makes consent void.

“Accept or you can’t order” is invalid.

specific

Consent must map to one defined purpose in the notice. Broad, all-purpose consent is not enough.

Each purpose needs its own consent.

One checkbox for marketing, analytics, and sharing is unlawful.

informed

Notice must be clear, standalone, and shown before consent. Hidden or bundled disclosure does not count.

Consent given without proper notice is void.

Burying consent in a 60-page ToS fails this test.

unconditional

Consent cannot be tied to non-essential service access. It is valid only where the data is strictly necessary.

Conditioning service on unnecessary consent violates Section 6(1).

Requiring ad-sharing consent to create a document is unlawful.

unambiguous with a clear affirmative action

Consent must come from a positive act. Silence, pre-ticked boxes, or continued use are not enough.

Passive or implied consent mechanisms are void.

“By continuing, you agree” is invalid.

for the specified purpose

Use is limited to the exact stated purpose. Any new use is a fresh processing activity.

Purpose creep requires fresh notice and fresh consent.

Using appointment numbers for promotions is purpose creep.

limited to such personal data as is necessary

Only the minimum necessary data may be collected. Consent cannot expand that limit.

Excess collection is unlawful, even with consent.

A ride app cannot collect call logs “for safety.”

Confirm Shaming

The decline option is framed in guilt-inducing language to psychologically pressure the user into accepting.

Accept button: "Yes, keep my account secure." Decline link: "No, I don't mind my data being misused."

Exploits cognitive bias to extract a decision the user would not otherwise make. The framing of the decline option is itself a manipulative practice.

Visual Asymmetry

The Accept button is rendered in large, high-contrast format while the Decline option is a small, low-contrast hyperlink in a smaller font.

A 200x60 pixel blue "Accept All" button alongside a grey 9px "Decline" hyperlink placed below the fold.

The visual hierarchy of the interface suppresses the decline option. The user's natural eye movement is directed away from the decline option by design.

False Urgency

A countdown timer is displayed alongside the consent banner, pressuring the user to accept before reading the notice.

"This privacy offer expires in 02:47:33. Accept now to continue."

Artificially restricts the time available for an informed decision. Directly undermines the voluntariness of consent.

Basket Sneaking

Pre-ticked checkboxes for non-essential data collection are embedded within a multi-step registration or checkout flow, between unrelated inputs.

During a 5-step checkout, Step 3 contains a pre-ticked box: "Share my purchase data with marketing partners" placed between the delivery address and payment fields.

The user is not presented with a distinct, identifiable consent item. The consent is obtained by concealment, not by disclosure.

Roach Motel

Consent is accepted via a single click but withdrawal requires navigating multiple settings layers or contacting customer service.

One-click "Accept All" during onboarding; withdrawal requires: Settings > Privacy > Data > Consents > Marketing > Email > Manage > Revoke > Confirm.

Creates an asymmetry between the ease of giving and withdrawing consent, violating both Section 6(1) and Section 6(4).

Hidden Information

Material details such as third-party data sharing are disclosed only at the bottom of a long scrollable notice, after the consent button is already visible at the top.

A consent screen with an "Accept" button at the top, followed by 800 words of text, with the disclosure "your data will be sold to third-party advertisers" appearing only in paragraph 14.

The user cannot be considered informed of what they are consenting to. The notice fails the standalone and comprehensibility requirements of Section 6(3).

Confirm Shaming

The consent screen for sharing health data with insurance partners displayed: Accept button: "Yes, get better coverage." Decline link: "No, I'll risk my health."

The framing of the decline option exploits the user's concern for their health to extract consent. This is a manipulative practice under Section 6(1). The consent is void.

Replace with neutral language. Accept: "I consent to sharing my health data with insurance partners." Decline: "I do not consent to this sharing."

Service Conditioning

HealthTrack refused to allow users to book a doctor consultation unless they also consented to sharing their health data with third-party insurance companies.

Sharing health data with insurance companies is not strictly necessary for booking a doctor consultation. Conditioning the core service on this consent violates Section 6(1).

Separate the consultation booking consent from the insurance data sharing consent. The consultation must be bookable without the insurance sharing consent.

Service denial where data is strictly necessary

A maps application refuses to provide turn-by-turn navigation to a user who declines real-time GPS access.

