Negative Consent

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), consent must be free, specific, informed, and unambiguous, with a clear affirmative action by the Data Principal. Negative consent, where an organization assumes consent because an individual does not object, ignores a message, or fails to take an action, does not meet the requirements of valid consent under the Act.

The DPDP Act requires Data Fiduciaries to obtain consent through a clear affirmative action before processing personal data where consent is the applicable basis for processing. Consent mechanisms must provide individuals with a meaningful choice and cannot rely on pre-selected options, silence, or inactivity as an indication of agreement. Organizations must also provide a clear mechanism for withdrawal of consent.

Negative consent practices can reduce transparency and limit the ability of Data Principals to make informed choices about their personal data. Organizations need to ensure that consent journeys clearly explain the purpose of processing, provide active choices, maintain consent records, and respect withdrawal requests in accordance with the DPDP framework.

In practice, gaps emerge when:

• Organizations treat lack of response as consent.
• Consent options are pre-selected by default.
• Data Principals are not required to actively provide consent.
• Consent records do not capture affirmative actions.
• Withdrawal of consent is difficult or unavailable.

Organizations address these challenges by implementing affirmative consent mechanisms, maintaining consent records, providing clear notices, enabling easy withdrawal, and regularly reviewing consent practices. Within Privy, capabilities such as consent management, preference workflows, consent tracking, and audit-ready reporting help organizations manage valid consent processes aligned with DPDPA requirements.