Consent Management
SL-03Granular, purpose-bound consent with multilingual notices, one-click withdrawal, an immutable artefact trail and interoperability with registered Consent Managers. Consent that cannot be withdrawn as easily as it was given is not consent under the Act.
8 guardian verifications awaiting review
Children's personal data cannot be processed until verifiable consent of a parent or lawful guardian is obtained. Section 9 carries a ceiling of ₹200 crore.
Consent artefacts
11.5 L
Across all purposes and channels
Active
56%
78 of 140 sampled
Withdrawal rate
21%
ViewExpired
19
Renewal campaign required
Children's consents
13
ViewPublished notices
4
2 in draft or review
ViewConsent volume
Grants and withdrawals over twelve months. A rising withdrawal rate usually signals a notice problem, not a product problem.
Collection channel
Where consent is actually captured.
- Web portal49
- Mobile app30
- Service kiosk17
- Paper form (digitised)17
- SMS10
- Consent Manager10
Consent by purpose
Only purposes relying on consent as their ground appear here; legitimate-use purposes have no consent to count.
Active campaigns
Re-consent, renewal and notice-update campaigns currently running.
- RunningNotice v3.2 re-consent — Family IDSMSWeb portalMobile app
- Audience
- 4.12 L
- Delivered
- 3.86 L
- Responded
- 56%
- Withdrawn
- 16.2 K
- RunningScholarship consent renewal — AY 2026-27SMSWeb portal
- Audience
- 84.2 K
- Delivered
- 81.9 K
- Responded
- 64%
- Withdrawn
- 2.3 K
2 notices are not published
Skill development enrolment notice, AI-assisted query handling notice. A notice must be served before or at the time consent is sought — serving it afterwards does not cure a defective consent.
Related
Purpose registryEvery purpose, its lawful ground, the data it may touch and the retention that follows. Purpose limitation is enforced downstream from here.Withdrawal propagationWhich systems have actually stopped processing after a withdrawal — and which have acknowledged but not acted.Consent ManagersInteroperability with Board-registered Consent Managers under Section 6(7) and Rule 4.Consent mappingWhich personal data elements are bound to which consent, and which have no recorded ground at all.