Granular vs bundled consent: why one “I agree” fails, and how to split by purpose

At a glance

Under India’s DPDP Act consent is per purpose, so one blanket “I agree” covering several uses — bundled consent — doesn’t hold. Granular consent splits the ask: a separate, unticked opt-in for each distinct purpose, so a person can agree to the thing they came for and decline the rest. If a customer can’t say yes to appointment reminders without also saying yes to marketing, your consent is bundled — and invalid for the parts they didn’t actually want.

Educational resource only. This explains granular versus bundled consent under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

On this page

• Why bundled consent breaks
• What counts as a separate “purpose”
• How to split consent granularly
• The service-vs-extras line
• FAQ

The situation

Bundling is the most common consent mistake: a single checkbox, or just the “Submit” button, standing in for agreement to everything a business might do with the data. It feels efficient. But it collapses several distinct decisions into one, which the DPDP Act’s per-purpose standard doesn’t accept.

Why bundled consent breaks

Consent has to be specific to a purpose — so one tick can’t validly cover unrelated uses. The Act requires consent to be specific (Section 6): tied to a particular, named purpose. A single “I agree” that covers appointment reminders, marketing, analytics, and sharing with partners isn’t specific to any of them — the person never made a distinct choice about each. So even if they ticked it, the consent is invalid for the purposes they wouldn’t have chosen on their own. Bundling doesn’t get you more consent; it gets you unreliable consent.

What counts as a separate “purpose”

Different reasons to use the data are different purposes — even if they use the same field. A phone number collected to send an OTP, to send delivery updates, and to send promotions is one field, three purposes. The test isn’t the data type; it’s the reason. Rough guide:

• Core service delivery (what the person came for) — one purpose.
• Marketing / promotions — a distinct purpose, always its own opt-in.
• Sharing with third parties / partners — distinct.
• Analytics / profiling — distinct.

If two uses could sensibly get different answers from the person, they’re different purposes.

How to split consent granularly

Give each purpose its own unticked opt-in, in plain language. In practice:

“☐ Use my number to send appointment reminders. ☐ Send me occasional offers and health tips by SMS. ☐ Share my details with partner labs for test bookings.”

Three separate, unticked choices — the person can take the first and leave the rest. Contrast the bundled version:

“☐ I agree to the terms and to receive communications from us and our partners.”

Keep the opt-ins genuinely independent — declining marketing must not block the core service (more on that below), and each choice should be recorded separately so you can prove exactly what was agreed.

The service-vs-extras line

You can require the data your service genuinely needs — you can’t make unnecessary consents a condition of it. Consent has to be free and unconditional, so you can’t hold the core service hostage to marketing consent. A gym can require the details it needs to run your membership; it can’t refuse membership because you declined promotional messages. The clean pattern: the data necessary for the service is handled as such (with notice, and often as a straightforward requirement), while the extras — marketing, sharing, profiling — are separate, truly optional opt-ins the person can decline without losing the service.

FAQ

Why isn’t one “I agree” checkbox enough under the DPDP Act? Because consent is per purpose. A single tick covering several unrelated uses isn’t specific to any of them, so it’s invalid for the purposes the person wouldn’t have chosen separately.

What’s the difference between granular and bundled consent? Granular consent gives each purpose its own separate opt-in; bundled consent lumps multiple purposes into one agreement. The Act requires the granular approach.

Can I refuse service if someone won’t agree to marketing? No. Consent must be free and unconditional. You can require data the service genuinely needs, but not make an unnecessary consent (like marketing) a condition of the service.

How many opt-ins do I need? As many as you have distinct purposes. If a use could get a different answer from the person, it deserves its own opt-in.