Yes

Location data is mechanically necessary for navigation. Without it, the service cannot function. This is functional impossibility, not differential treatment.

Service denial where data is not necessary

A calculator application refuses to open unless the user consents to camera and microphone access.

No

Camera and microphone access have no functional connection to arithmetic operations. Denial of service is coercive conditioning on an unrelated consent.

Service degradation as punishment for refusal

A news platform reduces article load speed by 40% and limits users to 3 articles per day for users who decline targeted advertising consent.

No

Speed degradation and content restriction are direct, discriminatory consequences of exercising the right to decline. This is differential treatment as punishment for refusal.

Feature unavailability where feature requires the withheld data

An e-commerce platform disables the "Recommended for You" section for users who opt out of behavioural profiling.

Yes

Personalisation cannot function without profiling data. Disabling a feature that requires the withheld data is a functional consequence, not punitive treatment. The core shopping service must remain fully available.

Core service withheld to extract advertising consent

A social media platform hides posts from a user's timeline unless the user consents to third-party advertiser data sharing.

No

The social feed is the core service. Third-party data sharing has no functional connection to displaying a user's own network's posts. Using the feed as leverage to extract advertising consent is coercive.

Section 6(1): Free

Is consent freely given if the only alternative is a recurring subscription payment?

For a dominant platform with no comparable substitute, the economic pressure of a subscription fee may function as coercion, rendering the tracking consent not freely given.

Meta's "Pay or Okay" model in Europe was rejected by the EDPB for dominant platforms. An Indian platform implementing the same model faces the same legal risk under Section 6(1).

Section 6(1): Differential Treatment

Does the model offer differential treatment based on the user's consent decision?

Yes. Non-paying users receive a tracking-heavy experience while paying users receive a tracking-free experience. The user's experience is materially different based solely on their consent decision.

A dominant Indian social media platform offering a "Premium" subscription for Rs. 299 per month to users who decline advertising tracking, while free users are subjected to comprehensive behavioural profiling, is offering differential treatment based on consent.

Section 6(1): Unconditional

Is the tracking consent made conditional on not paying the subscription?

Yes. The model is structurally conditional by design. The tracking consent is a precondition for the free version of the service.

The free version of the service is only available if the user consents to tracking. The tracking consent is therefore a precondition for accessing the free service, which violates Section 6(1).

Mobile number

"To provide services and improve your experience"

"To send a one-time password for two-factor authentication during account login on this platform"

A banking app that states "for communication purposes" when collecting a mobile number, but then uses it for loan marketing SMS, has collected under an unlawful purpose and used it for an undisclosed one.

Email address

"For communication and marketing purposes"

"To send a transactional confirmation email upon completion of your purchase order"

An e-commerce platform that collects email "for communication" and then sends weekly promotional newsletters has engaged in purpose creep. The original purpose did not cover marketing.

GPS location

"To personalise your experience"

"To display service providers within a 5 km radius of your current location when you initiate a search"

A food delivery app that collects location "to personalise your experience" but retains and analyses historical location data to build a movement profile for advertising targeting has exceeded the stated purpose.

Aadhaar number

"For KYC and verification"

"To verify your identity through the Aadhaar-based OTP authentication service as required under the Prevention of Money Laundering Act, 2002 for account opening"

A fintech platform that collects Aadhaar "for KYC" but then uses the Aadhaar-linked demographic data for credit scoring has used the data for a purpose not stated in the notice.

Mobile number collected for appointment reminders

Used to send promotional SMS for a new subscription plan

No

Issue a new notice specifically disclosing the promotional use of the mobile number. Obtain fresh affirmative consent from each user before sending any marketing message.

Email address collected for order confirmation

Used for a weekly newsletter

No

Issue a separate consent request for newsletter communications. The original transactional consent does not extend to marketing communications.

Location data collected for real-time navigation

Retained and used to build a historical movement profile for analytics

No

Issue a new notice disclosing the analytics purpose and the retention period. Obtain fresh consent. Users who decline must have their historical location data deleted.

Personal data to be processed

An itemised list of every category of personal data that will be collected. Vague descriptors such as "certain personal information" are not sufficient.

"We will collect: (1) your mobile number; (2) your email address; (3) your real-time GPS location; (4) your device identifier."

Consent is void under the Informed pillar. The Data Principal cannot be considered informed of what they are consenting to.

