Consent fatigue: how the DPDP notice rules are reshaping consumer flows

WWithin weeks of the DPDP Act's notification, every consumer-facing product team in India began the same exercise: rewriting the consent screen. The Act requires a notice that is clear, specific, and given in English plus the eighteen scheduled languages — and a consent that is free, informed, and unambiguous. For products built around a frictionless sign-up, that is a significant intervention.

From banners to scrolls

The early implementations have settled into three rough patterns. First, the long-form scroll: a single notice that lays out every purpose, every data fiduciary the user might encounter, and every retention period. Second, the layered card: a short notice with a 'read more' that opens the full statutory disclosure. Third, the just-in-time prompt: consent collected at the moment a purpose is actually invoked, rather than upfront at sign-up.

Each pattern has its defenders. The scroll is the most legally defensible — every disclosure is present and timestamped. The layered card is the easiest on conversion. The just-in-time prompt arguably maps best to how consent should work in principle, but it can feel intrusive if a user encounters six prompts in a single session.

The withdrawal problem

Section 6 of the Act gives every Data Principal the right to withdraw consent as easily as it was given. The drafting is short and unambiguous, but the operational consequences are large. A fiduciary that collected consent via a single tap at sign-up must now expose a single-tap withdrawal somewhere in the product. Many product teams have settled for a 'Manage data' screen buried in account settings — which is unlikely to meet the 'as easily as given' test in any future enforcement action.

• Withdrawal flow must be no harder than the original consent flow.

• Each purpose must be withdrawable independently — bundled withdrawal is acceptable as a default, but not the only option.

• Logs must show the consent record, the withdrawal record, and the timestamp difference.

Where it lands

The pragmatic resolution will probably be a hybrid: a layered notice at sign-up plus a clearly-discoverable consent dashboard that gives the user a per-purpose view of what they have agreed to and a one-tap withdrawal for each. That model is more work than the status quo but less invasive than the just-in-time prompt. Expect the Data Protection Board's first round of guidance to push companies in that direction.