The Art of Valid Consent under DPDPA: Cookies & Notice
An in-depth look at what makes consent valid under the DPDPA, detailing notice requirements, cookie banners, and the prohibition of bundled consent.
What Constitutes Valid Consent?
Under the DPDPA, consent must be free, specific, informed, unconditional, and unambiguous. It must be accompanied by a clear notice detailing the categories of personal data collected, the purpose of processing, and how the user can withdraw consent.
Q: Can companies use "Bundled Consent" for multiple services?
No. The DPDPA requires consent to be purpose-specific. Bundled or forced consent—where a user is forced to agree to marketing, profiling, and partner sharing to use a basic service—is illegal and renders the entire consent invalid.
Real-World Example
An e-commerce mobile app cannot deny a user checkout services simply because they refuse to consent to receiving promotional SMS marketing. Checkout and marketing are unrelated; consent must be separated (unbundled).
Managing Cookies and Tracking Mechanisms
Websites targeting Indian users must review their cookie banners and tracking scripts. Under the DPDPA, tracking cookies that identify or profile users require explicit consent. Essential cookies that only run the site session are exempt.
Q: Are push notifications and voice logs considered data processing?
Yes. Push notifications rely on device tokens linked to user accounts, and voice assistants store audio logs that capture voice biometric indicators. Both qualify as personal data processing. Organizations must get explicit consent, specify the purpose, and provide easy opt-out controls.
Key Note
The DPDPA introduces "Consent Managers" as intermediaries. Data Principals can grant, manage, or withdraw their consent through a unified portal, and fiduciaries must integrate with these systems once active.
Book a Personalised Walkthrough
Interested in the Consent Management frameworks? Speak to a specialist to get a custom roadmap for your systems.