Introduction
The foundational pillar of the Digital Personal Data Protection (DPDP) Act, 2023, is the empowerment of the Data Principal (the user) through verifiable consent. The law mandates that consent must be free, specific, informed, unconditional, and an unambiguous indication of intent. On paper, this is a triumph for privacy rights. In practice, it threatens to create a digital landscape paralyzed by "Consent Fatigue."
Consent fatigue occurs when users are bombarded with so many privacy notices, cookie banners, and terms of service pop-ups that they stop reading them entirely. They blindly click "I Agree" just to access the content they want, completely defeating the legislative goal of "informed" consent.
The GDPR Warning Sign
We do not have to guess what consent fatigue looks like; Europe's GDPR provided a live demonstration. Following the enforcement of GDPR, European websites became unnavigable labyrinths of cookie banners. Studies showed that the vast majority of users clicked "Accept All" simply because it was the path of least resistance, not because they actually understood the data processing implications.
If the DPDP Act leads to every Indian app and website deploying a mandatory, multi-page consent wall before a user can even view a homepage, the law will have failed its primary objective.
The DPDP Act's Unique Solution: Consent Managers
The drafters of the DPDP Act recognized this threat and introduced a novel, uniquely Indian solution: Consent Managers.
A Consent Manager is a Data Protection Board-registered entity that acts on behalf of the Data Principal. It provides an interoperable platform—likely built on top of India's Digital Public Infrastructure (similar to the Account Aggregator framework or UPI)—where users can manage all their consent preferences from a single dashboard.
How It Works in Practice
Instead of managing 50 different privacy toggles on 50 different apps (Swiggy, Zomato, Uber, MakeMyTrip, etc.), a user will interact with their chosen Consent Manager. The user can set global preferences (e.g., "Never share my location for marketing"). When a new app requests data, the request routes through the Consent Manager, which automatically approves or denies it based on the user's pre-set rules, eliminating the need for a repetitive pop-up on the app itself.
The Burden on Data Fiduciaries
While Consent Managers solve the fatigue problem for users, they create a significant technical challenge for Data Fiduciaries (businesses). Businesses must build APIs to interface seamlessly with these third-party Consent Managers.
If a user revokes consent via their Consent Manager app at 2:00 AM, the Data Fiduciary's backend systems must receive that webhook and instantly halt data processing without any human intervention.
Conclusion
Consent fatigue is the enemy of genuine privacy. The DPDP Act’s success hinges almost entirely on the technical execution and widespread adoption of the Consent Manager framework. If it works, India will have leapfrogged the GDPR's clunky cookie banners. If it fails, Indian consumers will simply trade their privacy for convenience, one blindly clicked "I Agree" button at a time.