Specified purpose of processing

The exact, bounded purpose for which each data type is being collected. Each purpose must be separately stated.

"Your mobile number will be used to send a one-time password for login authentication. Your GPS location will be used to display nearby restaurants when you initiate a search."

Bundling multiple purposes in one sentence is non-compliant. Each purpose requires a separate disclosure.

Description of goods or services enabled

A clear description of what service or functionality the processing enables and what the Data Principal receives in return for providing their data.

"Providing your location enables us to show you restaurants within 5 km of your current position. Without this, the search function will not display location-based results."

Creates a functional nexus test: the user must understand the connection between their data and the service they are receiving.

Withdrawal mechanism

A direct, clickable link or mechanism within the notice itself allowing the Data Principal to withdraw consent at any time.

"You may withdraw this consent at any time by clicking [Withdraw Consent] below or by visiting Settings > Privacy > Consent Management."

A reference to a separate settings page is the minimum standard. The withdrawal mechanism must be in the notice, not merely referenced.

Rights exercise link

Information on how the Data Principal can exercise their rights under Sections 11 to 14 of the DPDPA: access, correction, erasure, and nomination.

"To access, correct, or request erasure of your personal data, click [Exercise My Rights] or visit our rights exercise portal at [URL]."

The notice must link to the mechanism for exercising these rights. A general reference to a privacy policy is insufficient.

Grievance redressal link

A direct communication link to the Data Fiduciary's designated Grievance Officer and to the Data Protection Board's complaint portal.

"Our Grievance Officer is [Name], reachable at [email]. To file a complaint with the Data Protection Board, visit the DPB complaint portal [DPB portal URL]."

The DPB's online complaint portal must be directly linked. The Grievance Officer's contact details must be current and functional.

Free

On first launch, displayed a full-screen banner: "Accept our data practices to continue." No decline option was visible.

Making app access conditional on accepting all data practices, with no visible decline option, is coercion. The consent is not free under Section 6(1).

Provide a clearly visible decline option with equal visual prominence. Allow the user to access the app with limited functionality if they decline non-essential data collection.

Specific

A single checkbox covered location, contacts, camera, browsing history, and device identifiers, all in one consent request.

Each data type serves a different purpose. Bundling them into one checkbox prevents the user from exercising granular choice. Violates Section 6(1).

Present a separate consent request for each data type and each processing purpose. Allow the user to accept location access while declining contact list access.

Informed

The consent banner said "to improve your experience." No specific purposes were stated. No withdrawal link was provided.

"To improve your experience" is not a specified purpose under Section 2(za). The notice fails the mandatory content requirements of Section 6(3).

State the exact purpose for each data type. Include a direct link to withdraw consent within the notice itself.

Unambiguous

The banner stated "By continuing to use QuickBite, you agree." No checkbox or toggle was presented.

Continued use of an app is inaction or disengagement. Section 6(1) explicitly prohibits this as a basis for consent.

Present an unchecked checkbox or an Off-state toggle for each consent item. Require the user to actively check or toggle before proceeding.

Specific

At account registration, presented one consent screen covering Aadhaar, PAN, bank account details, transaction history, device identifiers, location data, and contact list for KYC, fraud detection, credit assessment, personalised offers, and marketing in a single click.

Seven data types and five processing purposes in one click. The user cannot say yes to KYC and no to marketing. Each data type and each purpose requires a separate consent mechanism.

Disaggregate into individual consent requests: one for KYC (Aadhaar, PAN), one for fraud detection (device identifier, transaction history), one for personalised offers (location, browsing), one for marketing (email, mobile number).

Unconditional

Refused to open an account unless the user consented to marketing communications and third-party data sharing, in addition to KYC.

KYC is strictly necessary for account opening under PMLA. Marketing and third-party sharing are not. Conditioning account access on non-essential consents violates Section 6(1).

Separate the mandatory KYC consent from the optional marketing and third-party sharing consents. The account must be openable without the optional consents.

Informed

The notice was embedded within the Terms and Conditions document, accessible via a hyperlink at the bottom of the registration screen.

The notice must be presented and understandable independently of any other information. A hyperlink to a Terms document does not satisfy Section 6(3)'s standalone requirement.

