Consent Under Scrutiny: The Statesman Highlights Data Protection Challenges in India’s New Digital Era

India’s digital privacy landscape is undergoing a seismic shift with the implementation of the Digital Personal Data Protection Act, 2023 and the proposed Data Protection Rules, 2025. In a recent editorial published on August 30, 2024, The Statesman raised critical questions about how consent is being sought, managed, and interpreted under this new regulatory framework. The article focuses particularly on the complexities of obtaining valid consent, especially from vulnerable groups such as children and persons with disabilities, and the broader implications for digital service providers.

The Statesman’s coverage comes at a time when organizations across sectors are updating their privacy policies and consent mechanisms to comply with the new law. The editorial underscores the urgent need for clarity, accountability, and technological innovation in how personal data is collected and processed.

Key Highlights from the Editorial

- The Digital Personal Data Protection Act, 2023 mandates verifiable parental consent for children under 18  
- The Statesman questions the practicality and reliability of current verification methods  
- Consent Managers are introduced as third-party entities to manage and standardize digital consent  
- Ambiguities in the law may lead to legal disputes and limit access to child-focused digital services  
- The editorial calls for stronger safeguards and clearer implementation guidelines  

Understanding the Consent Framework

Under the new law, consent is the cornerstone of lawful data processing. Section 4 of the Act states that personal data may only be processed with the individual’s consent or for legitimate uses defined by the legislation. Section 5 further requires that consent requests be accompanied by a clear notice detailing what data is being collected, why, and how users can exercise their rights.

However, The Statesman points out that the law does not mandate disclosure of third-party data sharing, nor does it offer a robust roadmap for verifying parental identity. This gap is especially concerning given India’s diverse family structures and the sheer scale of its online child population.

- Over 624 million children were online in India as of 2021  
- Verification methods like self-declaration and document uploads are prone to misuse  
- Determining legal guardianship in non-traditional households remains a challenge  

The Role of Consent Managers

To streamline consent processes, the Act introduces Consent Managers—independent entities registered with the Data Protection Board. These managers serve as intermediaries between users and data processors, enabling individuals to give, review, and withdraw consent through a standardized digital platform.

The editorial draws parallels with Account Aggregators in the financial sector, who perform similar functions for financial data. While the concept is promising, The Statesman warns that the lack of operational clarity and high implementation costs could deter smaller firms from adopting these systems.

- Consent Managers operate under an electronic consent framework set by MeitY  
- They are responsible for ensuring transparency and interoperability in consent handling  
- Smaller companies may struggle with the cost and complexity of integration  

Risks and Unintended Consequences

The editorial cautions that the ambiguity surrounding verifiable consent could lead to unintended consequences. For instance, companies may choose to avoid offering services to children altogether to sidestep compliance risks. This could stifle innovation in educational apps, games, and other child-centric platforms.

Moreover, the strict liability approach—similar to GDPR in Europe—could expose intermediaries to penalties even when children provide false information. This raises questions about the fairness and feasibility of enforcement.

- Legal uncertainty may discourage development of child-friendly digital services  
- Privacy concerns complicate parental identity verification  
- Intermediaries face liability risks despite limited control over user declarations  

Looking Ahead

The Statesman’s editorial serves as a timely reminder that consent is not just a checkbox—it is a dynamic and complex process that must be handled with care. As India moves toward full implementation of its data protection framework, stakeholders must collaborate to refine consent mechanisms, protect vulnerable users, and ensure that digital rights are upheld without compromising innovation.

Sources: The Statesman, Ahlawat & Associates, Economic Times.