Five Practical Rules for Getting Website Consent Right Under the DPDPA

Consent sits at the centre of the DPDPA, 2023 — it has to be clear, tied to a specific purpose, and capable of being taken back. In practice, getting all three of those right on a live website is harder than it sounds. Here is a practical set of rules for managing it properly, without turning every page into a wall of checkboxes or slowing the business down to a crawl.

1. Write notices that actually inform instead of confusing

• State the purpose, the categories of data involved, the expiry, and a contact point — all of it, not just the headline.
• Use plain language. Legal or technical jargon defeats the point of a notice.
• Make the choice visually clear — checkboxes and toggles for granular, purpose-by-purpose consent work far better than a single blanket "accept."

2. Adapt consent to each collection point

A website, a mobile app and a backend API each set different expectations for the person on the other end, and the consent experience should reflect that rather than using one template everywhere. A website typically needs a cookie banner and signup-form consent. A mobile app needs in-app prompts, timed to when a feature actually needs the data rather than all at once at install. A backend integration or API needs its consent context handled server-side, tied to tokens rather than a visual prompt at all. Notices tailored to each of these, rather than one generic version stretched across all three, are what actually holds up.

3. Build in expiry and re-consent, not just initial capture

The DPDPA expects clear timelines around how long consent stays valid, not an indefinite grant. Tie expiry to the purpose itself — an account-lifecycle-linked consent should expire differently to a marketing-duration one — and build periodic re-consent flows into the product, particularly whenever the underlying service changes in a way that affects what data is used for.

4. Make revocation as easy as giving consent was

• Offer genuine one-click opt-outs, not a multi-step form buried in settings.
• Give people a single, centralised place to manage their preferences rather than scattering controls across different product surfaces.
• Sync withdrawal across every connected system through your integrations — a withdrawal that only updates one system is not really a withdrawal.

5. Keep consent logs that cannot be quietly altered

Maintain a tamper-proof record of exactly who consented, to what, and when. Store it securely, and keep it in a form that would hold up if the Data Protection Board asked for it directly — traceability has to be designed in from the start, not bolted on after the fact.

The Balance That Actually Matters

Good consent management sits right at the intersection of legal compliance and user trust. Get it wrong, and an organisation loses both at once. Get it right, and it builds loyalty and credibility alongside the legal footing — the two are not actually in tension, whatever it might feel like mid-implementation.

If you're not sure your current banner and logs would survive scrutiny, our CMP evaluation service checks exactly that.