Present a standalone consent notice as a distinct screen before the registration form. The notice must itemise each data type and each purpose without requiring the user to navigate to another document.

Withdrawal

To withdraw marketing consent, users were required to email privacy@finpay.com with a written request, which was processed within 30 business days.

The ease of withdrawal must be comparable to the ease of giving consent under Section 6(4). A 30-day email process is not comparable to a single checkbox click.

Provide an in-app toggle within the Privacy Settings screen that mirrors the original consent mechanism. Withdrawal must take effect immediately upon the user's action.

The Customer Service Detour

Requiring users to call a toll-free number during business hours to revoke a consent that was given via a single click on a mobile application.

A user consented to marketing SMS with one tap during app onboarding. To withdraw, they are directed to call 1800-XXX-XXXX between 9 AM and 6 PM on weekdays.

Creates an asymmetry of approximately one tap versus 15 to 30 minutes of effort. Directly violates the symmetry principle.

The Multi-Layer Maze

Hiding the consent withdrawal option under multiple layers of settings menus.

Consent was given during onboarding in two taps. Withdrawal requires: Settings > Account > Privacy > Data Preferences > Consent Management > Marketing > Email Marketing > Manage > Revoke > Confirm Revocation.

If consent acceptance was presented during onboarding, withdrawal should be approximately equally accessible. This architecture is deliberately obstructive and violates Section 6(4).

The Mandatory Justification

Requiring users to provide a reason for withdrawing consent before the withdrawal is processed.

A platform presents a mandatory dropdown menu before processing a withdrawal: "Please tell us why you are withdrawing consent."

A Data Principal does not owe the Data Fiduciary an explanation for withdrawing consent, just as they did not owe an explanation for giving it.

The Confirmation Loop

Presenting multiple confirmation screens after a user requests withdrawal, designed to wear down the user's determination through friction and doubt.

After clicking "Withdraw Consent," the user is shown: Screen 1: "Are you sure?"; Screen 2: "You will lose access to personalised features"; Screen 3: "This action cannot be undone. Confirm?"; Screen 4: "Enter your password to confirm."

The withdrawal process must be as simple as the consent process. Additional friction at the withdrawal stage violates the symmetry principle.

The Email Black Hole

Requiring withdrawal requests to be sent via email to a generic inbox with no automated confirmation and no guaranteed processing timeline.

A platform's privacy settings page states: "To withdraw consent, email privacy@platform.com. Requests are processed within 30 business days." Consent was given via an in-app toggle.

The mechanism for withdrawal must be equivalent in accessibility and immediacy to the mechanism for giving consent. A 30-day email process is not equivalent to an in-app toggle.

Stage 1: Withdrawal received

The Data Principal withdraws consent via the prescribed mechanism. The legal basis for all processing that relied on that consent instantaneously ceases.

Section 6(5), DPDPA 2023

A user taps "Withdraw Marketing Consent" in the app's Privacy Settings. From that moment, the legal basis for all marketing-related processing of that user's data ceases.

Stage 2: Processing halted

The Data Fiduciary must, within a reasonable time, cease all processing activities that were authorised solely by the withdrawn consent, and must cause its Data Processors to do the same. The statute does not prescribe a fixed deadline but the standard is reasonableness, not indefinite delay.

Section 6(5), DPDPA 2023

The platform must stop sending marketing SMS, marketing emails, and targeted advertising to that user within a reasonable time of receiving the withdrawal. A campaign already mid-dispatch may be completed, but no new campaign may be initiated after the withdrawal is received.

Stage 3: Erasure initiated

The Data Fiduciary must erase the personal data from its own systems unless retention is mandated by a superseding Indian law.

Section 8(7), DPDPA 2023

The platform must delete the user's mobile number and email address from its marketing database. If the same mobile number is also used for transactional OTPs (a separate consent), only the marketing-purpose copy must be deleted.

Stage 4: Processors notified

Deletion instructions must be transmitted to all contracted Data Processors who were handling the data on behalf of the Fiduciary.

Data Processing Agreement obligations

The platform must instruct its email marketing vendor, its SMS gateway provider, and its advertising platform to delete the user's data from their systems.

Stage 5: Third-party recipients notified

All third parties to whom the data was shared must be notified and must confirm erasure.

