Sujal Tyagi
5 Nov 2026 4 min read
Millions of Indians tap “I Agree” every day without reading a single line. The tap is logged as consent, yet a recorded click is not a real decision. This blog argues that formal consent is not necessarily informed consent, and that India’s Digital Personal Data Protection Act, 2023 (DPDP Act) narrows that gap without ever closing it. We have all scrolled past a wall of legal text to reach “Continue.”
Privacy policies exist to protect companies, not to inform users. McDonald and Cranor’s well-known 2008 study estimated that an average US internet user would spend about 244 hours a year reading every policy they meet. Their subjects were American, but the pattern is familiar: bundled permissions, vague purposes and a take-it-or-leave-it screen. When saying no means losing a payment app or a government service, choice starts to look like compliance. In Puttaswamy, the Supreme Court held that informational privacy is part of the fundamental right to privacy. That makes the quality of consent matter, although not every weak consent mechanism is a constitutional violation.
Section 6 demands that consent be free, specific, informed, unconditional and unambiguous, given through clear affirmative action, and limited to the data necessary for the stated purpose. Section 5 adds a notice explaining what is collected, why, and how to exercise rights or complain. Section 6(4) makes withdrawal as easy as giving consent, and section 6(2) voids any part of consent that breaches the law. The Act is backed by the DPDP Rules, 2025, which, as the government’s own explainer notes, require a separate, clearly worded notice and provide for registered Consent Managers.
One caveat on timing: the Rules were notified on 13 November 2025, but they take effect in stages. Consent Manager registration (section 6(9) and Rule 4) begins on 13 November 2026, while sections 5, 6(1) to 6(8) and 6(10) are scheduled for 13 May 2027. These standards show what the law will demand, not what can be enforced today.
Still, three gaps remain. First, the Act regulates the content of a notice, not whether anyone takes it in. A notice can satisfy every requirement and still go unread. A logged acceptance is only a starting point, since the fiduciary must still prove notice and consent meeting the section 6 standard. In other words, compliance on paper can coexist with confusion in practice.
Second, consent is not the only route to processing. Section 7 allows specified “legitimate uses” without consent, including data voluntarily provided for a stated purpose, State subsidies and benefits, certain disclosure obligations and court orders, medical emergencies involving a threat to life, and employment purposes. Section 17 separately exempts specified processing, and notified State instrumentalities, from parts of the Act on stated grounds.
Third, the Act never defines dark patterns. A pre-ticked box, a faint “decline” link or a prompt that keeps reappearing could undermine consent that must be “free” and “unambiguous”, depending on the design and the legal tests. India’s 2023 dark-pattern guidelines under consumer law partly fill the void, but they sit in a different statute with a different regulator. This silence matters because manipulation often hides in the interface, not the wording.
Part of the fix is better design: layered notices opening with a few plain lines, just-in-time prompts, purpose-wise choices, and equal prominence for “accept” and “decline”. Regulators can back this up by treating deceptive interfaces as defeating the “free” and “unambiguous” requirements. None of this is complicated; it simply asks companies to design for users, not around them.
Once it commences, section 6(10) will put the burden of proving notice and consent on the data fiduciary. But that proves a process, not understanding. A stronger standard would make fiduciaries show their consent flow was tested for comprehension with ordinary users, including those reading in regional languages. Passing an audit is not the same as being understood.
Consent should be judged by whether a person understood what they agreed to, not by whether a click was logged. Until the law asks that question, “I Agree” will stay closer to ritual than choice.
Author: Sujal Tyagi, 4th Year B.B.A. LL.B. Student
Vivekananda Institute of Professional Studies
Sign in to join the discussion.
In India the practice survives as khatna or khafz, performed mostly on six- and seven-year-old girls in the Dawoodi Bohra community. There is no official data on it: the government told the Supreme Court that no official data supported the practice’s existence
Recently, Kangana Ranaut, a famous Indian actress and a Member of Parliament from Himachal Pradesh, filed a suit seeking protection of her personality rights, where the court ordered META to take down AI images impersonating her and all other Fake images, fake audios, etc related to her.
