At a glanceYou can withdraw the consent you gave an app or service at any time — and under India’s DPDP Act, withdrawing must be as easy as giving it was. Once you withdraw, the company must stop the data use that relied on your consent and, in most cases, move to delete your data. You do it through the app’s privacy settings or by a written request to its privacy contact.
Educational resource only. This explains how to withdraw consent under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.
The situation
An app you barely use has permission to hold your phone number, contacts and ID — permission you clicked past at sign-up. You want to pull that permission without deleting your whole account, and you’re not sure you’re allowed to. You are, and it’s meant to be simple.
What withdrawing consent actually does
Withdrawing consent revokes the permission a company relied on to use your data — going forward.
When you agreed to an app using your data, that consent was tied to specific purposes. The DPDP Act lets you withdraw that consent whenever you choose (Section 6). Once you do, the company must stop the processing that depended on it. It also typically triggers your right to erasure — with consent gone and the purpose ended, there’s usually no lawful basis left to keep the data, so it should be deleted.
Withdrawal works forward, not backward: it doesn’t make past, lawful use retroactively illegal, but it stops future use from the point you withdraw.
The rule that protects you: as easy to withdraw as to give
The Act explicitly requires that pulling consent be no harder than granting it was.
This is the load-bearing protection. If giving consent was one tap at sign-up, withdrawing it can’t be a buried, multi-step obstacle course or a “call our office during working hours” runaround. The law puts withdrawal on the same footing as consent deliberately — so companies can’t make the exit far harder than the entrance. If a service makes withdrawal deliberately painful, that itself falls short of the Act.
How to withdraw, step by step
Use the built-in setting if there is one; otherwise put your withdrawal in writing.
- Check in-app first. Look under Settings → Privacy / Permissions / Consent. Many services now offer a direct toggle or “manage consent” option — the fastest route.
- If there’s no toggle, write to them. Email the company’s privacy contact or grievance officer / Data Protection Officer (listed in its privacy notice). State clearly that you are withdrawing your consent under the DPDP Act.
- Be specific about scope. Say whether you’re withdrawing consent for everything, or for a particular purpose (for example, marketing messages but not the core service you still use).
- Pair it with a deletion ask if you want the data gone. Add that you also want your personal data erased now that consent is withdrawn, and request written confirmation.
- Keep a record. Save the request and any reply, in case you need to escalate.
Compliant vs not — how to tell:
| Compliant withdrawal | Not compliant |
|---|---|
| A clear in-app toggle or “manage consent” option | No option anywhere, and no reachable contact |
| A privacy contact who acts on a written request | Being told withdrawal “isn’t possible” |
| Withdrawal roughly as easy as sign-up was | A deliberately buried, multi-hoop process |
| Data use stops after you withdraw | Messages/processing continue as before |
What withdrawal won’t switch off
Some data use doesn’t depend on your consent, so withdrawing consent won’t stop it.
Keep one thing in mind so you’re not surprised. The Act allows certain legitimate uses that don’t run on consent at all — for instance data you provided voluntarily for a service you’re actively using, or specific legal and state functions. Where a use is lawful without consent, withdrawing consent won’t turn it off. Likewise, a company can still hold specific data it’s legally required to retain (such as certain tax or KYC records). These are narrow limits, not a loophole that cancels your control.
FAQ
Can an app refuse to let me withdraw consent?
No. The right to withdraw exists under the Act, and withdrawal must be as easy as giving consent was. A service can’t simply refuse.
Will withdrawing consent delete my data?
It usually should — with consent gone and the purpose over, there’s typically no basis to keep it. Make an explicit erasure request and ask for confirmation to be sure.
Do I have to close my whole account to withdraw consent for marketing?
No. You can withdraw consent for a specific purpose (like marketing) while continuing to use the core service you still want.
What if withdrawing is deliberately hard to find?
A deliberately obstructive process falls short of the Act’s “as easy to withdraw as to give” rule. Raise it through the grievance channel, then the Data Protection Board of India if unresolved.