Section 8(7) cascade obligation

If the platform had shared the user's data with a third-party advertiser or a data broker, it must notify those parties and obtain confirmation that the data has been deleted from their systems as well.

Stage 6: Statutory retention check

If another Indian law mandates retention, the data may be retained for that statutory purpose only.

Section 7 and applicable retention statutes

A bank that receives a withdrawal of consent for marketing purposes must still retain the customer's KYC data (PAN, Aadhaar) for the period mandated by the Prevention of Money Laundering Act, 2002. The retention is for the statutory purpose only, not for marketing.

Audit all consent UI/UX for dark patterns including confirm shaming, visual asymmetry, false urgency, and basket sneaking

Section 6(1)

Accept button is 3x larger than Decline; decline option uses guilt-inducing language; countdown timers on consent banners

Immediate

Disaggregate all bundled consent mechanisms into separate, purpose-specific consent requests

Section 6(1)

Single checkbox covering KYC, marketing, analytics, and third-party sharing

Immediate

Build standalone notice infrastructure independent of Terms of Service, covering all 22 Eighth Schedule languages

Section 6(1) and Section 6(3)

Notice embedded in clause 12 of Terms of Service; notice available only in English

Immediate

Implement re-consent workflows triggered automatically when any processing purpose changes

Section 6(1)

Platform begins using data for a new purpose without issuing a fresh notice

Immediate

Implement one-tap revocation mechanisms and automated deletion pipelines cascading to all third-party processors

Section 6(4), Section 6(6) and Section 8(7)

Withdrawal requires a phone call; deletion not cascaded to advertising partners

Immediate

Build immutable, cryptographically verifiable audit log infrastructure capturing all consent interactions at the field level

Section 6(10)

Consent stored as a single boolean flag; no notice version, no timestamp, no purpose-level record

Immediate

Issue Rule 3-compliant notices to all existing users for pre-DPDPA data within the 18-month transition window

Section 5(2) and Section 6(3)

Pre-DPDPA data continues to be processed without a fresh compliant notice

Within transition window

1

Is the consent request free of dark patterns including confirm shaming, visual asymmetry, false urgency, and basket sneaking?

Free: Section 6(1)

Pass / Fail

2

Do the Accept and Decline options carry equal visual prominence including comparable button size, font size, and colour contrast?

Free: Section 6(1)

Pass / Fail

3

Is service access conditioned only on data that is strictly technically necessary for core service delivery?

Free and Unconditional: Section 6(1)

Pass / Fail

4

Is each processing purpose addressed by a separate, independent consent mechanism?

Specific: Section 6(1)

Pass / Fail

5

Is the stated purpose concrete, bounded, and free of vague catch-all language?

Specific: Section 6(1)

Pass / Fail

6

Is there a re-consent workflow triggered automatically when the processing purpose changes?

Specific: Section 6(1)

Pass / Fail

7

Is the notice presented as a standalone notice, independent of the Terms of Service?

Informed: Section 6(1) and Section 6(3)

Pass / Fail

8

Does the notice itemise all data types, all processing purposes, and all services enabled?

Informed: Section 6(1) and Section 6(3)

Pass / Fail

9

Does the notice include direct links to the withdrawal mechanism, rights exercise portal, and DPB complaint portal?

Informed: Section 6(1) and Section 6(3)

Pass / Fail

10

Is the notice offered in English and all user-requested Eighth Schedule languages?

Informed: Section 6(3)

Pass / Fail

11

Is the default state of all consent checkboxes and toggles set to unchecked or off?

Unambiguous: Section 6(1)

Pass / Fail

12

Does the affirmative action mechanism leave a clear, server-side record of the user's deliberate choice?

Unambiguous: Section 6(1)

Pass / Fail

13

Is the withdrawal mechanism as simple as the consent mechanism (same number of steps)?

Withdrawal: Section 6(4)

Pass / Fail

14

Is there a documented deletion cascade procedure triggered automatically on consent withdrawal, covering all processors and third-party recipients?

Withdrawal: Section 8(7)

Pass / Fail

15

Does the audit log capture: timestamp, notice version hash, language, affirmative action type, IP address, device identifier, and purpose-level consent status?

Burden of Proof: Section 6(10)

Pass / Fail

16

Is the audit log stored in an immutable or cryptographically verifiable format?

Burden of Proof: Section 6(10)

Pass / Fail