Consent Architecture: DPDPA's Mandate vs. EU's Framework

As India’s Digital Personal Data Protection Act (DPDPA), 2023, and its accompanying Rules (2025) solidify the nation’s privacy landscape, a critical distinction emerges in how consent is managed compared to global frameworks like the EU’s General Data Protection Regulation (GDPR) and ePrivacy Directive. While both regimes champion data principal autonomy, their architectural approaches to consent management present significant divergences, particularly concerning the role of intermediaries.

India’s Regulated Consent Manager Ecosystem

The DPDPA, 2023, establishes a robust framework for obtaining and managing consent, placing it at the core of lawful data processing. Section 6(1) mandates that consent must be “free, specific, informed, unconditional, and unambiguous,” requiring a clear affirmative action from the Data Principal. Crucially, Section 6(2) grants Data Principals the right to withdraw consent at any time, with processing ceasing thereafter.

The most distinctive feature of the Indian approach is the introduction of the “Consent Manager.” Defined in Section 2(e) as a Data Fiduciary, a Consent Manager is an entity registered with the Data Protection Board of India (DPBI) that enables a Data Principal to give, manage, review, and withdraw consent through an accessible, interoperable, and transparent platform. The DPDP Rules, 2025 (anticipated to be detailed in a specific chapter, perhaps Chapter X, on Consent Managers), are expected to lay down stringent requirements for their registration, technical standards, audit mechanisms, and responsibilities. This model draws conceptual parallels from the Reserve Bank of India’s (RBI) Account Aggregator framework, which facilitates consent-based data sharing in the financial sector, albeit under a different regulatory mandate. Unlike the previous IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which broadly required consent for sensitive personal data, the DPDPA’s Consent Manager introduces a new, regulated layer of intermediation.

The EU’s Market-Driven CMP Framework

In the European Union, the GDPR (Regulation (EU) 2016/679) and the ePrivacy Directive (Directive 2002/58/EC, as amended) also place high importance on consent. GDPR Article 4(11) defines consent similarly to DPDPA, requiring it to be “freely given, specific, informed and unambiguous.” Article 7 sets out conditions for consent, including the controller’s obligation to demonstrate consent (Article 7(1)) and the ease of withdrawal (Article 7(3)). The ePrivacy Directive, particularly Article 5(3), specifically addresses the requirement for user consent before storing or accessing information on a user’s terminal equipment, famously applied to cookies and similar tracking technologies.

To meet these requirements, the EU market has seen the proliferation of Consent Management Platforms (CMPs). These are software solutions or services that help data controllers (equivalent to DPDPA’s Data Fiduciaries) collect, store, and manage user consent preferences, especially for website cookies and app permissions. Unlike India’s Consent Managers, CMPs are not directly mandated or regulated by specific articles of the GDPR or ePrivacy Directive. Instead, they are market-driven tools developed by third-party vendors or in-house, designed to assist data controllers in fulfilling their legal obligations. Frameworks like the IAB Europe’s Transparency and Consent Framework (TCF) provide technical specifications for CMPs to operate interoperably, but participation is voluntary. The ultimate accountability for demonstrating valid consent rests squarely with the data controller.

Key Differences and Trade-offs

The architectural differences between India’s Consent Manager framework and the EU’s CMP ecosystem are pronounced:

1. Regulatory Mandate and Oversight: India’s DPDPA is stricter by mandating and directly regulating Consent Managers as distinct entities registered with the DPBI. This introduces a layer of governmental oversight and accountability for the consent management process itself. The EU, conversely, is looser in this regard, not mandating a specific type of intermediary. CMPs operate as market solutions, with accountability for consent remaining with the data controller.
2. Role of the Intermediary: An Indian Consent Manager is a legally defined Data Fiduciary, actively facilitating consent decisions and withdrawals for the Data Principal. This suggests a more active and empowered role for the intermediary. An EU CMP is primarily a tool for the data controller to manage their consent obligations, with the controller remaining the central point of contact for the data subject.
3. Accountability: In India, accountability for consent management is shared between the Data Fiduciary and the Consent Manager, both having defined legal duties under the DPDPA and Rules. In the EU, while CMPs assist, the data controller bears the sole legal burden of demonstrating valid consent under GDPR Article 7(1).
4. Prescriptiveness of Standards: While the DPDP Rules, 2025, are yet to fully detail the technical and operational standards for Consent Managers, the DPDPA’s approach suggests a potentially more stricter and prescriptive regulatory environment for these entities. The EU’s CMP market, while guided by data protection authorities’ interpretations, relies more on industry best practices and voluntary frameworks.
5. Data Portability: GDPR Article 20 explicitly grants data subjects the right to data portability. While the DPDPA is silent on an explicit “right to data portability,” the Consent Manager’s role in managing consent could implicitly facilitate aspects of data principal control over their data flow, depending on how the Rules define their interoperability and data access functions.

Practical Takeaway

For Indian businesses, General Counsels, and Data Protection Officers, the DPDPA’s Consent Manager framework necessitates a fundamental shift in how consent is perceived and managed. It’s not merely about implementing a pop-up or a cookie banner. Instead, it requires integrating with registered and approved Consent Managers, understanding their technical specifications, and establishing robust protocols for consent acquisition, management, and withdrawal through these regulated intermediaries. This means moving beyond a self-managed CMP approach to one that involves a trusted, regulated third party in the consent lifecycle. Businesses must prepare for new API integrations, data sharing agreements with Consent Managers, and a clear understanding of the audit trails and compliance requirements specific to this unique Indian model.