What DPDP says about consent. Most companies get it wrong.
DPDP consent explained simply: clear purpose, separate choices, withdrawal, proof and why bundled consent is risky.
The simple answer
Consent under DPDP should be clear, specific and linked to a purpose. A user should know what they are agreeing to, not just tap one button to make a banner disappear.
The practical problem is bundled consent: one checkbox or one button silently covering service updates, marketing, analytics, ads, partner sharing and profiling.
What to check
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
If this is unclear, treat it as a signal to ask the company for a plain-English explanation.
One button cannot mean everything.
State of Privacy found consent patterns that looked simple but hid many downstream uses. DPDP readiness requires purpose-by-purpose thinking.
What to do next
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
Keep it practical: take one action, save proof, and avoid giving more data than the task needs.
People also ask
What is valid consent under DPDP?
It should be free, specific, informed, unambiguous and linked to a clear purpose.
Can one checkbox cover everything?
That is risky if it hides different purposes like marketing, ads and service messages together.
Can users withdraw consent?
Yes. A practical withdrawal path is part of responsible consent design.
How many trackers run on your pages? Does your privacy policy name them? Can you answer a data-rights email? If you don't know, we can help you find out.
Talk to Meridian Bridge Strategy →Your personal data belongs to you. You can ask a company what it holds and how to raise a privacy request. The response depends on the applicable duties, identity checks and any retention requirements.
Get the template email →The public report shows what we found in the company records. Check the observation dates and method.